A $40 million allocation cleared an investment committee in Riyadh last quarter on the strength of a nine-dimension risk scorecard. Every row was green. Every cell was populated. The composite verdict: no red flags identified.
The underlying document contained one usable noun โ the project's name. Everything else was placeholder. Team: N/A. Supply schedule: N/A. Audit status: N/A. Governance concentration: N/A. Nine tables, forty-one empty metrics, zero facts extracted from source material.
The reviewer read "information unavailable" as "no adverse information found." Those are not the same sentence. One is a statement about the analyst's ignorance. The other is a claim about the world. The committee approved the second while reading the first.
I have spent eighteen years building and breaking diligence systems. I have never seen a failure mode this cheap to produce and this expensive to survive. Cheap, because it takes no effort. Expensive, because it scales.
Institutional crypto diligence has industrialized. A three-analyst, three-week manual review is now a pipeline: scraper, extractor, framework, scorer, deck. Templates are standardized โ nine dimensions, forty to sixty metrics, color-coded output. Funds buy the tooling because headcount does not scale with deal flow, and deal flow in a bull market is a flood. I have reviewed eleven such pipelines in the past year. Eight share the same architectural defect.
The defect is not the model. It is the contract between the extractor and the scorer.
A pipeline has four stages. Ingestion pulls source material. Extraction converts text into structured fields. Scoring maps fields to risk levels. Presentation renders the result for humans. Each stage has a type contract. The extractor promises a field exists. It does not promise the field is non-null.
So when ingestion returns an empty shell โ a failed crawl, a paywalled source, a PDF that parsed to whitespace โ extraction dutifully returns a schema with every key present and every value empty. The scorer receives a well-typed object. It scores it. N/A flows through the arithmetic and emerges as neutral. Neutral is green. Green is a pass.
Nothing in the pipeline lied. That is what makes it dangerous.
Failure mode one: the null-value collapse.
Any engineer who has written Solidity knows the pattern. A mapping returns zero for an unset key. There is no distinction between "this address holds zero tokens" and "this address was never initialized." The language gives one value for two states. Diligence schemas do the same thing with strings.
A missing value and a benign value are structurally identical in every scoring framework I have audited. Both render as empty. Both aggregate as neutral. The difference between "we could not determine the admin key holder" and "the admin key is a 4-of-7 multisig with published signers" is the entire investment thesis. In JSON, it is a null versus a string. Downstream, it is the same pixel of green.
The fix is trivial and almost nobody implements it. Distinguish undefined from empty. Force the extractor to emit provenance โ a byte offset or verbatim quote โ for every populated field. Reject any artifact where coverage falls below a threshold. I built that into my own tooling in 2019, after the 0x Protocol engagement taught me what happens without it. In 2018 I spent six weeks modeling integer overflow edge cases in the 0x settlement contract while the market priced the token on narrative. The bug was real. The report halted deployment. That outcome was possible only because I had source code in front of me. Six weeks of rigor beats six seconds of cleverness โ but only when the input exists.
Failure mode two: confidence laundering.
The placeholder annotated every dimension with a confidence level. Low confidence, it said. That is honest at the extraction layer. It is a lie by the time it reaches the investment committee.
Here is the chain. Extraction tags confidence. The framework strips it, because the framework's schema has no confidence field. The scorer produces a number. The deck rounds the number. The memo describes the number in prose. Four hops later, a statement of ignorance has become a statement of fact. Provenance decays geometrically with each transformation, and no node in the chain is being dishonest โ each merely consumes the previous node's typed output as ground truth.
I saw the same decay in 2021, in a different register. Tracing wallet clusters behind the top NFT collections, I found that eighty-five percent of reported trading volume came from self-custodied wallets trading with themselves. The floor price metric was not wrong. It was answering a question nobody had asked. It measured transfer events. It did not measure demand. Hype is leverage in reverse: it magnifies the position you did not know you were holding.
Failure mode three: false-negative economics.
Diligence errors are asymmetric, and the incentives are aligned with the wrong side. A false positive โ flagging a safe project as risky โ costs two days and one awkward call. It is visible, embarrassing, punished. A false negative โ clearing an unsafe project โ costs the position. It is invisible at the moment of decision. It surfaces eighteen months later, after the lockup, in a different reporting period, attributed to "market conditions." Nobody is punished, because nobody can prove the counterfactual.
So pipelines are tuned for throughput. Coverage thresholds are set where they clear the queue. When I audited one vendor's configuration last year, the minimum extraction count required before a report would render was zero fields. The report always renders. That is the product. Code is law, but capital is king โ and here, capital moved on a report that never had a subject.
One more mode. Partial data is more dangerous than no data. A blank schema reads as blank to anyone paying attention. A schema populated at forty percent reads as complete, and the missing sixty is invisible precisely because the page looks full. In the FTX aftermath I traced over $2 billion in commingled ALGO and ADA across wallets that presented as segregated. The balance sheet was populated. It was wrong. Empty is loud. Incomplete is silent.
Credit where owed: the pipeline that produced the Riyadh artifact did not hallucinate. It refused to invent a team, a supply schedule, an audit. In a market where language models will confidently fabricate a tokenomics table from a press release, a system that returns N/A shows more integrity than most analysts.
The framework was not broken. It did what a good framework does โ it made the absence of evidence legible. Nine dimensions of nothing is a precise signal. It says the source material is empty. That is information.
The failure was one layer up, at consumption. A human saw a filled template and read completeness. That is not a tooling problem. That is a reading problem, and no vendor can patch it. The correct response to this artifact was not a risk score. It was a stop-work order. The template was a smoke detector. Someone painted it green and called it a ceiling.
The bulls are half right. Automated diligence creates the paper trail that makes failure attributable. It does not create the judgment that reads it.
The next institutional cycle will not be won on better models. It will be won on data lineage โ attested provenance for every field, defined-versus-empty typing, and coverage thresholds that hard-fail a report instead of rendering a green shell. Ask your diligence vendor one question before the next allocation: show me the raw extraction, not the scorecard. If they cannot produce offsets behind every populated cell, you are not reading analysis. You are reading a template that has learned to look confident.