HostHostDeFi › Library
The library
Sourced verdicts on whether crypto platforms, wallets and tools are legit — and the mechanics behind every major scam pattern. Every file names its sources and its date; nothing here is a rewrite of someone else's article.
Free · 100 checks/day · Solana & EVM
Legitimacy verdicts — protocols & platforms
Is Aave legit? Nine years of lending history and a public stress record
Is Aave legit? Live as ETHLend since 2017 — the largest DeFi lending protocol, formal-verified, DAO-run since,…
Read the file →Is Aerodrome legit? Base's native liquidity hub, verified
Aerodrome verdict: legitimate — the dominant Base DEX, ve(3,3) model done right, Velodrome lineage, real,…
Read the file →Is Arbitrum legit? The largest Ethereum L2 and the company behind it
Is Arbitrum legit? Offchain Labs — a Princeton spinout, Ed Felten, $120M+ raised, the largest Ethereum L2,…
Read the file →Is Aster legit? The Binance-orbit DEX that flipped the leaderboard inside a week
Is Aster legit? A real YZi Labs-backed company that flipped Hyperliquid's volume in a week — plus,…
Read the file →Is Backpack legit? The exchange born inside FTX's wreckage that bought a piece of it back
Is Backpack legit? Coral's exchange — born from a $14.5M FTX loss, licensed in Dubai, and the buyer of,…
Read the file →Is Balancer legit? The OG AMM's security file
Balancer verdict: legitimate — the OG programmable-liquidity AMM since 2020, real team, real audits — plus,…
Read the file →Is Base legit? Coinbase’s L2, and what that does and doesn’t mean
Is Base legit? Coinbase’s Ethereum L2 — Aug-2023, OP Stack, no native token, biggest L2 by activity,…
Read the file →Is Binance legit? The biggest venue with the biggest settlement
Is Binance legit? The largest exchange on earth — a $4.3B DOJ plea, a 5-year monitorship, and a spotless,…
Read the file →Is Birdeye legit? The data layer half of Solana trading quietly runs on
Is Birdeye legit? Solana's default trading-data layer — ex-Solscan founder, 4,000+ enterprise clients, and,…
Read the file →Is Blur legit? The NFT marketplace's file
Blur verdict: legitimate — the pro-trader NFT marketplace that took OpenSea's crown, Paradigm-backed,…
Read the file →Is Bybit legit? The exchange that survived crypto's largest theft
Is Bybit legit? A real Dubai-licensed exchange since 2018 that survived the largest theft in crypto history,…
Read the file →Is Coinbase legit? The only crypto exchange Wall Street audits
Is Coinbase legit? A NASDAQ-listed company since Apr-2021, custodian for most US spot Bitcoin ETFs, audited,…
Read the file →Is Compound legit? DeFi lending's origin story, verified
Compound verdict: legitimate — the protocol that invented yield farming in 2020, institutional-grade lending,…
Read the file →Is Convex legit? The Curve yield layer's file
Convex verdict: legitimate — the dominant Curve yield optimizer since 2021, $B-scale TVL, the ve-model's,…
Read the file →Is Curve legit? The exchange's real security file
Curve Finance verdict: legitimate OG DeFi — the deepest stablecoin venue since 2020, a real governance,…
Read the file →Is DeBank legit? The portfolio tracker, verified
DeBank verdict: legitimate — the standard DeFi portfolio tracker, real company since 2019, read-only by,…
Read the file →Is Drift legit? Solana's perp DEX, verified
Drift verdict: legitimate — Solana's native perpetuals exchange, real volume since 2021, doxxed team,…
Read the file →Is dYdX legit? The OG perp venue's full record
dYdX verdict: legitimate — the decentralized perp pioneer, now its own Cosmos chain, backed by,…
Read the file →Is EigenLayer legit? Restaking's real risk file
EigenLayer verdict: legitimate — the restaking protocol that built a new security category, $100M+ a16z,…
Read the file →Is Ethena legit? The synthetic dollar that grew faster than anything before it
Is Ethena legit? USDe became one of the fastest-growing dollar assets in crypto history on a delta-hedged,…
Read the file →Is Fluid legit? Instadapp's lending layer, verified
Fluid verdict: legitimate — Instadapp's next-gen lending protocol, real team (doxxed Sowmay/Samyak,…
Read the file →Is Frax legit? The hybrid stablecoin's file
Frax verdict: legitimate — the fractional-reserve stablecoin that shipped FRAX, frxETH, and a real L2.,…
Read the file →Is GMX legit? The fair-launch perp DEX's file
GMX verdict: legitimate — the fair-launched perp DEX paying real yield since 2021, no VC, audited contracts.,…
Read the file →Is Hyperliquid legit? The 11-person exchange doing $140 billion a month
Is Hyperliquid legit? An 11-person, zero-VC exchange doing $140B/month — named founder, self-funded, one,…
Read the file →Is Jito legit? The MEV infrastructure most of Solana actually runs on
Is Jito legit? The MEV infrastructure under most of Solana's stake — named founders, $10M+ raised from top,…
Read the file →Is Jupiter legit? The aggregator that routes most of Solana's swaps
Is Jupiter legit? Solana's default swap layer since 2021 — ~80% of DEX flow, a real DAO, one documented,…
Read the file →Is Kamino legit? The lending market with the audit file to prove it
Is Kamino legit? Solana's largest lending protocol — 18 audits with zero criticals, open-source code, a,…
Read the file →Is Kraken legit? The oldest major exchange with the cleanest custody file
Is Kraken legit? Founded 2011, Wyoming SPDI bank charter, no catastrophic breach in 14 years — plus a $30M,…
Read the file →Is Ledger legit? The most-sold hardware wallet and its most-argued decision
Is Ledger legit? A real Paris company since 2014 — 6M+ devices, ~$450M raised — plus the Recover controversy,…
Read the file →Is Lido legit? The biggest liquid staking protocol, stress-tested publicly
Is Lido legit? The largest liquid staking protocol — live since Dec 2020, ~30% of all staked ETH, audited by,…
Read the file →Is Lighter legit? The perp DEX whose every trade is proven on Ethereum
Is Lighter legit? A real zk-rollup backed by a16z and Founders Fund, with verifiable Ethereum settlement,…
Read the file →Is Magic Eden legit? The dominant NFT marketplace, with one real controversy on file
Is Magic Eden legit? A $1.6B marketplace with named founders and top-tier backers — plus one real controversy,…
Read the file →Is Marinade legit? Solana's oldest staking protocol, built on zero VC money
Is Marinade legit? Solana's first liquid staking protocol since Aug 2021 — zero VC money by its own account,…
Read the file →Is MetaMask legit? The wallet that made Ethereum usable
Is MetaMask legit? A Consensys product since 2016 — Dan Finlay, Aaron Davis, ~30M monthly users — with a real,…
Read the file →Is Meteora legit? Solana's dynamic liquidity, verified
Meteora verdict: legitimate — Solana's dynamic-liquidity engine (DLMM), Jupiter-lineage team, powers,…
Read the file →Is Morpho legit? The new lending standard's file
Morpho verdict: legitimate — the isolated-market lending protocol that grew into Aave's real rival,…
Read the file →Is OKX legit? The exchange that pleaded guilty and kept operating
Is OKX legit? A real exchange since 2017 — and a $505M §1960 guilty plea for >$1T in unlicensed US,…
Read the file →Is OpenSea legit? Eight years, $425M raised, and every scandal survived
Is OpenSea legit? The first major NFT marketplace — founded 2017, $425M+ raised, survived insider-trading,…
Read the file →Is Orca legit? The two-person DEX that out-built the venture stack
Is Orca legit? A two-person bootstrap that became Solana's friendliest swap — doxxed founders, a genuine fair,…
Read the file →Is Pendle legit? The protocol that invented yield trading, five years in
Is Pendle legit? The original yield-tokenization protocol — live since June 2021, ex-Kyber founders, billions,…
Read the file →Is Phantom legit? The most-used crypto wallet, measured by its record
Is Phantom legit? Phantom Technologies Inc. — SF-founded 2021, $150M Series C at $3B (Sequoia/Paradigm), 15M,…
Read the file →Is pump.fun legit? The registered company behind crypto's most accused product
Is pump.fun legit? A real English-registered company with on-chain revenue — and a live SDNY lawsuit plus a,…
Read the file →Is Raydium legit? Solana's original AMM, five years and $300B later
Is Raydium legit? Solana's first major AMM — Feb-2021, $300B+ cumulative volume, LaunchLab — plus the,…
Read the file →Is Rocket Pool legit? Decentralized ETH staking, verified
Rocket Pool verdict: legitimate — the decentralized ETH liquid staking protocol, permissionless node,…
Read the file →Is Sky (MakerDAO) legit? The original DeFi protocol's file
Sky verdict: legitimate — MakerDAO's rebrand, the protocol behind DAI/USDS since 2017, the oldest,…
Read the file →Is Tensor legit? Solana's pro trading venue, built in public since 2022
Is Tensor legit? Solana's pro-grade NFT marketplace — hackathon-born in 2022, Placeholder-backed,…
Read the file →Is Trezor legit? The original hardware wallet, thirteen years on
Is Trezor legit? SatoshiLabs, Prague, 2014 — the first hardware wallet ever, open-source everything,…
Read the file →Is Uniswap legit? The most-audited codebase in DeFi
Is Uniswap legit? Uniswap Labs — Hayden Adams, a16z/Polychain backed, SEC case dropped Feb-2025 — distinct,…
Read the file →Is Velodrome legit? Optimism's liquidity hub, verified
Velodrome verdict: legitimate — the dominant Optimism DEX, ve(3,3) model's best execution, real revenue,…
Read the file →Safety verdicts — wallets, exchanges & tools
Is 1inch safe? The aggregator that lost its own funds, twice, while user funds stayed safe
1inch honestly: non-custodial aggregator, two disclosed resolver-side incidents (Dec-2024 stolen key, Mar-2025…
Read the file →Is Atomic Wallet safe? The self-custody wallet that lost the argument it was making
Atomic Wallet honestly: June 2023 — $35M became $100M+ across 5,500 wallets, Elliptic attributed Lazarus, cause…
Read the file →Is Axiom safe?
Axiom is a real, YC-backed Solana trading terminal — non-custodial via Turnkey wallets or your own. Where the…
Read the file →Is Backpack safe? The FTX survivors who bought FTX Europe
Backpack honestly: self-custody wallet + custodial exchange — FTX-burned, then bought FTX EU for $32.7M and took on…
Read the file →Is Bags.fm safe?
Bags.fm honestly: the fee-share launchpad — creators keep ~50% of fees across up to 100 claimers, 7 modes to 10%,…
Read the file →Is Banana Gun safe?
Banana Gun honestly: the Sept-2024 $3M exploit (11 users, manual drains), the treasury refund, server-side keys —…
Read the file →Is Binance safe? The biggest venue, the insured hack, and the plea deal
Binance honestly: the 2019 hack (7,000 BTC) was covered 100% by its ~$1B SAFU fund — plus monthly PoR, and a $4.3B…
Read the file →Is BingX safe? The exchange that covered $52M and called it minor
BingX honestly: Sept-2024 two-phase drain across 7+ chains hit $43-52M while the exchange called it minor. The cover…
Read the file →Is BitBox02 safe? The Swiss wallet with the boring security file
BitBox02 honestly: open firmware + secure chip, Census Labs audit, reproducible builds, two disclosed…
Read the file →Is bitFlyer safe? The exchange that operates inside the strictest rulebook crypto has
bitFlyer honestly: Japan-licensed since 2017, cold-storage + segregation law, no documented breach — plus the FTX…
Read the file →Is Bitget safe? The second-tier custodian with the biggest stated backstop
Bitget honestly: breach-free exchange since 2018, ~$561M protection fund, 191% PoR — plus the Apr-2025 VOXEL…
Read the file →Is BitMart safe? The exchange whose 'we'll cover it' took a lot longer than its hack
BitMart honestly: Dec-2021 stolen private key → ~$196M from two hot wallets; company pledged compensation — CNBC…
Read the file →Is Bitstamp safe? The 2011 veteran whose only hack taught the industry
Bitstamp honestly: 2015 — phished sysadmin, 19,000 BTC stolen, every user honored in full. EU's first licensed…
Read the file →Is Bloom safe?
Bloom honestly: a TG bot + Chrome extension that runs inside Axiom/GMGN/Photon, plus a web manager — its 1% fee,…
Read the file →Is BullX safe?
BullX NEO safety honestly: generated wallets with one-time key reveal, 1% flat fee, multi-chain scope, wallet…
Read the file →Is Bybit safe? The venue that took crypto's largest-ever hit and stayed open
Bybit honestly: Lazarus stole ~$1.5B (401K ETH) via a poisoned Safe{Wallet} signing UI — crypto's largest heist.…
Read the file →Is Cielo safe?
Cielo honestly: the 30+ chain wallet tracker — subscription revenue, not held keys; read-only tracking by design;…
Read the file →Is Coinbase safe? The public company whose flaw drained 6,000 users — all reimbursed
Coinbase honestly: the only US-listed major custodian — never breached at the exchange level; 6,000 users drained…
Read the file →Is CoinEx safe? The exchange that treated a $70M theft like a billing problem
CoinEx honestly: Sep-2023 hot-wallet key leak, ~$70M out, Lazarus suspected — security fund covered 100%, rebuilt in…
Read the file →Is Coinomi safe? The wallet that spell-checked a seed phrase
Coinomi honestly: its 2019 desktop app sent seed phrases to Google's spellcheck API — a real leak, an unproven…
Read the file →Is Coldcard safe? The Bitcoin wallet whose seeds came out weak — and got stolen
Coldcard honestly: the July-2026 seed-entropy bug let attackers regenerate weak seeds offline and steal funds — what…
Read the file →Is Crypto.com safe? The venue that watched 2FA fail and paid every cent back
Crypto.com honestly: Jan-2022, attackers bypassed 2FA on 483 accounts and pulled ~$34M — all reimbursed same-day.…
Read the file →Is Deribit safe? The options venue whose $28M loss cost the user nothing — then sold for $2.9B
Deribit honestly: Nov-2022 wallet-server compromise took $28M from hot wallets; 99% cold, reserves covered same-day;…
Read the file →Is Ellipal safe? The 'fully air-gapped' wallet a lab extracted in an afternoon
Ellipal honestly: Ledger Donjon dumped the EC-01's flash and brute-forced its password in minutes — no SE, radios…
Read the file →Is Exodus safe? The cleanest closed-source record that still answers to your OS
Exodus honestly: unbreached at wallet level for a decade, Cure53-audited, HackerOne bounty — but closed-source, keys…
Read the file →Is Gate safe? The oldest exchange in the set — hack survivor, PoR pioneer
Gate.io honestly: founded 2013 as Bter, lost 7,170 BTC in 2015, then became the FIRST exchange with audited 100% PoR…
Read the file →Is Gemini safe? The regulated custodian whose product failed the counterparty test
Gemini honestly: no exchange breach on record — but Earn lent to Genesis, which took ~$940M down in 2022. Users got…
Read the file →Is GMGN safe?
GMGN.ai honestly: the hosted wallet whose keys you can't export — even for imported wallets — the 1% fee, and what…
Read the file →Is HTX safe? The exchange that got hit four times — and covered every time
HTX (ex-Huobi) honestly: four incidents in ~2 months of late 2023 — Sep 5,000 ETH, Poloniex $114M, HECO $86M —…
Read the file →Is Hyperliquid safe?
Hyperliquid honestly: crypto's biggest perp venue — own L1, USDC bridge custody, the Dec-2024 Lazarus probing and…
Read the file →Is Blockstream Jade safe? The wallet that outsourced the secure element
Blockstream Jade honestly: no secure element — a blind PIN oracle does that job. What the virtual-SE model protects,…
Read the file →Is Keystone safe? The air-gapped wallet that opened what everyone else closed
Keystone honestly: QR-only signing, three secure elements, the first open-sourced SE firmware, published audits,…
Read the file →Is Kraken safe? The exchange that invented proof of reserves — and stayed unbreached
Kraken honestly: 14+ years without a user-fund breach, inventor of proof-of-reserves (2014), still publishing…
Read the file →Is KuCoin safe? The exchange that lost $281 million and made users whole anyway
KuCoin honestly: Sep-2020, $281M drained via leaked hot-wallet keys — then 84% recovered, 16% insured, zero user…
Read the file →Is Kwenta safe?
Kwenta honestly: acquired by Synthetix (Nov-2024), relaunched as Synthetix Exchange — the non-custodial perps…
Read the file →Is Ledger safe? The device that never lost a key — and the company that lost its customers
Ledger honestly: Secure Element keys never extracted remotely — but the 2020 breach leaked 272K buyers' home…
Read the file →Is LetsBonk safe?
LetsBonk honestly: the BONK launchpad on Raydium rails — self-custody signing, 1% fee routed to buybacks, dynamic…
Read the file →Is Luno safe? The exchange that lent to its own sibling and still protected the customer
Luno honestly: DCG-owned, Mazars-audited reserves, clean custody — its savings product lent to sister firm Genesis,…
Read the file →Is Maestro bot safe?
Maestro honestly: 14 chains, $12.8B+ volume, ~1% fee — the Oct-2023 router exploit, the 610 ETH refund, and the…
Read the file →Is MetaMask safe? The wallet that was never breached — and why users still lose funds daily
MetaMask honestly: self-custody SRP, never breached at wallet level — and the most-phished brand in crypto. What…
Read the file →Is Meteora safe?
Meteora is Solana's deepest liquidity stack — DLMM, DAMM, DBC launch curves — audited and non-custodial, but 'safe'…
Read the file →Is MEXC safe? The listing machine with verifiable books and an untested record
MEXC honestly: 3,000+ listings, zero-fee model, Hacken-audited PoR >100%, $100M Guardian Fund expanding to $500M —…
Read the file →Is Moonshot safe?
Moonshot app honestly: self-custodial MPC wallet, keys exportable, cash in via Apple Pay — the tiered fees (2.5%/1%)…
Read the file →Is Nova bot safe?
Nova honestly: the Solana-only TG bot — 10 wallets, a security PIN, Nova Click extension, 1% fee plus processor…
Read the file →Is Odin.fun safe?
Odin.fun honestly: the Bitcoin Runes launchpad on ICP — the Aug-2025 $7M liquidity exploit, why users weren't made…
Read the file →Is OKX safe? The exchange that froze for five weeks — then got drained through an old contract
OKX honestly: CEX + self-custody wallet — 2020's five-week withdrawal freeze (unreachable key holder) and the 2023…
Read the file →Is Padre safe?
Padre.gg honestly: pump.fun-owned terminal, 35% cashback economy, server-held keys — and what vertical integration…
Read the file →Is PancakeSwap safe? The DEX whose domain got stolen while its contracts held
PancakeSwap honestly: the contracts held — but a Mar-2021 GoDaddy hijack sent users to a seed-phrase phishing site.…
Read the file →Is PepeBoost safe?
PepeBoost honestly: exportable keys and multi-chain sniping at the small end of the bot market — thin record,…
Read the file →Is Phemex safe? The exchange that lost keys on sixteen chains in one morning
Phemex honestly: Jan-2025 hot-wallet compromise — ~$73–85M across ~16 chains at once (co-located keys inferred); PoR…
Read the file →Is Photon safe?
Photon honestly: the in-browser key shown once with no recovery, a flat 1% fee both ways, five wallets per account —…
Read the file →Is Rabby safe? The wallet built to warn you before you sign
Rabby honestly: DeBank's self-custody EVM wallet — a MetaMask fork with a pre-sign security engine — publicly…
Read the file →Is Raydium safe?
Raydium is Solana's oldest major AMM — real, audited and non-custodial since 2021. What the audits cover, what the…
Read the file →Is SafePal safe? The air-gapped wallet whose lab report came back with asterisks
SafePal honestly: Binance-backed air-gapped S1 at ~$50; Kraken Labs found weak tamper detection + a downgrade path…
Read the file →Is Sniperoo safe?
Sniperoo honestly: the no-Telegram web bot — 0.9% fee undercutting the 1% standard, sub-900ms autosell claims, and…
Read the file →Is Solflare safe?
Solflare honestly: true self-custody (seed phrase, no company recovery), the Shield hardware option, phishing as the…
Read the file →Is Solscan safe? The read-only tool whose risks live in what it displays
Solscan honestly: the leading Solana explorer (3M+ users, Etherscan-owned) — read-only, no keys; its risks are fake…
Read the file →Is SushiSwap safe? The day an approved router became the attacker
SushiSwap honestly: Apr-2023 RouteProcessor2 — a promoted router bug drained users who approved it (~$3.3M one…
Read the file →Is SwissBorg safe? The venue that watched its staking middleware get robbed
SwissBorg honestly: Sep-2025 Kiln supply-chain hit — poisoned API payload hid auth transfers, 192,600 SOL (~$42M)…
Read the file →Is Trezor safe? Open-source custody with a documented 15-minute extraction
Trezor honestly: fully open-source — and Kraken extracted its seed in 15 minutes with $75 of gear. What the…
Read the file →Is Trojan bot safe?
Trojan on Solana honestly: ex-Unibot team, keys encrypted server-side ('non-custodial in design'), 1%/0.9% fees, and…
Read the file →Is Trust Wallet safe? The mobile wallet whose browser extension was weaponized
Trust Wallet honestly: Binance-owned self-custody — and a Dec-2025 leaked-API-key supply-chain attack that drained…
Read the file →Is Unibot safe?
Unibot honestly: the Oct-2023 approval exploit ($640K, 600 wallets), the $1.78M full refund — the largest in bot…
Read the file →Is Uniswap safe? The unexploited protocol with the most-attacked users
Uniswap honestly: never exploited at the contract layer and no custody in either direction — yet Permit2 phishing…
Read the file →Is Uphold safe? The transparent ledger that promoted a loan book it didn't understand
Uphold honestly: live reserves, no exchange breach — but it pushed CredEarn as 'safe/insured' while loans ran to…
Read the file →Is Vector safe?
Vector.fun honestly: Privy-embedded self-custody, skin-in-the-game broadcasts, 1% fee with 75% redistribution — the…
Read the file →Is Viper safe?
Viper honestly: six chains at 0.25% spot — the family's deepest fee undercut — plus its most transparent custody…
Read the file →Is Wasabi safe? The wallet whose best feature was regulated away
Wasabi honestly: no breach, no theft — zkSNACKs killed the CoinJoin coordinator June 2024 under US pressure. What…
Read the file →Is Zengo safe? The wallet that removed the thing everyone else tells you to guard
Zengo honestly: MPC two-share signing kills seed phishing, with a real escrowed company-dies recovery (Chill…
Read the file →Scam mechanics — how the traps work
Address poisoning scams — the lookalike that hijacks your copy-paste
How address poisoning works — dust transactions and lookalike addresses that hijack your copy-paste, with real…
Read the file →Token approval scams — the allowance that keeps stealing
How token approval (allowance) scams work — unlimited grants, dormant thefts, Permit2 off-chain signatures, and how…
Read the file →Honeypot check vs rug check: "can I sell" is not the same question as "can they drain it"
Honeypot check vs rug check on HostDeFi: can you sell, versus can the team drain it. What each reads on Solana,…
Read the file →Fake RPC endpoints — when the node lying to you is the attack
A malicious RPC can show wrong balances, fake state and a chain ID that isn’t the network’s. The attack, and the…
Read the file →Fake staking pool scams
The four shapes fake staking takes — impersonated validators, custodial pools that are just wallets, fake reward…
Read the file →Review an EVM swap allowance before you approve it
What the Approve step on an EVM swap really grants, how to read the spender and amount in the wallet prompt, and…
Read the file →How to check if a crypto airdrop is real — the two-minute verification
How to check if a crypto airdrop is real: the channel test, the claim-transaction read, the drainer pattern — the…
Read the file →Ice phishing — the signature attack that never touches the chain
How ice phishing works — signatures that drain wallets without ever touching the chain, the Permit/Permit2…
Read the file →Pig butchering scams — the long con behind crypto romance fraud
Pig butchering is the biggest crypto fraud by dollar volume — the months-long fake-platform con, how it runs, the…
Read the file →QR code crypto scams — the attack you can't read
A QR code is an address you can’t read. How swapped codes and malicious WalletConnect URIs route your payment to a…
Read the file →Seed phrase scams — every way they ask for the keys
Every shape of seed phrase theft — fake support, fake wallet apps, 'validation' pages, recovery-agent cons — plus…
Read the file →Testnet airdrop scams — the free rehearsal that isn't
The testnet airdrop lure: free “testing tasks”, then a mainnet claim signature that drains. How the bait-and-switch…
Read the file →Wallet drainer scams — how one signature empties a wallet
How wallet drainers actually work — the signature tricks, the fake-site lures, the kit operators behind them, and…
Read the file →HostDeFi is an educational risk tool, not financial advice. On-chain data can be incomplete or manipulated; always do your own research. Free · no signup · a HostDeFi product