Every crypto project eventually hires outside help. A market maker to seed liquidity, a marketing or KOL agency to build awareness, a PR firm to place coverage, an audit shop to sign off on the contracts, a launchpad to run the raise. The problem is that the Web3 services market has almost no accountability layer. Anyone can spin up a Telegram handle, claim a portfolio of "50+ projects," and quote a retainer with a straight face. Founders routinely wire five and six figures to vendors they met in a group chat three days earlier.
This guide is the buyer-side playbook: how to run real due diligence on a Web3 vendor before money moves, the scam patterns that recur across every service category, and why public ratings and reviews are starting to change the incentives for the whole industry.
Why is vetting Web3 vendors so hard in the first place?
Traditional B2B has friction that punishes bad actors. Companies have registered entities, filed accounts, LinkedIn histories that are expensive to fake, and legal recourse when a contract is breached. Web3 stripped most of that away. Deals close pseudonymously, payments settle in stablecoins with no chargebacks, and "the team" is often three anonymous wallets. When a market maker quietly wash trades your token or an agency delivers bot followers, the cost of getting caught is close to zero because the next project has no easy way to learn what happened to the last one.
That asymmetry is the whole game. Good providers exist in every category, but they compete on the same surface as the scammers, and from the outside a real track record and a fabricated one can look identical. Your job as a buyer is to force verifiable proof out of a market that would rather sell you a story.
What should a due-diligence checklist actually cover?
Before signing anything, work through a fixed checklist for every vendor regardless of category. The specific deliverables differ between a market maker and a PR firm, but the trust questions are the same.
- Verifiable track record. Ask for three to five named recent clients, not logos on a landing page. Logos are free. Named projects you can independently contact are not.
- Live references you actually reach. Message past clients directly through their official channels, not the intro the vendor offers. A referral the vendor controls is a testimonial, not a reference.
- On-chain proof. For anything that touches liquidity or token flow, ask for wallet addresses or exchange accounts tied to prior work so you can inspect the activity yourself.
- Clear scope and deliverables. The contract should specify what gets delivered, by when, and how success is measured. "Marketing services" is not a deliverable.
- Sane payment structure. Milestones, escrow, or monthly retainers with exit clauses. Never a single large upfront wire for a promise.
- Team accountability. At least one real, findable person who signs the agreement and whose reputation is exposed if the work fails.
If a provider resists any of these, that resistance is the finding. Legitimate vendors are used to diligence and expect it. The ones who push back hardest are usually the ones with the most to hide.
How do you verify a track record and check references?
Start with claims you can falsify. If an agency says it drove a specific campaign, the coverage, the KOL posts, or the on-chain volume from that period should still be visible. Cross-reference the dates. A common trick is to claim credit for a project's organic success or for work done by a different vendor entirely.
For references, treat this like a hire, because it is. Reach two or three former clients through channels you found yourself. The questions that surface truth are specific and behavioral: Did the volume or coverage survive after the contract ended? Did the vendor communicate when something went wrong, or go quiet? Would you rehire them, and if not, exactly why? A vendor with a clean history will have several clients happy to answer. A vendor who can only produce one carefully coached contact is telling you something.
What does on-chain proof look like for a market maker?
Market making is where verification matters most, because the entire product is trading activity and trading activity is easy to fake. A legitimate market maker provides tight, consistent spreads and genuine two-sided depth. A bad one manufactures volume that looks impressive on a screener but represents no real buyers.
Ask for the specific pairs and exchanges a candidate currently supports, then look at the order books yourself. Real liquidity shows depth on both sides across price levels. Wash trading shows a repeating pattern of the same size trades bouncing between a small set of addresses, high reported volume with thin actual depth, and price action that snaps back instantly after any real order. Academic and industry analysis in 2026 continues to find that a meaningful share of reported volume on automated market makers is wash traded, so treat headline volume numbers as a claim to verify rather than a result to celebrate.
On fees, a straightforward market making engagement is typically a monthly retainer in the low thousands to low tens of thousands of dollars, sometimes paired with a token loan or option structure instead of cash. Exact figures vary widely by scope, number of venues, and depth targets. What should worry you is any market maker who leads with a promise to "pump the chart" or hit a target price. That is manipulation, not liquidity, and it puts your project on the wrong side of exchange surveillance.
Which scam patterns show up across every category?
The service types differ but the cons rhyme. A handful of patterns account for most of the damage.
| Red flag | What they say | What it usually means |
|---|---|---|
| Full payment upfront | "We need 100% before we start, standard in the space." | No incentive to deliver once the wire clears. High disappearance risk. |
| Guaranteed listings | "We guarantee a Tier 1 exchange listing." | Major exchanges decide independently. The "guarantee" is a bribe fantasy or a lie. |
| Guaranteed price or volume | "We'll get you to a $50M market cap." | Wash trading and fake volume. Cosmetic numbers that collapse and invite delisting. |
| Fake or bot reach | "250K followers, huge engagement." | Purchased followers and engagement pods. No real audience, no conversions. |
| Anonymous, unaccountable team | "We keep the team private for security." | No one to hold responsible when the work fails. Nothing at stake. |
| Pressure and urgency | "This rate is only good until Friday." | Manufactured urgency to skip diligence. A tactic, not a deadline. |
| No written scope | "We'll figure out the details as we go." | Nothing to enforce. Every dispute defaults to the vendor's version. |
None of these is subtle once you know the pattern. The reason they keep working is speed. Founders under launch pressure skip the questions that would expose them.
How should contracts, escrow, and milestones be structured?
The single best protection is a payment structure that keeps the vendor motivated after the contract starts. For agencies and PR, that means a monthly retainer, typically several thousand to low tens of thousands of dollars depending on scope, with the right to stop after each month if deliverables slip. Never buy a six-month package in one wire.
For discrete deliverables such as an audit, a listing consultation, or a campaign sprint, tie payment to milestones. Pay a deposit, then release the balance when the work is verifiably done. Where trust is thin, use an escrow arrangement so a neutral party holds funds until an agreed condition is met. The contract should name the deliverable, the deadline, the acceptance criteria, and the remedy if the vendor fails. If a provider refuses milestones or escrow, they are asking you to carry all the risk, which is the opposite of what you are paying for.
One category-specific note: for exchange listings, understand that legitimate costs are paid to the exchange, not routed through a "connector" who guarantees the outcome. Listing budgets vary enormously by tier and can run from low thousands on smaller venues to well into six figures on major ones, and no consultant can override an exchange's own review. Anyone guaranteeing a Tier 1 listing for a fee is selling you a story.
How do public ratings and reviews change the game?
Everything above is manual work that each buyer has to repeat from scratch, which is exactly why scams persist. The structural fix is an accountability layer: a public, persistent record of how vendors actually performed, tied to identities they cannot easily discard.
When a market maker's spread history, an agency's real campaign results, or a launchpad's post-listing performance become searchable and reviewable, the economics flip. A bad outcome stops being a private loss for one project and becomes a permanent, visible cost to the vendor. Providers who deliver accumulate reputation that compounds. Providers who wash trade or vanish accumulate a record that follows them. Ratings do not replace diligence, but they turn a one-shot gamble into a repeated game, and repeated games are where reputation finally starts to matter. That is the shift the Web3 services market has been missing.
Until that layer is universal, run the checklist every time, insist on verifiable proof, and never let launch urgency talk you out of the questions that protect you. If you want to work with vetted providers and build a track record buyers can actually check, see how Zupai is building accountability into Web3 outreach.