TL;DR
– Not investment advice: this article explains how Web3 “investments” work and what can go wrong. It does not tell you to buy anything, and it should not be read that way.
– Five different things: “investing in Web3” can mean buying tokens, shares in companies, exchange-traded products, NFTs, or staking. Each works differently and carries different risks.
– Losses are common and can be total: EU supervisors warn that with crypto-assets “you may lose a lot, or even all, of the money invested.”
– Scams and hacks are a large part of the picture: the FBI’s IC3 recorded $11.366 billion in losses from US complaints involving cryptocurrency in 2025.
– Rules exist but cover only part of the market: the EU’s MiCA regulation applies to certain crypto-assets and providers, not to everything sold under the Web3 label.
Contents
1. What “investing in Web3” usually means
2. Five things people buy and how each works
3. Who holds the keys
4. What can go wrong
5. Rules, tax and where protection ends
6. Questions to ask before trusting any project
7. FAQ
“How do I invest in Web3?” is a question with a hidden assumption: that Web3 is one thing you can buy. It is not. What you end up holding depends on what you mean, and the risks differ a lot. This guide explains the main options and spends most of its time on what can go wrong. This is not investment advice. If you are considering putting money into any of this, start with the official investor-protection resources linked at the end.
What “investing in Web3” usually means
Web3 is the idea of an internet where users hold digital assets and interact through blockchains and smart contracts. When people talk about “investing” in it, they usually mean one of two routes.
The first is direct exposure: holding crypto-assets such as the native tokens of blockchains or apps. The second is indirect exposure: owning shares in companies or funds whose business is connected to the sector, such as exchanges, infrastructure providers or chip makers. These still move with the crypto market but sit inside securities rules.
Many people searching this topic are really asking how to earn something from Web3. Earning by working, building or creating is a different question, covered in our guide on how to make money in Web3.
Five things people buy and how each works
| What you hold | How it works | Main risk to understand |
|---|---|---|
| Tokens (e.g. a blockchain’s native coin or an app’s token) | A digital entry on a blockchain. Price is set mostly by what other buyers will pay. | Extreme price swings; no issuer obliged to pay you back (except some stablecoins) |
| Shares in companies | Ordinary equity in a firm active in crypto or Web3. | Company risk plus the company’s exposure to crypto markets |
| Exchange-traded products (ETPs) and funds | A listed product that tracks a crypto-asset’s price. You hold the product, not the coin. | Still tracks a volatile asset; fees; product structure |
| NFTs | A unique token, often linked to an image, item or access right. | Thin, illiquid markets; often outside crypto regulation |
| Staking | Locking tokens to help run a proof-of-stake network in return for rewards. | Penalties, lock-ups, and dependence on whoever runs the setup |
ETPs. On 10 January 2024 the US Securities and Exchange Commission approved the listing of several spot bitcoin ETPs. Its chair at the time stressed: “we did not approve or endorse bitcoin,” and called it “primarily a speculative, volatile asset.” A regulated wrapper does not make the contents safe.
Staking. On Ethereum, staking means depositing ETH to activate a validator. Running your own requires at least 32 ETH. Validators that go offline “lose small amounts of ETH,” and serious misbehaviour leads to slashing, where “part of the validator’s stake is destroyed.” Pooled or exchange staking lowers the entry bar but adds counterparty risk: in the exchange case, ethereum.org notes, “the exchange has custody of your ETH.”
Token sales and ICOs. The 2023 version of this article warned that many initial coin offerings were scams. That advice has aged well.
Who holds the keys
The single most practical question is who controls the asset. In crypto, control means holding the private key.
| Setup | Who holds the key | Typical trade-off |
|---|---|---|
| Hardware wallet | You, on a dedicated device | You carry all the responsibility. Lose the recovery phrase and nobody can restore access. |
| Software wallet | You, on a phone or computer | More convenient, more exposed to malware and phishing |
| Exchange account | The exchange | Easy to use, but you depend on the firm’s security and solvency |
| ETP or fund | The fund’s custodian | No keys to manage, but you hold a financial product, not the coin |
The old advice still holds: a hardware wallet is generally safer than a phone app, and the recovery phrase should never be typed into a website or shared with anyone. EU supervisors also advise making sure that any wallet you use is sufficiently secured.
What can go wrong
Volatility. The joint warning from the EU’s three financial supervisors (EBA, EIOPA and ESMA) says most crypto-assets “typically remain volatile and highly risky” and that “you may lose a lot, or even all, of the money invested.” Even stablecoins, their factsheet notes, “may not be so stable overtime, especially in stressed market conditions.”
Hacks. According to Chainalysis, over $3.4 billion was stolen in crypto hacks from January through early December 2025. A single breach at the exchange Bybit accounted for $1.5 billion. Attacks on individuals were frequent too: 158,000 personal wallet theft incidents, with at least 80,000 unique victims.
Scams. The FBI’s Internet Crime Complaint Center reported $11.366 billion in losses from complaints involving cryptocurrency in 2025, with crypto investment fraud alone at $7.228 billion across 61,559 complaints. The usual pattern: a friendly contact, a slick platform, early “profits”, then withdrawals that never arrive.
Rug pulls. A project’s creators raise money or attract liquidity, then withdraw it and disappear. Anonymous teams, unaudited smart contracts and pressure to buy quickly are the usual signs.
Smart contract bugs. Code holds the money. If the code has a flaw, the money can leave, and there is often no one to call.
Promotion. EU supervisors note that interest in crypto is partly driven by “aggressive promotion on social media by finfluencers.” Someone paid to promote a token is not giving you neutral information.
Rules, tax and where protection ends
MiCA in the EU. The Markets in Crypto-Assets Regulation entered into force in June 2023 and has applied in full since December 2024. Firms already operating under national rules could continue during a transitional period until 1 July 2026 at the latest, or until they were authorised or refused. Per the ESAs’ warning, “only firms authorised and listed on the ESMA register are allowed to provide crypto-asset services in the EU under MiCA.”
What MiCA does not do matters just as much. It “regulates activities involving certain crypto-assets.” Unique, non-fungible tokens are generally outside its scope, and some providers are “fully decentralised” and therefore outside it as well. With unauthorised firms, the factsheet warns, “you may face losses, have limited or no possibility to recover any assets.” MiCA also does not guarantee prices. No regulation does.
Tax. In the EU, the DAC8 directive requires crypto-asset service providers to collect information on their users’ transactions and pass it to tax authorities. Member states must apply it “as of 1 January 2026.” In practice, gains and income from crypto are increasingly visible to tax offices. Rules differ by country, so check with your national tax authority or a tax adviser.
Outside the EU. In the US, the SEC’s Investor.gov crypto page covers custody, ETPs, scams and how to report fraud, and notes that “different crypto assets can present different benefits or risks.”
Questions to ask before trusting any project
The original article’s checklist still works, read as a way to spot problems rather than pick winners.
- What problem does it solve? If the only use of the token is to be bought by someone else, that is the answer.
- Who is behind it? Named people with a verifiable track record, or anonymous accounts?
- Is the provider authorised? In the EU, check the ESMA register and your national regulator’s warning list.
- Has the code been audited? By whom, and were the findings fixed?
- Where does the yield come from? Returns with no clear source are a classic warning sign.
- Who holds the keys? See the custody table above.
FAQ
Is investing in Web3 safe?
No form of it is risk-free. EU supervisors warn that most crypto-assets “typically remain volatile and highly risky” and that you may lose all the money invested.
Is Bitcoin regulated under MiCA?
MiCA does not regulate bitcoin’s price or make it safer. In practice it applies to the firms that offer, exchange or hold it for clients in the EU, which must be authorised.
Are NFTs covered by EU crypto rules?
Generally not. MiCA excludes crypto-assets “that are unique and non-fungible,” although NFTs issued in a large series or collection may still fall within its scope.
What is a rug pull in crypto?
Creators collect money or liquidity from users, then withdraw it and vanish.
Do I pay tax on crypto in the EU?
Usually, but rules vary by country. Under DAC8, which member states must apply from 1 January 2026, crypto service providers collect data on users’ transactions and send it to tax authorities.
Where can I check if a crypto firm is legitimate?
In the EU, use the ESMA MiCA register and your national financial regulator’s warnings. In the US, start with Investor.gov.
Sources: ESAs warning on crypto-assets (ESMA news) · Joint ESAs warning (PDF) · Joint ESAs factsheet (PDF) · ESMA: MiCA · European Commission: DAC8 · FBI IC3 2025 report · Chainalysis · SEC statement, 10 Jan 2024 · ethereum.org: Staking · Investor.gov: Crypto assets
About the Author
👉Want guest posting?🪙Subscribe to the @egorithms Telegram