How to Assess Risk in Your Crypto Portfolio (2026)

Assessing crypto portfolio risk means quantifying four separate exposures rather than one: price volatility, correlation between holdings, custody and counterparty risk, and protocol risk in anything held on-chain. A single volatility number covers only the first, which is why portfolios that looked diversified on a spreadsheet have repeatedly fallen together in the same week.

The useful output of a risk assessment is a position size, not a score. If a plausible drawdown on a holding is 70% and the largest portfolio loss you can absorb without changing behaviour is 15%, arithmetic sets the maximum weight before opinion gets a say.

The four exposures that lose real money

• Price volatility and drawdown — how deep a peak-to-trough fall the position can produce, which for major crypto assets has historically exceeded 70%.
• Correlation — whether holdings fall together; separate tokens sharing one bridge, one stablecoin, or one lending market are one position wearing several names.
• Custody and counterparty risk — an exchange balance is a claim on the exchange, not a coin you control, and it fails with the exchange.
• Protocol and contract risk — code that can be exploited, upgraded, or paused, plus the token approvals you granted and never revoked.
• Exit liquidity — the price you can actually sell size into, which for thin tokens is far below the quoted last trade.

Metrics, and the blind spot in each

Sizing a position from a drawdown budget

Work backwards from the loss you can carry rather than forwards from the return you want. Fix the maximum total portfolio loss you would tolerate without abandoning the plan, assume a plausible drawdown for the asset, and divide. The result is a ceiling, not a target.

Portfolio $100,000; largest total loss tolerated = 15% = $15,000
Assumed plausible drawdown on the crypto sleeve = 70%
Max crypto sleeve = 15,000 / 0.70 = $21,428, or 21.4% of the portfolio
Within the sleeve, assume 90% drawdown risk on any single altcoin
Single-name loss budget of $4,500 -> max position = 4,500 / 0.90 = $5,000
That is 5.0% of the portfolio and 23% of the crypto sleeve
Doubling the assumed drawdown halves the allowed position, so the
assumption does more work than the return forecast ever will

Custody and counterparty risk is not a metric

FDIC deposit insurance covers deposits at insured banks; it does not cover crypto held on an exchange, and it does not cover a token that falls in value. A balance on a trading venue is an unsecured claim on that venue, which is a different instrument from the same coin held in a wallet whose keys you control.

That difference cannot be reduced to a number, so handle it with rules instead. The point of the rules below is that no single failure — an exchange, a chain, a contract, a device — can take more than a defined share of the portfolio.

1. Cap the balance held at any one exchange at a share of the portfolio you could write off, and move the excess to self-custody.
2. Test a small withdrawal from each venue quarterly; a withdrawal that silently fails is the earliest available warning.
3. Keep the seed phrase off any internet-connected device, with a second physical copy in a separate location.
4. Review and revoke token approvals on every chain you use; an old unlimited approval remains spendable indefinitely.
5. Cap total exposure to any single smart-contract protocol, counting positions that route through it indirectly.
6. Record where every position lives, so a paused contract or a halted bridge does not need a research project to assess.

Turning the assessment into a review

Risk assessment is worthless as a one-off document. Recompute weights, top-holding share, and the drawdown budget on the same schedule you review the portfolio, and log the numbers so you can see which limit is drifting. A crypto portfolio tracker that stores history makes this a five-minute job rather than a rebuild.