Key Takeaways
A rug pull happens when the people behind a project drain its value and leave buyers holding tokens that cannot be sold or are worth almost nothing. Most rug pulls follow a small number of repeatable patterns.
Important warning signs can be investigated using public blockchain data: unlocked liquidity, active mint authority, concentrated wallets, and contracts that block selling.
No checklist makes a token "safe." Scanners and research reduce risk, but memecoins and new DeFi tokens remain highly speculative, and many fail even without fraud.
What Is a Rug Pull?
A rug pull is a type of crypto scam where a project's creators or insiders suddenly remove value from a token or protocol, leaving other holders with losses. The name comes from the phrase "pulling the rug out from under someone."
Two areas where buyers should watch for rug-pull risks are:
Memecoins, which can be launched in minutes on platforms that require little or no technical skill.
New DeFi tokens and protocols, where users deposit funds into smart contracts controlled by small or anonymous teams.
A falling price or low liquidity does not, by itself, establish fraud. Look for evidence of deceptive promises, privileged control, and insider actions rather than relying on a headline percentage.
Three Common Rug-Pull Patterns
Understanding how rug pulls work makes them much easier to spot.
Type | How It Works | Typical Sign |
|---|---|---|
Liquidity pull (hard rug) | Developers remove the funds backing the token from a decentralized exchange (DEX) pool. Removing a large share can sharply reduce liquidity and make selling difficult or costly. | Liquidity is not locked or burned. |
Dumping (soft rug) | Insiders deceptively promote a project while planning to unload a large supply on buyers. Selling may be allowed by the code; an insider sale alone does not prove fraud. | A few wallets control a large share of supply. |
Malicious code (honeypot) | The smart contract lets people buy but blocks or heavily taxes selling. Selected addresses may be exempt from the restrictions. | Sell transactions fail or face extreme taxes. |
An Officially Documented Allegation: Frosties (2022)
In March 2022, the US Department of Justice announced charges involving the Frosties NFT project. Prosecutors alleged that its creators abandoned the project after selling the NFTs and moved approximately $1.1 million in proceeds to wallets they controlled, instead of delivering promised benefits. This is a historical example of alleged deceptive abandonment, not a finding that every failed project is criminal. The announcement describes charges, not a conviction. Read the DOJ announcement.
Warning Signs: How to Identify a Rug Pull
The most useful signals fall into three groups: on-chain data, contract permissions, and team and community behavior.
1. Liquidity Is Not Locked or Burned
A DEX pool contains assets that traders swap against. In a traditional pool, liquidity providers receive LP tokens representing their share. Other designs, such as Uniswap v3, use NFT positions. Check the actual pool design instead of assuming every pool uses the same LP token model. Uniswap liquidity documentation.
For the specific pool and position, check who can withdraw liquidity, what share is locked, when any lock expires, and whether the lock has an administrator or emergency withdrawal path. A screenshot or a “liquidity locked” badge is not enough. Verify the address and terms on-chain where possible.
A valid lock or an irrecoverable LP-token burn may restrict withdrawal of the covered position. It does not lock every pool, guarantee trading depth, or prevent insiders from dumping tokens. Nor does it eliminate bugs, minting powers, or malicious trading rules. Unlocked liquidity is a risk to understand, not proof of a scam.
2. The Creator Can Still Mint or Freeze Tokens
Smart contracts often include special permissions. Two of the most important are:
Mint authority: the ability to create new tokens. If active, the creator can print supply and sell it, diluting everyone else.
Freeze authority (common on Solana): the ability to freeze holders' token accounts, which can stop them from selling.
A project with no clear reason to retain these powers deserves extra scrutiny. Solana documents mint and freeze roles separately; revoking one does not revoke the others. Token extensions can introduce additional authorities. Solana authority documentation.
On EVM networks, also check owner roles, proxy administrators, and upgrade powers. An upgradeable contract can change its implementation. “Ownership renounced” is not enough if other privileged roles remain. OpenZeppelin proxy documentation.
3. Supply Is Concentrated in a Few Wallets
Look at the top holders list on a block explorer. Warning signs include:
A single wallet holding a large share of supply. Identify exchange, pool, treasury, vesting and burn addresses before interpreting the list, and verify labels rather than trusting them blindly.
Many "different" wallets that were funded from the same source, which can hide one person controlling the supply. Common funding is a lead to investigate, not proof of common ownership; a shared exchange can fund unrelated users.
Developer wallets that bought heavily in the first seconds after launch.
4. Selling Is Restricted or Heavily Taxed
Some contracts include hidden sell taxes, blacklists, maximum sell limits, or the ability to change fees later. For example, a token can look normal initially while a privileged role retains the ability to impose a near-total sell tax later. Some honeypot checkers simulate buying and selling under particular conditions. A successful simulation is a snapshot, not a guarantee that your transaction or a later sale will work; failed or missing results need investigation. Honeypot.is documentation.
5. The Contract Is Unverified or Unaudited
On networks like Ethereum and BNB Chain, developers can verify their source code on a block explorer so anyone can read it. Unavailable source code makes independent review harder. Verification publishes matching source code; it is not an endorsement or a security audit. Etherscan verification documentation. An audit from a known security firm is a positive sign, but audits are not guarantees, and fake or low-quality audit badges do exist.
6. Social and Marketing Red Flags
Behavior can provide warning signs, although no single signal proves intent:
Promises of guaranteed or very high returns.
Heavy pressure to buy now ("last chance," countdowns).
Anonymous teams with no track record, combined with large token allocations.
Paid influencer promotion that is not clearly disclosed.
Comments or questions deleted in community chats, or chats locked after price drops.
Copycat names or branding borrowed from celebrities, films, or trending news.
Quick Reference: Red Flags vs Healthier Signs
Area | Red Flag | Healthier Sign |
|---|---|---|
Liquidity | Unlocked, or lock expires soon | Verified restriction on withdrawal of the relevant position; scope and expiry understood |
Contract permissions | Mint or freeze authority active | Each authority, upgrade role and justification checked |
Holder spread | Top wallets hold a large share | Distribution and relevant address labels checked |
Code | Unverified, hidden owner functions | Verified, reviewed by reputable auditors |
Taxes | High or changeable sell tax | No tax, or fixed and disclosed |
Team | Anonymous, no history, large allocation | Known track record, vested allocations |
Marketing | Guaranteed returns, urgency | Clear documentation, realistic claims |
Tools to Check a Token
Use public-address lookups first. You should not need to reveal a seed phrase, send funds, approve a token, or sign a wallet message to read a token's public risk information. Feature coverage, access requirements and supported chains vary, so check the provider's current documentation.
Block explorers: Start with the relevant explorer, such as Etherscan for Ethereum, to inspect contract source, holders and transaction history. Read the actual contract address and network, not just the token name.
GoPlus Security: Its documentation describes token-risk analysis and separate EVM and Solana security/simulation services. Check that the selected service supports the token's chain and standard. GoPlus documentation.
Honeypot.is: Provides simulation results and risk flags on supported networks. Its documentation explicitly allows unknown results, simulation failures and missing honeypot results. Treat those as uncertainty, not a pass. Honeypot.is documentation.
No tool certifies that a token is safe. A scanner may miss a privileged role, changing code, coordinated wallets, or a malicious action that has not happened yet. Independent code review and public records can complement automated checks, but none eliminates risk.
Step-by-Step Rug Pull Checklist
Use this process before interacting with any new token or DeFi protocol:
Get the correct contract address from the project's official site or documentation, not from replies or direct messages. Fake copies of popular tokens are common.
Compare independent checks using a suitable security scanner, explorer and supported simulation. Confirm they checked the same chain, contract and pool.
Check liquidity control: Which pool and position, what proportion is restricted, who controls the lock, and when does it expire?
Check contract permissions: Is mint, freeze, or owner control still active?
Review the top holders on a block explorer and look for clustered wallets.
Look for sell restrictions using a supported simulation, not your own funds. A passing result does not confirm a safe exit.
Research the team and history: past projects, audits, and how they respond to hard questions.
Be prepared to walk away. If you cannot understand or verify the risks, do not interact. New tokens can lose most or all of their value even without fraud.
What to Do If You Are Rugged
If you believe you were caught in a rug pull:
Stop sending funds or signing requests from the project. Do not pay withdrawal, tax, or recovery fees to unlock a balance.
Review approvals using your wallet provider’s official instructions. Disconnecting a site is not the same as revoking on-chain permissions. Revocation can limit future approved spending; it cannot reverse past transfers or fix an exposed seed phrase.
If your seed phrase or private key is exposed, treat the wallet as compromised. Use a clean device and a new wallet with a new recovery phrase. Follow official wallet-provider guidance for any remaining assets; do not add gas funds if an automated sweeper may be stealing deposits. Never share recovery phrases with support or recovery services. MetaMask incident guidance.
Record evidence: contract address, transaction hashes, screenshots, and links.
Report it to the exchange or platform involved and to the relevant authorities. In the US, this can include the FBI's Internet Crime Complaint Center (IC3).
Be careful of "recovery" offers. People who promise to get your funds back for a fee are often running a second scam.
Whether conduct is illegal depends on the facts and applicable law. Report suspected fraud without treating a price drop alone as proof, and do not assume that a report guarantees recovery.
Frequently Asked Questions
Is every token that crashes a rug pull?
No. Many tokens fail because of low demand, poor design, or market conditions. A rug pull involves deceptive or abusive insider conduct, such as draining liquidity, coordinated deceptive selling, or malicious code. Ordinary profit-taking or a disclosed liquidity withdrawal alone does not prove fraud.
Does locked liquidity mean a token is safe?
No. A valid lock can restrict withdrawal of the specific liquidity position it covers. Insiders can still dump large token holdings, mint new supply, or use hidden taxes. Treat locked liquidity as one positive signal, not a guarantee.
What is a honeypot token?
A honeypot is a token whose contract allows buying but blocks or heavily taxes selling, while selected addresses may be exempt. Simulations can help detect restrictions but cannot guarantee a later sale.
Can an audit prevent a rug pull?
An audit can find coding bugs and some risky permissions, but it cannot stop a team from acting dishonestly. Check that the audit is real on the auditor's own website and that its scope and version match the deployed contracts.
Are memecoins more likely to be rug pulls?
Memecoins can expose buyers to concentrated supply, hype-driven prices and anonymous operators. A universal fraud rate or a reliable comparison with all other tokens cannot be inferred from one platform or period. Evaluate the specific project and be prepared to lose the entire amount.
Related Terms
Rug Pull: A scam where project insiders drain value from a token or protocol and leave other holders with losses.
Liquidity Pool: A pool of assets held in a smart contract that lets users trade on a decentralized exchange.
Honeypot Scam: A token designed so that buyers can purchase it but cannot sell it, trapping their funds.
Pump and Dump: A scheme where insiders inflate a token's price through hype and then sell their holdings to later buyers.
Smart Contract Audit: An independent review of a smart contract's code to find bugs, security flaws, and risky permissions.
Sources and Review Date
Reviewed 18 October 2026. Primary sources are linked beside the relevant claims above. This is educational information, not investment or legal advice.
