Crypto Rug Pull: How to Spot It Before You Buy

The essentials

What is a rug pull?

Chainalysis defines a rug pull as a situation where developers build what looks like a legitimate crypto project, then take investors' money and disappear. In decentralized finance (DeFi), the classic scenario goes like this: scammers create a token, promote it with false promises, then drain the liquidity pool once enough buyers have come in.

The phenomenon is far from marginal. According to Chainalysis, rug pulls brought in more than $2.8 billion in 2021, or 37% of crypto scam revenue that year, up from 1% in 2020. That total does, however, include the exceptional case of Thodex, a Turkish exchange, which accounts for nearly 90% of the sum.

More recently, Solidus Labs' 2025 report estimated that about 93% of 388,000 liquidity pools analyzed on the Raydium DEX (Solana) showed "soft rug pull" characteristics.

A quick reminder: what is liquidity?

For a token to trade on a DEX (a decentralized exchange such as Uniswap, PancakeSwap or Raydium), someone has to deposit a liquidity pool: for example, the project's tokens on one side and ETH, BNB or SOL on the other. Buyers draw from this pool when they buy, and sell back into it when they exit.

In return for this deposit, the provider receives LP tokens (liquidity provider tokens), which let them reclaim their share of the pool at any time. If the token's creator holds these LP tokens, they can therefore withdraw the liquidity whenever they like. This is the core of many rug pulls.

The different types of rug pull

The hard rug pull

The hard rug pull relies on a brutal move or a technical trap:

• Liquidity removal: the creator pulls the entire pool in one go. The price collapses to almost zero and nobody can sell at a reasonable price anymore.
• Malicious code: the token's contract contains a backdoor, for example a function that lets the owner create tokens at will or block sales.

This type of scam is generally premeditated from the moment the token is created.

The soft rug pull

The soft rug pull is more gradual and harder to prove:

• the team gradually sells its tokens while the community keeps buying;
• the project is abandoned after raising funds, with no announcement;
• liquidity is removed in several stages.

Legally, the line between a failed project and a scam can be blurry. For you, the result is often the same: a token that is worth nothing.

The honeypot

A honeypot is a token you can buy but not sell. The chart goes up because everyone is buying and nobody can sell, which attracts even more buyers. GoPlus Security describes a typical mechanism: a blacklist built into the contract makes any transfer attempt from a listed address fail, which prevents holders from selling.

Honeypots can also work with a modifiable sell tax (for example raised to 100%) or a trading pause reserved for "approved" addresses.

The red flags to check

1. The liquidity is not locked

If the LP tokens sit in the creator's wallet, nothing stops them from withdrawing everything. Services exist to lock liquidity (hold it in a contract for a set period) or to burn the LP tokens (send them to an unusable address).

What to check: what share of the liquidity is locked, and until when? A lock of a few days offers almost no protection.

Note: locked liquidity doesn't stop big holders from selling their tokens into the pool and crashing the price.

2. Dangerous functions in the contract

On Ethereum-compatible blockchains, the code of verified contracts is readable on block explorers. Without being a developer, you can spot certain function names or use a scanner that will do it for you. The riskiest ones:

GoPlus Security also points out that some malicious contracts hide these functions behind deliberately confusing code or conditions triggered later, to fool analysis tools.

On Solana, the equivalent items to check include the mint authority (who can create new tokens) and the freeze authority (who can lock accounts). Ideally, both are revoked.

3. Holders are highly concentrated

If a few wallets (excluding the liquidity pool and lock contracts) hold a large share of the supply, they can crash the price by selling. Be especially wary if several of those wallets were funded from the same address: it's often the same person behind them. The guide Analyzing a token on-chain explains how to check this.

4. The team is anonymous and unreachable

Anonymity is not in itself proof of a scam: it is common in crypto. But Chainalysis lists the absence of a website, a white paper or identified developers among the warning signs. Combined with other points (unlocked liquidity, unaudited contract), it greatly increases the risk, because nobody can be held accountable.

5. Communication is locked down

Comments disabled, critical messages deleted, pressure to buy "before it's too late": a serious project welcomes questions.

6. No audit, or an unverifiable one

Chainalysis recommended avoiding new tokens that have undergone no code audit. An audit doesn't guarantee everything, but check at a minimum that one exists, that it is published by the firm itself and that it covers the right contract.

Verification tools

Token scanners automatically analyze a contract from its address: mint functions, blacklist, taxes, a buy-and-sell simulation to detect a honeypot, holder concentration, liquidity status. GoPlus Security, Token Sniffer or RugCheck (for Solana) are examples, cited here as illustrations and not as recommendations.

These tools have limits:

• they can be fooled by obfuscated code, as GoPlus acknowledges;
• a "green" score doesn't prove a project is honest, only that no known trap was detected;
• they don't detect a soft rug pull still to come.

Always complement them with a check on a block explorer (see Reading a block explorer).

A concrete example: the Squid Game token (2021)

In October 2021, at the height of the series' popularity, a token called SQUID appeared on BNB Smart Chain and began trading on PancakeSwap. According to Gizmodo and Wikipedia's summary:

• the token went on sale on October 20, 2021;
• its price climbed to $2,861;
• buyers discovered they couldn't sell their tokens: a honeypot-type mechanism;
• on November 1, 2021, the creators pulled the liquidity and the price fell to virtually zero;
• about $3.38 million was taken, then run through the Tornado Cash mixing service according to Wikipedia;
• the website disappeared; the Telegram channel didn't accept outside comments and the Twitter account blocked replies.

Several major media outlets had relayed the token's spectacular rise before the scam was exposed. Almost every red flag in this guide was present: inability to sell, anonymous team, closed communication, a website riddled with mistakes, an unrealistic price surge.

Quick checklist before buying a token

• Contract address obtained from an official source (not from a private message).
• Contract verified on the explorer and run through at least one scanner.
• No active mint function, blacklist or modifiable tax (or authorities revoked on Solana).
• Liquidity locked or burned, for a meaningful period.
• Reasonable holder concentration, with no cluster of linked wallets.
• Successful sells by other addresses visible in the transaction history.
• Amount limited to what you accept to lose, from a dedicated wallet.

Mistakes to avoid

• Relying only on the chart: a honeypot shows precisely a curve that only goes up.
• Trusting a single score: a scanner is an aid, not a guarantee.
• Believing locked liquidity is enough: big holders can still sell.
• Buying because of media coverage: the SQUID example shows that media can relay a scam before it is identified.
• Using the wallet that holds your savings: a malicious contract or a fake interface can also try to drain your wallet (see Phishing and drainers).
• Trying to "recover" your losses: beware of services that promise to get your funds back for a fee; this is a common scam aimed at victims. Report the facts to the authorities instead.

This guide is provided for general information only and does not constitute investment or legal advice.

Frequently asked questions

What is a crypto rug pull?

A scam in which a token's creators lure in buyers, then walk away with their money: they pull the liquidity, dump their holdings or prevent others from selling. It can be sudden (hard rug pull) or gradual (soft rug pull).

Is a rug pull illegal?

An organized rug pull is a scam: file a police report, keep the evidence and report the site to the authorities. The line between a failed project and a soft rug pull can, however, be legally blurry.

Can you get your money back after a rug pull?

Very rarely: a confirmed blockchain transaction cannot be reversed. Keep the transaction hashes and addresses for your report, and beware of services promising to recover your funds for a fee: it is a common scam.

How can you tell if a token is a honeypot?

A honeypot detector such as Honeypot.is, or a scanner such as GoPlus Security, simulates buying and then selling the token. Also check in the transaction history that other addresses have managed to sell.

Key takeaways

• A rug pull can be brutal (liquidity removal, booby-trapped code) or gradual (team sell-offs, project abandonment).
• A honeypot lets you buy but not sell: check that other addresses have managed to sell.
• The key signals are unlocked liquidity, mint or blacklist functions, concentrated holders, and anonymity combined with closed communication.
• Token scanners help spot known traps, but never guarantee that a project is safe.
• The Squid Game case (2021) combined almost all of these signals: only commit amounts whose total loss you can accept.

Sources

• Chainalysis — Crypto Scams: 2021 Rug Pulls Put Revenues Near All-Time High
• Gizmodo — Squid Game Cryptocurrency Scammers Make Off With $3.3 Million
• Wikipedia — 2021 Squid Game cryptocurrency scam
• GoPlus Security — Dive into Token Code and Safeguard Web3 Security
• Solidus Labs — Solana Rug Pulls & Pump-and-Dumps: What Crypto Institutions Must Know

Compare services related to this topic

• Best crypto wallet: comparison