A rug pull is a crypto fraud in which the people behind a token drain its value and disappear, leaving buyers holding an asset nobody can sell. This guide treats rug pull crypto schemes as a security problem rather than an investment question.
You will learn the main rug pull types, the contract code patterns behind honeypot tokens, how to read liquidity and holder data, and a step-by-step review you can run before interacting with any new token.
Nothing here is investment advice. The goal is to help analysts, wallet teams and careful users recognize malicious design before funds are committed.
What is a rug pull in crypto?
In a typical rug pull, a developer launches a token, pairs it with a valuable asset such as ETH or SOL in a decentralized exchange pool, and promotes it.
Once buyers have pushed value into the pool, the developer removes the liquidity or dumps a hidden token allocation, and the price collapses.
The scale is large. Solidus Labs’ 2025 Rug Pull Report found that of more than 7 million Pump.fun tokens with at least five trades, about 98.6% ended with under $1,000 in liquidity, and roughly 93% of 388,000 Raydium pools it examined showed soft rug pull characteristics (2025).
Not every dead token is fraud, but the numbers show how thin the margin is.
US prosecutors treat deliberate rug pulls as wire fraud. In the Frosties NFT case, the Justice Department charged two defendants in 2022 after they allegedly abandoned the project hours after selling out, taking about $1.1 million in proceeds.
Types of rug pulls and how each works
| Type | Mechanism | What to check |
|---|---|---|
| Liquidity pull | Developer withdraws the LP tokens backing the trading pool | Who holds the LP tokens and whether they are locked or burned |
| Hidden mint | Owner mints new supply and sells it into the pool | Owner-callable mint functions or upgradeable logic |
| Honeypot token | Buys succeed, but sells revert or are taxed near 100% | Transfer restrictions, blacklists, adjustable fees |
| Slow rug / dump | Insiders sell a large concentrated allocation over time | Holder concentration and unlock schedules |
| Abandonment (soft rug) | Team stops work and quietly sells | Team transparency, delivery history, social signals |
A hard rug relies on malicious code; a soft rug relies on broken promises. Code review catches the first category well and the second only partially, so the checks in this guide combine both.
Honeypot tokens: reading the contract
A honeypot token lets anyone buy but prevents ordinary holders from selling. The trick lives in the token’s transfer logic, typically in an ERC-20 _transfer override. The simplified Solidity below is illustrative and shows patterns reviewers should flag.
// Illustrative example of malicious patterns – do not deploy
mapping(address => bool) private _blocked;
uint256 public sellFee = 5; // owner can raise to 99
address private _router;
function setFee(uint256 f) external onlyOwner { sellFee = f; } // no upper bound
function block(address a) external onlyOwner { _blocked[a] = true; }
function _transfer(address from, address to, uint256 amt) internal override {
require(!_blocked[from], “blocked”); // sellers can be frozen
if (to == pair && from != owner()) { // sells into the pool
uint256 fee = amt * sellFee / 100;
super._transfer(from, owner(), fee); // fee flows to owner
amt -= fee;
}
super._transfer(from, to, amt);
}
Code red flags
- Owner-only functions that change fees with no cap, or that blacklist and whitelist addresses.
- Different logic for transfers to the liquidity pair than for transfers elsewhere.
- Owner-callable mint functions, or a proxy pattern where the owner can swap the implementation.
- Unverified source code on the block explorer, or verified code that does not match the deployed bytecode.
- Obfuscated addresses or arithmetic that hides where funds go.
Obfuscation is common in malicious contracts. SentinelOne researchers documented smart contracts disguised as arbitrage bots that drained more than $900,000, using XOR to hide the attacker’s wallet from static review.
The OWASP Smart Contract Top 10 is a useful checklist for broader vulnerability classes such as access control flaws and logic errors.
Liquidity locks, ownership and holder concentration
Code tells you what the owner can do. On-chain state tells you what the owner currently controls. Understanding token liquidity is central here, because whoever holds the LP tokens can remove the assets that make the token tradable.
Liquidity lock checks
- LP tokens burned: sent to a dead address, meaning nobody can withdraw the pool. Strongest signal.
- LP tokens locked: held by a time-lock contract. Check the unlock date and whether the lock contract itself is upgradeable.
- LP tokens in a normal wallet: the holder can pull liquidity at any time. Treat as high risk.
Ownership and holders
Check whether contract ownership has been renounced (owner set to the zero address) or moved to a multisig with a time delay. Renouncing removes admin powers but also removes the ability to fix bugs, so the right answer depends on the design.
Then review the top holder list. Exclude the pool and known lock or burn addresses, and look at what remains.
A handful of fresh wallets funded from the same source and holding a large share of supply is a classic sign of a bundled launch.
Published tokenomics of cryptocurrencies should match what the chain shows; mismatches between the stated allocation and actual holder balances are a red flag on their own.
Social engineering around token launches
Rug pulls rarely rely on code alone. Promotion drives the buying pressure that makes the exit worthwhile, and attackers borrow credibility wherever they can find it.
- Hijacked accounts. Compromised verified accounts are used to push new coins, as in reports that a SpaceX and Starlink X account was compromised to promote fake crypto coins.
- Paid ads and fake news sites. Malvertising and cloned media sites drive traffic to token pages and drainer kits; see how crypto scams in Asia combine malvertising with investment fraud, and how malicious Google ads target crypto users with wallet drainers.
- Targeting builders. Attackers also go after the other side of launches; one campaign used a fake Web3 accelerator with malicious npm packages to target crypto founders.
- Presale pressure. Countdown timers and “whitelist only” offers rush buyers past due diligence. Any crypto presale deserves the same contract and liquidity checks as a live token, because funds raised before launch are often held in a wallet the team fully controls.
- Fake audits. Audit badges link to PDFs that cover a different contract address, or to firms with no public track record.
A step-by-step rug pull review
This workflow takes 15 to 30 minutes for a single token. It maps to the Identify function of NIST CSF 2.0 for teams that formalize third-party asset reviews.
- Confirm the contract address from the project’s own verified channels and compare it on the block explorer. Impersonation tokens copy names and tickers.
- Check source verification. Unverified bytecode is an automatic stop for most security teams.
- Read the owner functions. List every function guarded by onlyOwner or a role check and write down what each can change.
- Check for proxies. If the contract is upgradeable, identify who controls the upgrade and whether a time lock applies.
- Simulate a sell. Use a transaction simulator or a fork of the chain to test a sell from a non-owner address before buying. A revert or a large unexplained deduction confirms a honeypot.
- Verify liquidity status by tracing LP token holders to a burn address or a lock contract with a known unlock date.
- Review holder distribution and the funding trail of the top wallets.
- Validate any audit by matching the audited address and commit to the deployed contract.
Detection logic for monitoring teams
Wallet providers and exchanges can alert on rug pull precursors. An illustrative rule set:
ALERT token_rug_risk WHEN
(event = OwnershipCall AND fn IN (“setFee”,”setMaxTx”,”blacklist”,”mint”)
AND new_value_change > threshold)
OR (event = LP_Burn_or_Remove AND remover = deployer AND pct_removed >= 50)
OR (event = LargeTransfer AND from IN top_holders
AND to = pool AND amount_pct_supply >= 5)
WITHIN 24h OF token_creation
What to do after a rug pull
- Revoke any token approvals granted to the project’s contracts, since some rug pulls are paired with drainer approvals.
- Record the contract address, deployer address, transaction hashes, website and social accounts before they vanish.
- Report to the FBI’s IC3 in the US or your national cybercrime authority, and notify any centralized exchange that received the proceeds.
- Ignore “recovery agents” who contact you; they are a common follow-on scam.
Key takeaways
- Rug pull crypto scams succeed because developers keep control over liquidity, supply or transfer rules.
- Honeypot tokens hide sell restrictions in transfer logic; simulate a sell before buying.
- Burned or time-locked LP tokens, capped fees and no owner mint reduce but do not remove risk.
- Holder concentration and wallet funding trails expose bundled launches.
- Audits only count if they cover the exact deployed contract.
- Promotion through hijacked accounts and ads is part of the attack, not a sign of legitimacy.
FAQ
How do you know if a crypto token is a rug pull?
Check for unverified code, owner functions that change fees or mint tokens, LP tokens held in a regular wallet, and a few wallets controlling most of the supply. Any one of these is a warning; several together are a strong signal.
What is a honeypot token?
It is a token whose contract allows buying but blocks or heavily taxes selling for ordinary holders. Only the owner or whitelisted addresses can exit.
Does a liquidity lock guarantee a token is safe?
No. A lock prevents liquidity removal until it expires, but the team can still dump unlocked supply, mint tokens or abandon the project.
Are audited tokens safe from rug pulls?
An audit reviews code at a point in time and usually does not judge team intent. Confirm the audit covers the deployed address and read its findings on owner privileges.
Is a rug pull illegal?
Deliberately deceiving buyers and taking their funds can be prosecuted as fraud, as US cases against NFT and token developers show. Legal outcomes depend on jurisdiction and evidence.
