What Is a Rug Pull in Crypto and How to Spot One
A rug pull is a crypto scam in which insiders attract capital and then deliberately abandon the project or drain its liquidity, leaving buyers with tokens they may not be able to sell. It's a designed exit, not just Bitcoin, Ethereum, or another market falling because sentiment changed.
A glossy token launch can look healthy for days. The website works, the presale appears locked, social channels celebrate a new exchange listing, and the chart climbs. Then the liquidity pool empties, the price falls almost vertically, and the deployer wallet stops moving. The question is no longer whether the market had a bad day. It's whether someone built the exit into the project from the beginning.
Table of Contents
- When the Chart Drops and the Team Disappears
- What a Rug Pull Actually Means in Crypto
- How the Scam Works Under the Hood
- Real Projects That Showed the Pattern
- Warning Signs and On-Chain Checks Before You Buy
- Why Fewer Incidents Does Not Mean Smaller Risk
- What to Do If You Suspect a Rug Pull
- Building Better Habits and Knowing Your Resources
When the Chart Drops and the Team Disappears
A fictional early-stage token launches with a polished website and a busy Telegram group. During the first days, the team posts countdowns, partnership graphics, and screenshots of early buyers. The presale is described as locked, and the community treats the upcoming listing as a major validation event.
On listing day, the token appears to confirm the story. The price rises, trading activity increases, and new wallets enter the pool. Yet the order book is thin, meaning relatively small trades can move the price sharply. On a block explorer, most supply still sits in a small cluster of wallets, while the deployer address retains visible links to the token contract and liquidity transactions.
The celebration lasts only briefly. A wallet associated with the project withdraws the paired asset from the liquidity pool. The token remains in holders' wallets, but the asset they need to trade against it has largely disappeared. The chart shows a price cliff rather than a gradual decline, and the pool's reserves change in a transaction that anyone can inspect.
Then the social evidence starts to vanish. The project's website stops loading. A Telegram group is deleted, the team's social accounts disappear, and the deployer wallet no longer moves in the way an active development team would. Holders can still see the token balance in their wallets, but the market around that balance has stopped functioning normally.
The clues visible to an ordinary holder
The sequence doesn't prove intent by itself. A failed launch can suffer from low liquidity, poor execution, or a team that gives up. But the combination of a sudden liquidity movement, concentrated ownership, disappearing communication channels, and a stalled deployer wallet creates a serious question.
Was this an unlucky project whose demand collapsed, or did insiders use the launch to create an exit opportunity? The answer depends on the difference between an honest failure and a deliberate extraction of value.
What a Rug Pull Actually Means in Crypto
In plain language, a rug pull in crypto happens when project insiders use their control or trading position to take value from buyers and leave them with tokens that have little or no practical market value. The SEC's description of a crypto liquidity-pool scheme explains how liquidity provider tokens can enable someone to withdraw pool liquidity without warning, causing investor losses.
That's different from an ordinary market decline. Bitcoin can fall because buyers lose confidence. An Ethereum application can shut down because funding runs out. A legitimate team might publish a closure notice, preserve user access where possible, and explain what happens to remaining assets. A rug pull centers on intent and control, especially when insiders use privileged access or a prepared selling position to extract value abruptly.
Three terms make the mechanics easier to follow:
- Token contract: The smart-contract code that defines how a token is created, transferred, and sometimes restricted.
- Deployer: The wallet that publishes the contract to a blockchain. It may retain administrative permissions after deployment.
- Liquidity pool: A smart-contract-controlled reserve of trading assets that allows users to swap the token without relying on a traditional order book.
Technical research separates rug pulls into contract-related and transaction-related mechanisms. Contract-related cases rely on malicious or dangerous code, such as owner controls, minting privileges, or sell restrictions. Transaction-related cases can work through trading behavior, including insiders selling into thin liquidity, even when the contract doesn't contain an obvious drain function, as described in peer-reviewed research on rug-pull risk in DeFi smart contracts.
The practical distinction is simple: a bad investment can lose value without fraud, while a rug pull uses insider control or positioning to create an unfair exit.
How the Scam Works Under the Hood
Most rug pulls become easier to understand when you follow where the value goes. The token price is only the visible result. The important question is whether the project's creators can move the assets supporting the market, change the rules governing trades, or sell into buyers who don't know the insiders are exiting.
Liquidity drainage
Think of a lemonade stand whose owner removes the cash register while customers are still holding cups. In a decentralized exchange, developers can withdraw the paired asset from the liquidity pool. Holders may still own the token, but the market has lost the reserve needed to buy it.
On-chain, check the pool's reserve balances and the wallet receiving the assets. A sudden reduction in the paired asset, especially when it aligns with a sharp price collapse, is a central warning signal. Readers who want the underlying mechanics can review this explanation of how smart contracts operate.
Hidden owner controls
A token can look ordinary while its contract gives one address unusual authority. Mint functions can create more tokens, blacklist functions can prevent selected wallets from selling, and upgradeable designs can allow the rules to change after buyers enter. It's like inviting guests into a building and changing the locks once they're inside.
Inspect the verified contract code, ownership records, proxy configuration, and privileged functions. A single externally owned wallet with broad control deserves more scrutiny than a clearly documented multisig arrangement with visible operational rules. Hidden contract control is a known rug-pull mechanism because creators may retain the ability to remove liquidity, block sales, or alter token behavior after the initial pump, as discussed in industry reporting on contract backdoors.
Pump, sell, and honeypot behavior
Some schemes don't require a dramatic one-transaction drain. Insiders can promote a token, let retail volume create exit liquidity, and sell gradually into the demand they generated. A honeypot goes further by allowing purchases while restricting or blocking sells, trapping buyers inside the contract.
Look for unusual buy-to-sell behavior, failed sell transactions from unrelated wallets, sudden changes in tax settings, and large insider transfers during social-media peaks. The broader scam environment includes social-engineering approaches that can overlap with crypto theft, so readers assessing risks beyond token contracts may also find this online dating safety guide useful.
In every case, value leaves through one of two paths. The contract grants a creator the ability to take it, or a creator uses wallets and market activity to sell it. That contract-versus-transaction lens keeps the investigation focused on evidence rather than branding.
A visual walkthrough can help connect the pool movement, hidden contract path, and promotional exit.
Real Projects That Showed the Pattern
Publicly documented examples show why on-chain behavior matters more than a project's visual identity. One case followed the classic liquidity-removal pattern. The token launched with promotional activity and attracted buyers into a trading pair. After interest peaked, the liquidity provider position was withdrawn, the paired market collapsed, and the project's communication channels were abandoned.
The important evidence wasn't the team's personality. It was the transaction sequence: liquidity entered, buyers supplied demand, a project-linked wallet removed the reserves, and the market lost the ability to support normal trading. Once the withdrawal occurred, holders faced a token balance without a functioning market.
A separate NFT-related case illustrated a contract-control failure. The project appeared to offer a limited digital-asset collection, but the smart contract retained a minting capability that allowed insiders to create additional tokens. Those tokens entered the market, increasing supply and undermining the value of the assets purchased by earlier participants.
Reading the timeline instead of the story
These examples differ in the technical route, but the pattern is recognizable:
- Launch conditions: Marketing creates attention and buyers provide initial demand.
- Contract anomaly: A privileged function or liquidity position gives insiders an unusual advantage.
- Triggering transaction: The controlling wallet removes reserves, mints supply, or sells into the market.
- Immediate reaction: Liquidity weakens, the chart collapses, and project communication fades.
The Cambridge empirical study of DeFi rug pulls documented 101 rug pulls across six DeFi service types. It found that ICOs made up the majority of cases, and most of those ICO rug pulls stayed active for less than six months before developers abandoned the project and investors were left with worthless tokens. The study also observed that ICO rug pulls occurring in 2021 tended to remain active longer than later cases, a pattern consistent with operators adapting as the market matured.
That evidence supports a useful conclusion. These incidents aren't random chart disasters. They have recurring lifecycle features, especially around early-stage token launches and DeFi offerings.
Warning Signs and On-Chain Checks Before You Buy
A reliable review separates what the contract can do from what the project team is doing. Neither category proves safety on its own, but together they can expose risks before you commit funds.
On-chain contract checks
Use the token address from an official, independently verified source. Then work through the following routine:
- Confirm the liquidity arrangement: Check whether liquidity is locked with a recognizable locker, how the lock is represented on-chain, and whether the relevant position can be withdrawn by a project-controlled wallet. A lock reduces one type of withdrawal risk, but it doesn't eliminate contract or trading risks.
- Review ownership status: Determine whether ownership has been renounced or placed under a multisig wallet. Renunciation can limit certain administrative actions, while a multisig makes unilateral control harder. Neither status guarantees honest conduct.
- Inspect holder concentration: Examine the largest wallets and look for clustered addresses, related funding sources, or wallets that received tokens from the same origin. Concentrated supply can let a small group move the market.
- Read the verified code: Search for mint, blacklist, pause, fee-change, sell-limit, and upgrade functions. Focus on who can call each function and whether the permissions can change after launch.
- Test market behavior carefully: Review successful and failed sells from unrelated wallets. A token that welcomes buys but repeatedly blocks sells may be a honeypot.
For automated market structure, this guide to automated market makers explains why pool reserves and swap logic matter.
Behavioral red flags
The surrounding project can reveal pressure tactics that code review misses:
- Unverifiable team: Founders provide names or credentials that can't be checked independently.
- Anonymous operators with no footprint: Privacy isn't proof of fraud, but anonymity increases the importance of contract transparency and accountable governance.
- Late audit activity: An audit appears only after criticism, with unclear scope or no evidence that identified issues were fixed.
- Aggressive referrals and yield promises: Recruitment pressure and guaranteed-return language shift attention away from product function and risk.
- Marketing-linked token releases: Large token releases or insider transfers align with promotional peaks.
- Price-only community: Discussion centers on targets and urgency rather than users, technology, or measurable utility.
Treat the checklist as a repeatable pre-trade process, not a badge that certifies a token. Readers who want broader security patterns can compare the approach with these real-world cybersecurity case studies.
Why Fewer Incidents Does Not Mean Smaller Risk
Counting incidents can create false comfort. A category may show fewer reported events while the remaining schemes become more damaging because operators target deeper liquidity, larger communities, or more established venues.
Early in 2025, one tracker reported rug-pull incidents falling 66% year over year, from 21 incidents to 7, while estimated losses approached $6 billion. The figures come from DappRadar's reported trend summary, and they illustrate why frequency alone is a weak risk measure. One large collapse can dominate the total.
| Year | Reported Incidents | Total Value Lost (USD) | Average Loss per Incident (USD) |
|---|---|---|---|
| Early 2024 comparison period | 21 | About $90 million | Not provided |
| Early 2025 | 7 | Nearly $6 billion | Not provided |
The comparison period and loss estimates are reported in the industry coverage of DappRadar's figures. The average loss per incident isn't calculated here because the verified data doesn't provide a compatible average for both periods.
Size the exposure, not just the probability
A value-at-risk mindset asks, “How much could this position cost if the market becomes unusable?” That question is more useful than asking only whether rug pulls are becoming common. A single trade in a large, polished pool can carry more absolute downside than many small experiments, even if the larger venue looks safer.
A broader 2024 survey found datasets documenting 2,448 rug-pull instances, but those datasets covered only 7 of 34 root causes, or about 20% coverage. The paper added 2,360 instances and expanded root-cause coverage to 54%, showing why reported counts remain incomplete and why detection must evolve. You can review the accompanying rug-pull research and taxonomy.
Practical rule: Decide the maximum acceptable loss before you buy. A lower incident count doesn't make an oversized position prudent.
What to Do If You Suspect a Rug Pull
Act in phases. Panic can cause a second loss through rushed approvals, fake recovery services, or further communication with the people who promoted the token.
Stabilize the wallet
First, stop interacting with the project's website and social links. If you still control assets, review and revoke token approvals that could let a malicious contract move funds, then transfer unaffected assets to a secure wallet if you believe the original wallet has been exposed. Don't connect the wallet to a new “recovery” site sent through direct messages.
If the token still trades, decide whether removing exposure is technically possible without signing unfamiliar transactions. A failed sell can be evidence, but repeated attempts may create additional fees or expose you to further contract behavior.
Document before the trail gets harder to follow
Create a clean evidence file containing:
- Wallet addresses: Your address, deployer wallets, liquidity recipients, and suspicious holders.
- Transaction hashes: Buys, approvals, failed sells, liquidity withdrawals, mints, and transfers.
- Timestamps: Record the relevant blockchain times and your local time.
- Screenshots: Save the chart, contract page, liquidity status, website, and social profiles.
- Communications: Preserve Telegram messages, posts, advertisements, referral links, and promises.
Blockchain transactions are public, but investigators still need accurate identifiers and context. Don't edit the original screenshots or delete messages.
Report through the right channels
Notify the exchange, wallet provider, decentralized application, or launch platform involved. Report the token address and evidence to the relevant blockchain explorer and scam-tracking service. You can also contact official agencies such as the FTC, SEC, IC3, or the equivalent authority in your jurisdiction.
Reporting may help investigators identify linked wallets or warn other users, but it doesn't guarantee recovery. Be especially cautious of anyone who demands an upfront payment or private key to retrieve funds. Recovery depends on the movement of assets, available records, jurisdiction, and enforcement action.
Building Better Habits and Knowing Your Resources
Rug-pull defense works best as a continuing discipline. Before each trade, verify the liquidity arrangement, inspect ownership permissions, review holder concentration, and read the contract's privileged functions. Then size the position so a complete loss wouldn't force a rushed decision elsewhere.
Diversification can limit dependence on one token or venue, but it doesn't turn speculative assets into safe assets. Established ecosystems, including Ethereum and Layer 2 networks, can offer mature infrastructure while still hosting risky contracts. Bitcoin typically presents a different risk profile from a newly deployed token, yet no asset or network removes the need to verify what you're buying.
Keep learning from tools and researchers that expose contract behavior. CertiK, TokenSniffer, De.Fi scanners, blockchain explorers, and reputable security researchers can help you compare ownership, liquidity, holder, and transaction signals. Treat scanner results as evidence to investigate, not as an automatic approval.
Regulatory work also affects accountability. SEC enforcement, MiCA implementation, and actions by authorities in other jurisdictions may influence how deployers, promoters, exchanges, and service providers operate, but legal oversight can't reverse every transaction or protect every trade. Readers studying how regulation intersects with the sector can explore these RNC Group crypto challenges.
The most durable habit is skepticism toward urgency. A useful guide on how to avoid crypto scams can reinforce that practice, especially as scams combine smart contracts, social media, AI-generated promotion, and cross-chain movement. The aim isn't to predict every failure. It's to understand control, verify the transaction path, and limit the amount you place at risk.
Coiner Blog publishes practical guides and balanced analysis on crypto risks, DeFi, Web3, tokenomics, and emerging blockchain technology. Visit Coiner Blog to keep building the research habits that help you evaluate new projects before you buy.