A rug pull is a type of crypto scam where project creators attract investor capital, then drain the funds and disappear. The mechanics vary, but the outcome is always the same: holders are left with tokens that have no value and no liquidity to sell into. Unlike exchange hacks or smart contract exploits, rug pulls are intentional. The people who built the project are the ones who destroy it. Understanding how they work and what signals they leave behind is the single most important skill for anyone interacting with new tokens, DeFi protocols, or NFT projects.
Hard Rugs vs. Soft Rugs vs. Honeypots
Hard rug pulls are the most aggressive form. The developer drains the liquidity pool in a single transaction, making the token instantly untradeable. This typically happens within 24 hours to 7 days of launch. According to industry data, 38% of hard rug pulls occur within the first week. The developer creates a trading pair on a decentralized exchange, waits for buyers to swap in, then withdraws all paired assets (usually ETH, SOL, or USDT), leaving holders with tokens that technically exist in their wallets but have zero market value.
Soft rug pulls are slower and harder to detect. The team builds hype through marketing and influencer campaigns, then gradually dumps their large token allocations as the price rises. The average soft rug lasts approximately 8 months before the project is effectively abandoned. Soft rugs increased by 33% between 2024 and 2025, causing an estimated $1.2 billion in losses in a single year. Because the selling happens gradually, it often looks like normal market activity until the pattern becomes unmistakable.
Honeypots use a different mechanism entirely. The smart contract is coded to allow buying but block or heavily tax selling. Victims can purchase the token and watch the price climb, but when they try to sell, the transaction either fails or incurs a fee so high that the trade is worthless. On DEXTools, a classic honeypot signature is a chart with only green (buy) candles and no red (sell) candles.
Five Warning Signs That Catch 90% of Rug Pulls
1. Unlocked or short-term liquidity. Legitimate projects lock their liquidity pool (LP) tokens in a time-locked smart contract for a minimum of 6 to 12 months. If the LP tokens are sitting in the deployer’s wallet with no lock, the developer can drain the pool at any time. Locks under 30 days are a warning sign. No lock at all is a stop sign. Verify locks on Etherscan for ERC-20 tokens, RugCheck for Solana tokens, or GeckoTerminal which shows lock status directly in its pool view.
2. Concentrated token supply. Check the “Holders” tab on a block explorer. If a single wallet (excluding known exchange or contract addresses) holds more than 20-30% of total supply, that wallet can crash the price with a single transaction. Sophisticated scammers distribute tokens across dozens of wallets to mask concentration. Use Bubblemaps for visual cluster analysis to see if multiple top holders were funded from the same source wallet.
3. Unaudited or unverified contracts. A legitimate project publishes its smart contract source code and ideally has it audited by a recognized security firm. If the contract is unverified on the block explorer, you cannot read the code, which means you cannot know what functions exist. Even verified contracts can contain hidden mint functions, modifiable tax parameters, or admin-only sell restrictions. Tools like Token Sniffer and GoPlus Security can flag these risks automatically.
4. Unrealistic yield or return promises. If a new DeFi protocol advertises 500% APY or higher with no clear explanation of where the yield comes from, the yield is coming from new depositors, not from real economic activity. Legitimate DeFi yields come from identifiable sources: borrower interest on lending protocols, trading fees on DEX pools, and network inflation plus transaction fees for staking. If the math does not add up, neither does the project.
5. Aggressive, coordinated marketing with no substance. Multiple influencers promoting the same unknown token simultaneously is one of the strongest rug pull indicators. According to 2026 data, 70% of rug pull projects used aggressive paid marketing to attract victims. Check whether the project has a working product, a public GitHub repository, or any verifiable development activity. Social media following with no genuine community engagement (10,000+ members but only 5 people chatting) is a classic bot-inflated signal.
Real Cases That Show the Pattern
| Project | Year | Loss | Method |
|---|---|---|---|
| MetaYield Farm | 2025 | $290M | Liquidity drain, team vanished |
| Mantra (OM) | 2025 | $5.52B | 17 wallets dumped 43.6M tokens |
| LIBRA ($LIBRA) | 2025 | $250M (insiders) | Political endorsement + insider dump |
| WOLF | 2025 | $42M peak wiped | 82% insider supply, LP drained |
| RAVE | 2026 | 95% crash | Concentrated supply, exchange pump |
RAVE Crashes 95% to $1.24 as RaveDAO Denies Manipulation and Confirms Plans to Sell Tokens
Free Tools for Verification
You do not need to read Solidity to protect yourself. Several free tools automate the most important checks.
Token Sniffer (tokensniffer.com) scans smart contracts for known scam patterns, including hidden mint functions, honeypot mechanics, and copycat code from previously flagged tokens.
GeckoTerminal (geckoterminal.com) shows real-time liquidity, holder distribution, lock status, and pool composition. Its built-in rug pull checker flags high-risk tokens automatically.
Bubblemaps (bubblemaps.io) provides visual maps of token holder relationships. Connected bubbles indicate wallets funded from the same source, exposing hidden concentration even when supply appears distributed.
GoPlus Security (gopluslabs.io) offers a Token Security API that checks for honeypot mechanics, sell restrictions, modifiable taxes, and other contract-level risks in real time.
DEXTools (dextools.io) shows pair-level data including liquidity depth, holder distribution, buy/sell ratios, and contract audit scores. If you see only buy transactions and no sells, close the tab.
What to Do If You Suspect a Rug Pull
If you are already holding a token and suspect a rug pull is developing, act quickly. Try to sell immediately through the DEX where the token is listed. If the sell transaction fails or shows abnormally high slippage, the contract may have sell restrictions enabled. Check Honeypot.is to simulate whether selling is possible before committing gas fees to a transaction that will fail.
Revoke any token approvals you have granted using Revoke.cash. Many scam contracts request unlimited spending approval during purchase. Even after selling, an active approval can allow the contract to drain other assets from your wallet.
Report the token on the platform where you found it and flag the contract address on community databases. Recovery of funds after a rug pull is extremely rare because stolen assets are typically laundered through mixers and cross-chain bridges within minutes. Prevention is the only reliable defense.
The Uncomfortable Math
Over 5,000 new tokens launch every single day across Ethereum, Solana, Base, and BSC. On Solana’s Raydium alone, 93% of pools showed soft rug pull characteristics in recent analysis. On Pump.fun, 98.6% of the 7 million tokens launched since 2024 were flagged as rugs or pump-and-dumps. Only 97,000 held more than $1,000 in liquidity.
These numbers are not meant to discourage participation in crypto. They are meant to recalibrate expectations. The vast majority of new token launches are not investment opportunities. They are extraction events designed to transfer money from buyers to creators. The projects that survive and deliver value are the exception, not the rule. Treating every new launch with skepticism, verifying before buying, and accepting that missing a pump is always better than catching a rug is the mindset that separates survivors from victims in this market.
