Rug Pull Crypto Scams: Warning Signs and How to Check a Token

A rug pull crypto scam happens when project developers attract buyers, then suddenly remove liquidity, dump a hidden token supply, or exploit contract code to drain funds, leaving holders with tokens they cannot sell or tokens worth nothing. It is the single most common exit scam in decentralized finance, and it clusters around new tokens and memecoins precisely because those markets have the least friction between deploying a contract and listing it for trading.

This guide covers the four main types, a red-flag checklist, an eight-step token check you can run before buying, and what to do if you have already been rugged.

What Is a Rug Pull in Crypto?

A rug pull takes its name from "pulling the rug out from under someone": support disappears without warning, and the person standing on it falls. In crypto, that support is liquidity, a token's contract integrity, or the team's continued involvement.

Rug pulls are most common on decentralized exchanges, where anyone can deploy a token and create a trading pair without third-party approval. They also appear in NFT project launches and, less frequently, in centralized platforms that list unvetted tokens. The defining feature is intent: it is a planned exit by insiders at buyers' expense. The risk rises when founders and early investors hold more than 50% of supply with short vesting periods.

For a deeper look at how liquidity pool mechanics work and why they create this attack surface, the glossary entry explains the underlying structure.

Types of Rug Pulls

Liquidity pull ("hard rug")

The deployer creates a trading pair, attracts buyers, then calls Remove Liquidity on the DEX pool and walks away with the paired ETH, SOL, or USDT. The token price collapses to near zero in seconds. Buyers cannot sell for meaningful value because there is nothing left to trade against.

The on-chain signal to watch: LP tokens still sitting in the deployer's wallet, with no lock or burn recorded on a verifiable locker contract.

Insider dump ("soft rug")

Here the contract itself may be clean. The problem is allocation. The founding team or early wallets hold a large, undisclosed share of supply, wait for organic buying to push the price up, then sell their entire position into that demand. Holders watch the chart collapse and find no contract exploit to point to.

A founding team and early investors controlling more than 50% of supply with short vesting periods can sell rapidly after launch. The absence of published vesting schedules is itself a red flag. This pattern overlaps with pump and dump schemes, though a soft rug typically involves the original project team rather than external promoters.

Malicious contract code

Privileged contract logic lets insiders mint new tokens, change sell taxes, pause trading, blacklist wallets, or move balances. A hidden mint function can inflate supply and dilute holders. A sell tax adjustable up to 100% can make a token effectively unsellable. A blacklist can block specific addresses from transferring.

For the specific case where the contract blocks all ordinary sells while allowing creator wallets to exit, see how to detect a honeypot scam. That article covers the mechanics in depth; here, the key point is that malicious contract code is the mechanism behind both rug pulls and honeypots.

Slow rug and abandoned projects

Not every rug is sudden. A slow rug plays out over weeks or months: development activity stops, the treasury is quietly drained, and the team gradually reduces its presence. Holders notice declining holder counts, thin liquidity, and a price that bleeds rather than crashes. By the time the project is clearly dead, insiders have already exited.

Rug Pull vs Honeypot vs Pump and Dump

The honeypot row deserves one clarification: in a honeypot, the inability to sell is built into the contract from day one. In a rug pull, you could sell before the exit event. That distinction matters for the on-chain checks you run.

Well-Known Rug Pull Examples

• SQUID (November 2021). The Squid Game-themed token rose from roughly $0.01 to more than $2,800, then became unsellable. Developers reportedly disappeared with approximately $3.38 million. The collapse was near-instantaneous.

   

• Frosties NFT (alleged, 2022). The creators allegedly moved roughly $1.1 million after the NFT collection sold out, then abandoned the project.

   

• LIBRA (February 2025). LIBRA spiked to a $4.56 billion market capitalization on February 14 before falling more than 94%. The token sparked rug pull allegations, though the classification remains disputed.

   

• Mantra (OM) and DappRadar's 2025 figures. OM's April 14 collapse accounted for 92% of DappRadar's nearly $6 billion in reported 2025 rug-pull losses. DappRadar recorded seven rug-pull incidents in 2025 versus 21 during the comparable 2024 period, a 66% decline in incident count, while reported losses rose from $90 million to nearly $6 billion. Mantra disputed the rug pull characterization.

The pattern across these cases: a rapid price rise, concentrated insider ownership, and an exit that left ordinary holders unable to recover value.

Rug Pull Warning Signs: Red-Flag Checklist

Team and marketing

• Anonymous team with no verifiable identity or track record
• Paid influencer promotion without disclosure
• Countdown timers and FOMO-driven launch mechanics
• Unrealistic APY promises with no explained source of yield
• Announcements that cannot be verified against the project's official website, blog, and social channels

Contract

• Source code not verified on the block explorer
• Owner or role can mint new tokens
• Sell tax is adjustable (especially if it can reach 100%)
• Wallets can be blacklisted or frozen by the owner
• Transfers can be paused
• Upgradeable proxy with a single-key admin
• Solana mint authority or freeze authority not revoked

Liquidity

• LP tokens held by the deployer, not locked or burned
• Lock expiry is imminent or unverifiable
• Low pool depth means one large order can move the price substantially

Holders

• Founding team and early investors control more than 50% of supply
• Top wallets are fresh addresses funded from the deployer
• Wallets show synchronized purchase timing

Trading

• Sells are consistently failing or reverting in simulation
• Sell tax is significantly higher than buy tax
• Buy and sell volume looks one-sided

How to Check a Token Before You Buy (Step by Step)

Step 1: Get the contract address from an official source

Copy the contract address from the project's official website or documentation. Do not use an address from a Telegram group, a social post, or a search result. A single-character difference sends you to a different contract entirely.

Step 2: Inspect it in a block explorer

Open the address in the correct explorer for the chain: Etherscan for Ethereum, BscScan for BNB Chain, Solscan for Solana. An EVM address can look identical across chains while its activity does not appear on the wrong explorer. Confirm the source code is verified and read the contract functions before proceeding.

Step 3: Run two token scanners

No single scanner catches everything. Run at least two. Look for flagged functions (mint, pause, blacklist), elevated owner permissions, and any automatic risk scores. A clean scan is preliminary evidence. Keep checking.

Step 4: Check liquidity

Open the trading pair in a DEX aggregator. Check pool depth and whether LP tokens are burned to a dead address or locked in a verifiable locker contract with a release date you can confirm on-chain. Unlocked LP tokens in the deployer wallet are a hard stop.

Step 5: Check holder distribution

Review the top holders list. Exclude known pool, locker, burn, and exchange addresses, then look at what the remaining concentration looks like. More than 50% of supply in founding-team and early-investor wallets with short vesting periods is a serious warning. Wallets sharing a funding source or showing synchronized buy timing suggest coordinated insider holdings.

Step 6: Check taxes and trading history

Simulate a buy and a sell using a tool that runs the transaction off-chain. Confirm the actual buy and sell tax. Review recent transactions for patterns: sells consistently reverting, buys executing but sells failing, or a tax that differs from what the project advertises.

Step 7: Check audits

A smart contract audit from a named firm is evidence worth examining. Verify the audit exists at the auditor's own website, confirm it covers the deployed contract address and version, and read the findings rather than just the headline result. An audit that predates a proxy upgrade may no longer cover the live code.

Step 8: Check fundamentals

Review the whitepaper, the team's verifiable history, the vesting schedule, and the roadmap. For a more structured framework, the guide on how to evaluate a token covers tokenomics, market sentiment, and the broader factors that affect token prices beyond on-chain signals alone.

Token check tools (as of October 2026)

How Tangem Wallet Helps at the Moment You Sign

Token scanners and on-chain checks happen before you buy. But rug pull exposure also arrives through the transactions you sign after you already hold a token: connecting to a new dApp, approving a spender contract, or interacting with a project's interface.

Tangem Wallet helps with this signing-moment risk through its WalletConnect integration. From app version 5.27, the integration uses three security layers.

• Blockaid-powered Know Your dApps (KYDA) checks a dApp before you connect, using Blockaid threat detection and real-time behavioral analysis. Suspicious dApps trigger warning prompts.

   

• Transaction simulation runs an off-chain dry run before you sign. It provides a human-readable preview, shows calculated balance changes, and detects hidden operations in complex transactions.

   

• Cryptographically verified transactions (VTX) use signed transaction bundles, so the preview can be verified against execution. This prevents man-in-the-middle attacks between simulation and signing.

For scam detection for WalletConnect with Blockaid, the product documentation explains the full architecture.

Approvals need the same attention. A limited approval restricts the amount a spender can move. An unlimited approval leaves a broader permission in place until you revoke token permissions. This protection applies to the signing step. It cannot assess a token's investment quality or predict an insider dump.

For new or experimental tokens, keeping a separate wallet for that activity and using cold storage for long-term holdings limits the blast radius if something goes wrong. Tangem Cold Wallet requires a physical card tap for every transaction, so even a compromised phone cannot sign without the card present.

Got Rugged? What to Do Next

1. Revoke approvals immediately. An unlimited approval can remain exploitable if that address is funded again. Cancel outstanding approvals on the affected address.

    

2. Disconnect a malicious dApp. Remove the dApp's connection from your wallet to prevent further interaction.

    

3. Do not interact with refund tokens or unexpected airdrops. Unsolicited tokens that direct you to "claim" or "unlock" funds are almost always a second-stage scam. Do not connect a wallet or sign anything in response to them. See the guide on airdrop scams for the mechanics.

    

4. Save records. Check the affected address in the relevant block explorer for unauthorized outgoing transactions, unfamiliar approve() calls, and unrecognized token transfers. Record when the first unauthorized transaction occurred. This information matters for reporting.

    

5. Report the incident. In the United States, report to the FBI's IC3 at ic3.gov, or to your local cybercrime authority. Reporting helps pattern analysis even when individual recovery is rare.

    

6. Do not pay fund-recovery services. Unsolicited recovery offers that arrive after a loss are scams targeting victims a second time.

    

7. Consider the tax implications. Losses from a rug pull may be relevant to your tax filing. This is not tax advice. Consult a qualified tax professional in your jurisdiction.

Blockchain transfers are generally irreversible. Recovery is extremely unlikely after stolen tokens have been moved, though an exchange may sometimes freeze funds that arrive on its platform.

Final Thoughts

Rug pulls in crypto cannot be fully eliminated from a market where anyone can deploy a token in minutes. The eight-step check above filters out most obvious traps: unlocked liquidity, callable mint functions, concentrated insider holdings, and failing sell simulations are detectable before you commit a single dollar.

Risk only what you can afford to lose entirely. That is the operating assumption for any new or unaudited token. The rug pull crypto threat is real, and a fifteen-minute review can catch many obvious traps. For ongoing protection at the signing step, Tangem Wallet's pricing and features are available on the product page.

Disclaimer: This article is for educational purposes only and is not financial, legal, or tax advice. Report scams to the FBI's IC3 (ic3.gov) or your local authorities.