How to prevent Rug-pull scams in crypto

What Is a Crypto Rug Pull?

ByDigital Forager

How to Spot One Before It Costs You Everything

Updated September 26, 2026

You found a new token. The Telegram is buzzing. The chart is going vertical. Influencers are calling it the next big thing. You buy in – and 48 hours later the developers have vanished, the liquidity is gone, and your investment is worth nothing.

That’s a rug pull. And it happens every single day.

The rug pull is the most common crime in crypto – with more than 300,000 scam tokens created and 2 million investors defrauded. That’s greater than the number of investors harmed by the collapses of FTX, Celsius, and Voyager combined.

2025 was a strange year for rug pulls: the total number of incidents fell, but the ones that did happen got bigger. Total crypto theft for the year – hacks, rug pulls, and exit scams combined – reached roughly $3.4 billion, and a single event, the Mantra (OM) collapse, wiped out close to $6 billion in market value on its own in under an hour.

The good news is that rug pulls are almost always preventable. They follow a predictable playbook and leave clear warning signs – if you know what to look for.

What Is a Rug Pull?

A rug pull is a crypto scam where developers abandon a project and escape with investor funds, leaving token holders with worthless assets. The term originates from the phrase “pulling the rug out from under someone” – suddenly withdrawing support and leaving someone in a difficult position.

The mechanics vary but the result is always the same – you’re left holding tokens that can’t be sold and are worth nothing.

The Three Main Types of Rug Pull

1. Liquidity Rug Pull – The Most Common

In a liquidity rug pull, developers who control the liquidity pool suddenly withdraw all the paired cryptocurrency, leaving the new token with no trading value. Since the liquidity isn’t locked or is controlled by developer wallets, this drain happens instantly and the token price collapses.

Think of the liquidity pool as the reservoir that lets you sell your tokens. When it’s drained, your tokens still exist in your wallet – they’re just unsellable. You own something worthless.

2. Exit Scam – The Long Con

Developer exit scams involve the project team simply disappearing after raising funds. This often occurs after an initial coin offering, token presale, or new NFT mint. The developers promote the project heavily, collect investments, then delete social media accounts, shut down websites and abandon the project entirely.

Some exit scams happen within days. Others take months – building genuine community trust before pulling the rug when the money is significant enough. MetaYield Farm, below, followed exactly this pattern in 2025.

3. Pump and Dump – The Classic

Developers and insiders hype a token through social media, influencer partnerships and aggressive marketing to artificially inflate its price. As retail investors pile in during the pump phase, insiders who hold large token allocations sell off their holdings at peak prices, causing the price to crash.

Unlike other rug pulls, pump and dumps don’t always involve stealing liquidity directly – the scam is in the coordinated selling by insiders who hold massive token allocations while retail buyers are still buying. We documented this pattern live, screenshot by screenshot, in Crypto Pump and Dump Schemes – How Telegram Groups Coordinate Token Manipulation.

The Red Flags – What to Check Before You Buy

Almost every rug pull leaves warning signs before it happens. The five red flags covered here catch roughly 90% of them if you check before you buy.

Red Flag 1 – Anonymous Team With No Track Record

The single strongest predictor of a rug pull is an anonymous team with no verifiable history in the crypto industry. While pseudonymity is common in blockchain culture, there is a meaningful difference between pseudonymous builders with a track record and completely anonymous developers who appeared last week.

This doesn’t mean every anonymous project is a scam – but anonymous team plus other red flags is a serious warning combination.

Red Flag 2 – No Smart Contract Audit

Reputable projects have their smart contracts audited by independent security firms before launch. The most respected audit firms include CertiK, Trail of Bits, OpenZeppelin, Hacken, and Quantstamp.

Important caveat: Scammers frequently fabricate audit reports or claim audits from firms that have never reviewed their code. An audit does not guarantee safety – audits are point-in-time reviews and developers can modify contract code after an audit is completed if the contract uses upgradeable proxy patterns.

Always verify audits directly on the audit firm’s official website – never take the project’s word for it. For a fuller framework on vetting a project before you buy, see our guide to evaluating crypto projects.

Red Flag 3 – Unlocked Liquidity

A liquidity lock sends the LP tokens to a time-locked smart contract so the developer physically cannot withdraw them before the lock expires. Legitimate projects lock liquidity for 6 to 12 months minimum, often longer. Locks under 30 days are a warning sign and no lock at all is a stop sign.

You can verify liquidity locks on Etherscan for EVM tokens or through RugCheck for Solana tokens. If the LP tokens are sitting in the developer’s wallet with no lock contract, walk away.

Red Flag 4 – Concentrated Token Ownership

If a small number of wallets hold a massive percentage of the total token supply, those holders can crash the price the moment they sell. Sophisticated rug pullers distribute tokens across dozens of wallets – to detect this, check if multiple top holders were funded from the same source wallet and use Bubblemaps for visual cluster analysis.

As a general rule, if the top 10 wallets hold more than 30-40% of the total supply you have serious concentration risk.

Red Flag 5 – Impossible Yields and Unrealistic Promises

If a project is offering 1,000% APY or guaranteeing returns – ask yourself where that yield is actually coming from. Legitimate yield comes from trading fees, protocol revenue, and lending interest (the same sources we break down in What Is DeFi, Explained). Unsustainable yields come from printing new tokens that dilute existing holders or from the next buyer’s money – classic Ponzi mechanics.

FOMO and social proof override due diligence. When a token is pumping 500% in 24 hours and an influencer with 200,000 followers is promoting it, checking the contract feels like it might cost you the trade. Scammers are counting on your urgency – the same manipulation tactic covered in Fake Crypto Influencers – AI Deepfakes Stealing Millions.

Red Flag 6 – Honeypot Smart Contract

A honeypot is a particularly cruel variant – the token is coded so you can buy but you can never sell. Before buying, use GoPlus or Honeypot.is to simulate whether selling is possible. On DEXTools, if you see only green buy candles with no red sell candles, that is a classic honeypot signature. We break this specific scam down further in Honeypot Tokens – Profits You Can Never Spend.

Red Flag 7 – Aggressive Paid Marketing With No Substance

Today’s scam platforms are polished. They copy UI patterns from established brands, integrate real-time price feeds, and even simulate activity to appear trustworthy.

Watch for: multiple influencers promoting the same unknown token simultaneously, Telegram groups with thousands of members but almost no real conversation, bots spamming positive sentiment across social media, and pressure to buy before it’s “too late.” These are the same manufactured-urgency tactics we documented in Discord and Telegram Social Engineering.

Real projects don’t need to manufacture urgency. If the marketing feels like a coordinated push rather than organic excitement – trust that instinct.

The Free Tools That Can Save You Money

You don’t need to be a developer to do basic rug pull screening. These free tools take about five minutes per token:

RugCheck (rugcheck.xyz) – Solana token scanner. Checks for mint authority, freeze authority, liquidity locks, and bundle analysis. Gives tokens a risk score.

TokenSniffer (tokensniffer.com) – EVM token scanner. Checks contract code for known scam patterns, copycat code, and honeypot mechanics.

Honeypot.is – Simulates a buy and sell transaction to check whether selling is actually possible before you commit real money.

Bubblemaps (bubblemaps.io) – Visual tool that shows wallet connections and token distribution. Makes it easy to see if wallets that appear independent are actually controlled by the same person.

DEXScreener (dexscreener.com) – Shows buy/sell ratios, holder counts, liquidity size, and trading history. A token with only buy transactions and no sells is a red flag.

This free detection stack catches amateur and intermediate scams before your money is at risk, and the entire process takes less time than scrolling through the project’s Telegram. New tokens also tend to cluster around fresh chain launches – see How Meme Tokens Front-Run Chain Launches for that specific pattern.

Famous Rug Pulls – Real Examples {#famous-rug-pulls}

Squid Game Token (2021) – Capitalized on the Netflix show’s popularity. Price pumped to $2,861 before developers pulled the liquidity and disappeared with approximately $3.3 million. The token had a honeypot mechanic – buyers could not sell.

AnubisDAO (2021) – Raised $60 million in ETH in roughly 20 hours by impersonating OlympusDAO. Entire liquidity pool was drained within 24 hours of launch. Developers were anonymous and vanished.

SafeMoon – Federal prosecutors alleged the project’s founders and executives misled investors about supposedly “locked” liquidity, then diverted and misappropriated millions of dollars for personal use. SafeMoon’s market cap had grown to more than $5.7 billion before the alleged fraud unraveled. CEO Braden John Karony was found guilty on fraud charges in May 2025 and faces up to 45 years in prison at sentencing – a rare case where a rug pull actually ended in conviction rather than the developers simply vanishing. Full details are in the SEC’s own press release.

MetaYield Farm (2025) – A DeFi yield farming protocol that disappeared in 2025 after withdrawing roughly $290 million from more than 14,000 investors, then deleted its entire online presence.

LIBRA Token (2025) – Promoted in part by Argentina’s sitting president, LIBRA reached a market cap of $4.56 billion before insiders extracted an estimated $250 million within hours of launch, crashing the price roughly 94% and affecting more than 114,000 investor wallets. It’s the starkest recent reminder that even political endorsement offers zero protection against a rug pull.

Mantra / OM Token (2025) – The single largest crypto collapse of the year. OM’s price fell more than 90% in under an hour in April 2025, erasing close to $6 billion in market value. Exchanges and investigators scrutinized insider wallet activity following the crash, though the project’s team disputes characterizations of it as a deliberate rug pull. Whatever the ultimate cause, it’s the clearest illustration yet that concentration risk (Red Flag 4) can sink even a project with real exchange listings and market cap.

What to Do If You’ve Been Rug Pulled

The honest answer is that recovery is possible but narrow. The FBI’s IC3 fast-freeze program recovered about 58% of funds reported within the first hours of a theft in 2025 – but that success rate applies specifically to money still sitting in a bank-linked account before it moves further. Once stolen funds reach an exchange or a mixer, the odds of recovery drop sharply, and against total 2025 crypto losses of over $11 billion, the amount ultimately recovered remains a small fraction. Blockchain transactions themselves are irreversible – there’s no chargeback.

However, there are steps worth taking, and speed matters more than anything else:

  • Document everything – transaction hashes, wallet addresses, project website, social media. Screenshots of everything before it disappears.
  • Report to the FBI’s IC3 immediately – reports made within the first 24-72 hours have the best chance of triggering a freeze before funds move further.
  • Report to the FTC
  • Report to the project’s blockchain – Ethereum, Solana, and BNB Chain all have fraud reporting channels
  • Post publicly – warning others prevents more victims and creates a paper trail
  • Consult a crypto recovery specialist cautiously – be careful here, recovery scams targeting rug pull victims are extremely common. Never pay upfront fees to “recover” your funds.

The Bottom Line

For the average retail trader, spending five minutes on due diligence before every new token purchase is the single highest-ROI habit in crypto – because the money you do not lose to scams compounds just as powerfully as the money you make on legitimate trades. That’s the whole logic behind our Crypto Compounding Flywheel strategy: none of it works if a rug pull wipes out your capital first.

The crypto space is full of genuine opportunities – but it rewards the careful and punishes the impulsive. Run the free tools. Check the liquidity lock. Look up the team. If something feels designed to create urgency and override your judgment – it probably is.

For more on staying safe in the crypto space, check out our Crypto Security guide (or browse the full Crypto Security hub), our real scam DM breakdown, and our guide to evaluating crypto projects. Every recommendation on FreeCryptoList goes through the same screening process described in How We Rate Crypto Opportunities.

Frequently Asked Questions

A normal crash is the market repricing a real asset – painful, but the project and its team are still there. A rug pull means the team deliberately drained liquidity, abandoned the project, or coded the token so it could never be sold in the first place. The tell is usually what happens after the price drop: a real project’s team stays and communicates; a rug pull’s team deletes their social media and disappears.

For Ethereum and other EVM tokens, look up the liquidity pool contract on Etherscan and check whether the LP tokens sit in a time-locked contract or in a regular developer wallet. For Solana tokens, RugCheck does this automatically and gives the token a risk score. If you can’t confirm a lock, treat the liquidity as unlocked.

No. An audit is a point-in-time review, and scammers regularly fabricate audit reports or falsely claim a real firm reviewed their code. Even a genuine audit doesn’t stop a team from changing the contract afterward if it uses an upgradeable proxy pattern. Always verify a claimed audit directly on the auditing firm’s own website before trusting it.

It’s possible but time-sensitive. The FBI’s IC3 fast-freeze program recovers a real share of funds reported within the first 24-72 hours, while the money is still moving through traceable accounts. Once it reaches a mixer or is cashed out, recovery odds drop sharply. Report immediately, document everything, and be extremely wary of anyone offering guaranteed fund recovery for an upfront fee – that’s a common secondary scam targeting rug pull victims.

It’s widely covered alongside rug pulls because of the scale (nearly $6 billion erased in under an hour) and the concentrated-ownership pattern behind it, but the project’s team disputes that characterization, and the exact cause is still debated. Regardless of intent, it’s a real-world example of how concentrated token ownership can sink a project’s price almost instantly.

Run it through RugCheck (Solana) or TokenSniffer (EVM chains) for an automated risk score, check Honeypot.is or GoPlus to confirm you can actually sell, and glance at DEXScreener for a healthy mix of buy and sell transactions. All five minutes combined, and together they catch roughly 90% of rug pulls before you risk any money.

Sources

Similar Posts