A crypto rug pull starts with a token that drains your wallet usually has a very clean website. You can see a green chart, and an influencer you half-trust is posting about it, and the whole thing looks more legit than half the real projects you’ve seen. And then the liquidity vanishes in just a transaction, and your bag is worth nothing.
So here’s the short version of how to spot a crypto rug pull before it happens. This guide walks through each one, but it also covers the stuff generic listicles skip, like the red flags that are actually false alarms, and what your realistic options are if you have already been hit.
Key Takeaways
- A crypto rug pull is an exit scam where insiders build hype, attract money, then pull the value out and disappear. It’s one slice of a much larger crypto fraud problem.
- Crypto scams pulled in at least $14 billion and possibly $17 billion in 2025, up from a revised $12 billion the year before.
- The four highest-signal red flags are unlocked liquidity, concentrated token holdings, sell-blocking contract code, and an anonymous team making big promises.
- On Solana, roughly 98% of new tokens on Pump.fun showed traits of a pump-and-dump or rug pull, so most new tokens are scams, which is kind of closer to the truth.
- Free tools like block explorers, token sniffers, and liquidity-lock checkers catch the majority of crypto scams before you spend a cent.
- Recovery after a crypto rug pull is rare. Revoke wallet approvals, report it, claim the tax loss, and avoid recovery services, which are usually a second scam.
What a Crypto Rug Pull Is and How It Works
A crypto rug pull is a scam where the people who created a token deliberately collapse its value and walk away with the money. They’re not victims of a hack or a bad market. They just built the project as a trap. Binance Academy frames it the same way: insiders attract liquidity, then yank it out.
This isn’t done on a small scale. Beyond the $14 to $17 billion in total crypto scam losses for 2025, memecoin rug pulls, and scams alone cost investors over $500 million in 2024. And the average payment victims sent to a scam wallet jumped from $782 in 2024 to $2,764 in 2025, partly because AI tools made the fakes more convincing.
Rug pulls split into two shapes, and they fail differently.
Hard Crypto Rug Pulls: Liquidity theft and malicious code
A hard crypto rug pull is fast and mechanical. The most common version is a liquidity pull. When a token launches on a decentralized exchange, the developers pair it with real money, say ETH or SOL, to create a trading pool. That paired money is what lets you sell. In a liquidity pull, the developers hold the keys to that pool, wait for buyers to fill it up, then withdraw everything in a single transaction. The price goes to zero because there’s nothing left to sell into.
The other hard version lives in the smart contract itself. A “honeypot” token is coded so you can buy but never sell. The classic example is the SQUID token, which surged to around $2,800 before its developers cashed out more than $3 million and left holders unable to exit.
Soft Crypto Rug Pulls: Slow dumps and project abandonment
A soft crypto rug pull is quieter, instead of draining the whole pool in just one move. They just stop building and let the project rot while keeping the funds they raised. They just exit slowly. Now these slow exits are harder to prosecute because they look like an ordinary failure. No sudden transaction, it’s just a team that ghosts you and a chart that bleeds out over months.
Warning Signs That a Token Is About to Collapse
If you want to learn only one signal, then learn this one; unlocked liquidity is the difference between a project that can rug you and one that structurally can’t. Almost every other red flag is a supporting actor. Here are the categories that matter, kept separate so you know exactly what you are looking at.
Liquidity and tokenomics red flags
These are some simple questions, even if the answers take a minute to find.
- Is the liquidity locked or burned? If a trading pool remains unlocked, developers retain the technical ability to withdraw the entire pool at will. Locked liquidity sits in a smart contract for months, with a public timelock that you can verify. A promise in a Telegram chat is not a lock.
- How concentrated are the holdings? If the top 10 wallets hold most of the supply, those holders can crash the price at will. As a rough rule, a single non-team wallet holding more than 5% of supply, or a top 10 controlling more than 30 to 40%, deserves a hard look.
- How large is the team allocation? A team quietly sitting on 40% of tokens with no vesting is a slow rug waiting to happen.
Public.com’s guide to spotting crypto scams makes the same core point; thin liquidity plus concentrated ownership is the setup behind most price crashes. The reason this matters more than marketing is that you can prove it on-chain in seconds, while you can never prove a roadmap.
Team, audit, and community red flags
The human layer is noisier, so weigh these together rather than one at a time.
- Anonymous team with big promises: Anonymity alone isn’t harmful. But anonymity plus guaranteed returns with a countdown timer is the oldest pump bait.
- A fake or unverifiable audit: An audit from a firm nobody can independently verify is more dangerous than no audit at all, because it manufactures trust you haven’t earned. Check if the audit firm even exists and that the report is real.
- Manufactured community: Bought followers, copy-paste whitepapers, and locked or comment-disabled social channels all point in the same direction. A real community argues. A farmed one only cheers.
Smart contract red flags
This is the layer that never shows up on the website or the chart, which is exactly why it works.
- Mint functions that let the owner create unlimited new tokens and dilute you to zero.
- Adjustable transfer or sell fees that start near zero and can be cranked to 99%, which is a soft honeypot.
- Blacklist functions that let the owner block specific wallets from selling.
- Disabled selling outright, the hard honeypot.
None of these are visible unless someone reads the contract, so the next section is about how to actually do that without being a developer.
How to Verify a Token Before You Buy
Two checks catch the majority of crypto scams; confirming the liquidity is locked, and confirming the supply isn’t hoarded in a handful of wallets. The trick is to know which tool answers which question, then run them in a fixed order so you never skip the important one.
On-chain checks and the tools that run them
You don’t need to write code. All you need to know is what each tool reveals. So, here’s the reference set I reach for, all of which have free tiers.
| Tool | What does it tell you | Cost | Coverage |
| Block explorer (Etherscan, Solscan, BscScan) | Contract code, holder list, transaction history, and who owns the contract | Free | Chain-specific |
| Token sniffer/honeypot detector (Token Sniffer, Honeypot.is, GoPlus) | Whether selling is blocked, hidden fees, mint, and blacklist functions | Free | Multi-chain |
| Liquidity-lock checker (the locker’s own dashboard, DEX analytics) | Whether the pool is locked or burned, and for how long | Free | Multi-chain |
| Holder-distribution scanner (explorer holders tab, Bubblemaps) | How concentrated the supply is and whether top wallets are linked | Free/freemium | Multi-chain |
The block explorer is your foundation. The holders tab alone tells you the concentration story, and the contract tab shows whether ownership has been renounced. Crypto.com’s guide to avoiding crypto rug pulls walks through the same on-chain habits, and they are worth building into muscle memory.
A five-minute pre-purchase checklist
Run these in order. If any single step falls back, stop. You are done.
- Paste the contract address into a honeypot checker. If it flags blocked selling or extreme fees, walk away. (token sniffer).
- Open the holders tab on the block explorer. If the top 10 wallets dominate, treat it as high risk. (block explorer).
- Check the liquidity lock. No lock, or a lock expiring in days, means the pool can disappear. (liquidity-lock checker).
- Confirm contract ownership. Renounced or time-locked ownership reduces the risk of the code being changed against you. (block explorer).
- Sanity-check the team and audit. Verify if the audit firm is real and the report matches the live contract. (your own search).
Murphy Wall’s fast-spotting guide makes a point I agree with. The goal isn’t certainty, it’s filtering. You’ll never prove a token is safe. You’re only trying to throw out the obvious traps quickly, and this routine does that.
Real Crypto Rug Pull Cases and What They Teach
Patterns are abstract until you see them play out with real money, so here are some documented cases tied directly to the flags above.
SafeMoon is the one that should bother you the most, because it looked legitimate. It rode early memecoin fame in 2021 and publicly promised locked liquidity. Insiders pulled funds behind the scenes anyway, and the SEC and DOJ charged executives with fraud, with founder Braden Karony convicted in 2025.
AnubisDAO shows the hard liquidity pull at scale. In 2021, the DeFi project raised close to $60 million before the funds vanished, and almost all of its tokens were removed from the liquidity pools, leaving holders with nothing to sell into. This is the textbook version of the liquidity flag from earlier: the people who can drain the pool eventually do.
Frosties NFT proves these are not consequence-free pranks. The project raised over $1.1 million before its creators were charged with wire fraud and money laundering. Anonymous doesn’t mean untraceable, but it usually means you’re out of the money long before anyone is charged.
The throughline across all three is that the warning signs were visible before the collapse. Concentrated supply, unverifiable lock claims, and anonymous control. Every case failed at least two of the checks.
When a Red Flag Is Not Actually a Scam
This is the part most scam guides leave out because even a bit of nuance is bad for fear-based traffic. Not every crash is a crypto rug pull, and treating every red flag as proof will make you miss good projects and panic-sell at the worst time.
Take Mantra’s OM token. In April 2025, it collapsed by more than 90% in hours, wiping its market cap from around $6 billion to roughly $683 million. Crypto Twitter screamed rug pull immediately. But investigations and on-chain wallet activity showed no clear evidence that the team sold or drained funds, and the leading explanation became forced liquidations during thin weekend trading.
A few flags that look damning but often aren’t:
- An anonymous team can be legitimate. Plenty of real builders stay pseudonymous for privacy. Anonymity is just a risk multiplier, not a verdict.
- Thin early liquidity is normal for a genuine fair launch. It is dangerous, but it is not proof of intent.
- Locked or burned supply sometimes looks suspicious on an explorer when it is actually the safest possible setup.
But most of the money lost in crypto in 2025 went because of impersonation and social-engineering scams, not just to classic crypto rug pulls, so obsessing over contract code while ignoring a fake “support agent” in your DMs is fighting the last war.
What to Do If You Have Already Been Rug Pulled
I will be straight with you. In most cases, the money is gone, and the honest first step is accepting that, so you do not get scammed a second time chasing it.
That said, there are real actions worth taking, in order:
- Revoke token approvals immediately: If you’ve interacted with the contract, it may still have permission to move your other tokens. Use a revoke tool (Revoke.cash or your wallet’s built-in approvals manager) to cut that access.
- Report it: File with your national fraud body, for example, the FBI’s IC3 in the US, and report the contract to the relevant block explorer and exchanges so they can flag it. Reported crypto fraud losses hit $9.3 billion in the US in 2024, per the FBI, and reports do feed real investigations.
- Document everything for taxes: A worthless token may qualify as a capital loss. Keep your transaction hashes and talk to a tax professional.
- Do not touch “recovery services.”The accounts that DM you offering to get your funds back for a fee are, almost without exception, a second scam targeting people who have just lost money.
Final Thoughts
The one habit that prevents most crypto rug pull losses is very boring and unglamorous. But never buy before you run the verification check. Liquidity lock, holder concentration, contract code, and team. Five minutes, every time, no exceptions, no matter how good the chart looks or how late you feel. The projects worth holding will still be there after you have checked. The ones that can’t survive five minutes of scrutiny were going to take your money anyway. Slowing down is the entire edge.
FAQs
There is no law that names rug pulls specifically, but most of them break existing crypto fraud laws. Cases like Frosties and SafeMoon led to wire fraud and securities charges.
Usually no. Recovery is rare because funds move fast through DeFi. Revoke approvals, report it, and never pay a “recovery service.”
Run the contract address through a honeypot checker before buying. It tests whether selling is blocked or whether hidden fees make selling pointless.
Yes. Cheap, fast chains with easy token launches see far more crypto scams. Research found warning signs in up to 98% of new tokens on some Solana launchpads.
No. An audit reduces crypto risk only if the firm is real and the report covers the deployed contract. Fake audits are a red flag, not a green light.
