How to Spot a Rug Pull: Step-by-Step Guide, Tips, Fees, Risks and Best Practices Checklist
1. Introduction: Why Rug Pull Checks Matter
A rug pull is one of the most common and painful crypto scams. It happens when the people behind a token, DeFi protocol, NFT project, or presale attract buyers and then remove value from the project. The result is usually a sharp price crash, frozen trading, or a token that cannot be sold.
This guide is written for beginners. You do not need to be a blockchain developer to use it. The goal is to help you slow down, ask the right questions, check the most important warning signs, and avoid obvious traps before connecting your wallet or buying a new token.
| Quick question | Simple answer |
|---|---|
| What is a rug pull? | A scam or abusive exit where insiders remove liquidity, dump tokens, block selling, or abandon the project after attracting buyers. |
| Where does it happen most? | New tokens, DeFi pools, meme coins, NFT drops, presales and unaudited protocols. |
| Can you always spot one? | No. But many rug pulls show warning signs before launch or before the crash. |
| Biggest beginner rule | Never buy only because of hype. Verify liquidity, token ownership, contract risks, team credibility and sellability first. |
| Best first test | Use a small amount, test a buy and sell, and never connect your main wallet to unknown sites. |
2. What Is a Rug Pull?
A rug pull is a crypto scam where a project appears legitimate long enough to attract buyers, then the people in control suddenly take actions that destroy investor value. Chainalysis describes rug pulls as fraud tied especially to DeFi and token launches, where developers attract investors and then drain liquidity or abandon the project after collecting funds.
The name comes from the phrase “pulling the rug out from under someone.” In crypto, the “rug” may be the liquidity pool, the token contract, the project treasury, the presale funds, or the trust built through marketing.
3. How Rug Pulls Usually Work
- A token or project is launched: A team creates a token, NFT collection, staking platform, game, bridge, launchpad, or DeFi pool.
- The project builds hype: Promoters use social media, influencers, Telegram, Discord, airdrops, giveaways, high-yield promises, or fake partnerships.
- Buyers add money: People buy the token, join the presale, stake funds, mint NFTs, or add liquidity.
- Insiders exploit control: They remove liquidity, sell a large insider allocation, mint new tokens, change fees, block selling, or vanish with treasury funds.
- The market collapses: The token price falls sharply, trading becomes impossible, the website disappears, or the team stops responding.
Figure: A simple rug pull screening flow for beginners.
4. Main Types of Rug Pulls
| Type | How it works | Beginner warning sign |
|---|---|---|
| Liquidity pull | The creator removes the trading pool funds, such as ETH, BNB, SOL or USDC, leaving buyers unable to exit at a fair price. | Liquidity is not locked, lock period is very short, or the lock is controlled by the same team. |
| Token dump | Insiders hold a large supply and sell into buyer demand. | Top wallets own a large percentage of supply; team allocation is unclear. |
| Honeypot | People can buy, but normal buyers cannot sell because of hidden contract rules. | Buy transactions work, but sell transactions fail or require extreme slippage. |
| Minting abuse | The contract owner can create unlimited new tokens and dump them. | Contract has owner-only mint functions or unclear permissions. |
| Tax/fee trap | The creator changes buy/sell taxes to extreme levels, draining value from trades. | Sell tax can be changed by owner; tax is already unusually high. |
| Fake presale or launch | The team collects presale funds and never launches, or launches a worthless token. | No escrow, no reputable launchpad, anonymous team, unrealistic guarantees. |
| Project abandonment | The team stops building after raising money; funds are spent or moved without transparency. | No updates, vague roadmap, repeated delays, treasury movements with no explanation. |
5. How to Spot a Rug Pull: Step-by-Step Beginner Guide
5.1. Step 1: Start With the Promise
Ask: “What is this project promising, and does it sound realistic?” Extreme claims are one of the easiest warning signs to understand.
Be careful with promises such as guaranteed daily returns, “risk-free” income, “100x soon,” fixed high APY, secret insider access, or pressure to buy before a countdown ends. The SEC has warned that crypto asset investments can be exceptionally volatile and speculative, and the CFTC and SEC have warned investors about digital asset fraudsters promising high guaranteed returns with little or no risk.
| Healthy sign | Danger sign |
|---|---|
| Clear explanation of product, users and revenue model | Only hype words: “next Bitcoin,” “guaranteed moon,” “passive income forever” |
| Risks are disclosed openly | Team says there is no risk |
| Timeline is realistic | Huge promises with no working product |
| Marketing explains utility | Marketing focuses only on price and urgency |
5.2. Step 2: Check the Team
A public team is not a guarantee of safety, and an anonymous team is not automatically a scam. But for beginners, total anonymity plus aggressive fundraising is a serious risk.
Look for real names, work history, GitHub or LinkedIn activity, previous projects, known advisors, and whether the team has appeared in interviews or community calls. Watch for stolen profile photos, fake advisors, unverifiable partnerships, and team members who refuse basic questions.
5.3. Step 3: Read the Website and Whitepaper Like a Skeptic
A rug pull often uses professional design to look trustworthy. Do not confuse a polished website with a real business. Read the documents and ask whether they explain the problem, solution, token role, revenue model, token distribution, lockups, risks and roadmap in plain language.
| Question to ask | Why it matters |
|---|---|
| What problem does the project solve? | Real utility should be explainable without buzzwords. |
| Why does the token need to exist? | Some projects add a token only to raise money. |
| Who gets the initial supply? | Large insider allocations can create dump risk. |
| What are the vesting rules? | Unlocked team tokens can be sold quickly. |
| What happens if milestones are missed? | Honest projects define risks and constraints. |
5.4. Step 4: Check Token Distribution and Holder Concentration
Use a block explorer such as Etherscan, BscScan, Solscan, Basescan, Arbiscan, Polygonscan, or the relevant chain explorer. Search the token contract address, then open the holders tab. For beginners, the goal is not to understand every wallet. The goal is to spot obvious concentration risk.
Red flags include one wallet holding a huge share, several top wallets funded by the same address, team wallets with no vesting, and a large supply sitting in wallets that can sell immediately. A project may still be risky even if the supply is split across many wallets, because insiders can use multiple wallets.
| Holder pattern | Risk level | What it may mean |
|---|---|---|
| Top wallet is a burn address or verified lock contract | Lower, if verified | Tokens may be intentionally removed from circulation or locked. |
| Top 10 wallets hold a very high share excluding burn/lock/exchange wallets | High | A few holders can crash the market by selling. |
| New wallets funded from the same source before launch | High | Possible insider wallet splitting. |
| Team allocation is public with long vesting | Lower, but still checkable | Insiders cannot sell everything immediately. |
| Team allocation is unclear | High | You do not know who can dump. |
5.5. Step 5: Verify Liquidity Is Locked
Liquidity is what lets buyers and sellers trade on a decentralized exchange. In many token launches, the creator pairs the new token with a valuable asset such as ETH, BNB, SOL or USDC. If the creator can remove that paired asset, buyers may be left with a token they cannot sell for meaningful value.
A liquidity lock sends liquidity provider tokens to a time-lock contract or reputable locking service. It does not make a project safe, but it reduces one major rug pull method. Check the lock duration, the amount locked, who controls the lock, and whether the lock covers most of the liquidity. A one-week lock on a heavily hyped project is weak protection.
| Liquidity check | What good looks like | What bad looks like |
|---|---|---|
| Lock status | LP tokens locked in a verifiable contract | LP tokens held by deployer or unknown wallet |
| Lock duration | Months or years, aligned with roadmap | Days or weeks, or unlocks right after launch hype |
| Locked percentage | Most liquidity locked | Only a small portion locked for marketing optics |
| Lock provider | Recognized locker or transparent on-chain contract | Screenshot only, no verifiable link |
| Unlock plan | Explained before unlock date | No explanation; team avoids questions |
5.6. Step 6: Review the Smart Contract Risk
A smart contract is code that controls the token or protocol. You do not need to be a coder to perform basic checks, but beginners should know which permissions are dangerous.
Look for whether the source code is verified on the block explorer, whether the contract has been audited by a credible auditor, and whether the owner can change key rules. Chainalysis notes that DeFi and token launches can be created with relatively low technical overhead, which is one reason rug pulls are common. Academic research on rug pulls also highlights common tactics such as malicious code and unlocked liquidity.
| Contract feature | Why it can be risky |
|---|---|
| Owner can mint unlimited tokens | New tokens can be created and dumped. |
| Owner can blacklist wallets | The team can block some users from selling or transferring. |
| Owner can pause trading | Trading can be frozen at the worst time. |
| Owner can change sell tax | A normal sell tax can become 50%, 90% or higher. |
| Owner can exclude wallets from fees or limits | Insiders may be able to sell while others cannot. |
| Unverified source code | The community cannot easily inspect the actual contract logic. |
| Proxy upgradeability without strong governance | Rules can change after buyers enter. |
5.7. Step 7: Test Whether You Can Sell
A common beginner mistake is testing only a buy transaction. Before committing meaningful money, make a tiny purchase and then try to sell a tiny amount. If the sell fails, needs extreme slippage, or loses far more than expected, stop.
This does not guarantee safety. Some scams allow small sells at first and block sales later. Still, a test sell can catch basic honeypots and extreme fee traps before you risk more money.
5.8. Step 8: Study the Community, Not Just the Follower Count
Scam projects often buy followers, bot comments and fake engagement. A large Telegram or X following does not prove legitimacy. Look for real discussion, technical answers, civil moderation, clear risk disclosures, and whether critical questions are answered or deleted.
| Community behavior | Interpretation |
|---|---|
| Questions are answered with facts and links | Healthier sign |
| Every question is met with “FUD” or bans | Major red flag |
| Only price talk and moon emojis | Speculation-driven, higher risk |
| Team publishes regular build updates | Better than hype-only posting |
| Influencers promote without disclosing risk | Treat as advertising, not evidence |
5.9. Step 9: Look for Independent Verification
Independent verification can include a reputable audit, public bug bounty, known investors, working product, transparent treasury dashboard, verified contracts, public GitHub, and coverage from credible sources. Do not rely on a single audit badge. Read what the audit covers, when it was done, and whether critical issues were fixed.
5.10. Step 10: Make a Risk Decision Before You Buy
Write down your decision before buying. If your reason is “everyone is talking about it,” that is not due diligence. Decide your maximum loss, exit plan, and what warning sign would make you walk away. The safest decision is often to skip the trade.
6. The Rug Pull Red Flags Checklist
- Anonymous or unverifiable team raising money aggressively
- Guaranteed returns, fixed high yields, or claims of no risk
- Liquidity not locked, only partly locked, or locked for a very short time
- Top wallets control a large share of token supply
- Unverified contract source code
- Owner can mint, blacklist, pause trading, raise taxes or change major rules
- No credible audit, or audit is old, partial, or from an unknown firm
- Influencer-heavy promotion with little product detail
- Community questions are deleted or critics are attacked
- Fake partnerships, fake team members or copied whitepaper
- Website launched recently with no real history
- Roadmap is vague, unrealistic or focused only on exchange listings
- Presale funds go to a personal wallet with no escrow
- Test sell fails or requires very high slippage
- Contract has unusual transfer limits or wallet restrictions
- Project pushes urgent deadlines and fear of missing out
- Treasury wallets move funds without explanation
- Team refuses to explain token allocation, vesting or liquidity
7. Simple 100-Point Rug Pull Risk Score
Use this scoring table as a practical pre-buy filter. It is not a guarantee. It simply helps beginners avoid ignoring obvious warning signs.
| Category | 0 points | 5 points | 10 points |
|---|---|---|---|
| Team | Public, verifiable, relevant history | Partly known or limited history | Anonymous, fake or evasive |
| Liquidity | Mostly locked for a meaningful period | Partly locked or short lock | Unlocked or unverifiable |
| Token ownership | Broad distribution; clear vesting | Some concentration | Top wallets dominate supply |
| Contract permissions | Renounced or tightly governed | Some admin powers explained | Owner can mint, blacklist, pause or change fees |
| Audit/code | Verified code and credible audit | Verified code but no audit | Unverified code or fake audit |
| Product/utility | Working product or clear use case | Early prototype only | No utility beyond price hype |
| Marketing | Balanced and transparent | Some hype | Guaranteed returns or intense FOMO |
| Community | Open questions allowed | Mixed quality | Bots, bans, deleted questions |
| Treasury/presale | Transparent, escrowed or governed | Partly explained | Personal wallet or no fund controls |
| Sellability | Small test sell works normally | Sell works with high friction | Cannot sell or extreme slippage |
Suggested interpretation: 0-20 = lower observable rug risk, 21-40 = caution, 41-60 = high risk, 61-100 = avoid unless you have expert-level reasons and can afford total loss.
8. Fees and Costs to Check Before Buying a New Token
Fees matter because rug pulls and bad token designs can hide losses inside the transaction itself. Always check expected costs before buying.
| Fee or cost | What it means | Why beginners should care |
|---|---|---|
| Network gas fee | Fee paid to the blockchain validators or miners. | You pay this even if a transaction fails on many chains. |
| DEX trading fee | A decentralized exchange may charge a swap fee. | Small trades can become expensive when combined with gas. |
| Token buy tax | A percentage taken when you buy. | High taxes reduce your position immediately. |
| Token sell tax | A percentage taken when you sell. | High or changeable sell taxes can trap buyers. |
| Slippage | The difference between expected and actual execution price. | Extreme slippage can signal low liquidity or a tax trap. |
| Bridge fee | Cost to move funds across chains. | Bridges add smart contract and security risk. |
| Approval risk | Permission you give a contract to spend tokens. | Unlimited approvals to unknown contracts can endanger your wallet. |
| Exit liquidity cost | Price impact when selling into a small pool. | You may not be able to exit near the displayed price. |
9. Real-World Scenarios: What a Rug Pull Can Look Like
9.1. Scenario 1: The meme coin liquidity pull
A new meme coin trends on social media. The website says liquidity is locked, but the link goes only to a screenshot. The top wallet holds most LP tokens. After buyers rush in, the deployer removes the paired ETH from the pool. The chart goes almost vertical downward. Buyers still see tokens in their wallets, but there is little real liquidity left.
9.2. Scenario 2: The honeypot token
A beginner buys a token because the chart keeps rising. The buy transaction succeeds. When they try to sell, the transaction fails repeatedly. The contract allows the creator or approved wallets to sell, but blocks regular holders. The chart looks strong until victims realize they are trapped.
9.3. Scenario 3: The presale vanish
A project promises a gaming token with guaranteed staking income. Funds go to a wallet controlled by the team. The launch date is delayed several times. The team says “audit soon,” then the website and Telegram disappear. The presale investors never receive a valuable token.
9.4. Scenario 4: The slow rug
The team does not disappear overnight. Instead, it drains value slowly through high marketing payments, treasury transfers, insider token unlocks, and constant excuses. The project may not look like a classic instant rug pull, but the result for buyers can be similar: large losses and no accountability.
10. Rug Pull vs Pump-and-Dump vs Normal Project Failure
| Situation | Main cause | Typical signs | Can honest projects experience it? |
|---|---|---|---|
| Rug pull | Insider abuse, malicious code, liquidity drain or exit scam | Team control, blocked selling, sudden liquidity removal, hidden permissions | No. A rug pull involves deception or abuse. |
| Pump-and-dump | Coordinated hype followed by selling | Influencer push, sudden price spike, insiders sell into retail demand | Sometimes overlaps with rug pulls. |
| Normal failure | Poor product, weak demand, market downturn, execution problems | Updates may continue, funds are not secretly drained, risks were disclosed | Yes. Startups and crypto projects can fail without being scams. |
| Hack/exploit | External attacker or exploited bug | Unexpected drain, emergency pause, postmortem, law enforcement or audit response | Yes, if the team was not involved. |
11. Useful Tools for Beginner Rug Pull Checks
Tools can help, but they do not replace judgment. Scammers can design projects to pass simple scanners or change behavior after launch.
| Tool type | Examples | What to check |
|---|---|---|
| Block explorers | Etherscan, BscScan, Solscan, Basescan, Arbiscan, Polygonscan | Contract source, holders, deployer wallet, token transfers, LP token location. |
| DEX charting tools | DEX Screener, DEXTools, GeckoTerminal | Liquidity, price action, volume, pair age, buys and sells. |
| Token safety scanners | Token Sniffer, GoPlus, Honeypot.is and similar tools | Honeypot risk, tax settings, contract permissions, holder concentration. |
| Liquidity lockers | Unicrypt, Team Finance, PinkLock and similar services | Whether LP tokens are locked, how much, and until when. |
| Audit reports | CertiK, Trail of Bits, OpenZeppelin, ConsenSys Diligence, Hacken and others | Scope, date, severity of findings, whether fixes were verified. |
| Wallet safety tools | Revoke.cash or chain-specific approval checkers | Remove risky token approvals after interacting with unknown contracts. |
12. Best Practices to Avoid Rug Pulls
- Use a separate wallet for new tokens, mints and unknown dApps. Keep your main holdings in a different wallet.
- Never invest money you cannot afford to lose. For new tokens, assume total loss is possible.
- Do not buy from a random contract address shared in a chat without verifying it through official channels.
- Check the token contract, not just the ticker. Scammers copy names and symbols.
- Wait after launch. Many rugs happen quickly when early hype peaks.
- Test with a tiny amount first, including a test sell.
- Avoid unlimited approvals when possible, and revoke approvals you no longer need.
- Do not trust screenshots of locks, audits or partnerships. Use verifiable links.
- Be cautious with bridges, presales and private messages. Scammers often target beginners directly.
- Document your research. If you cannot explain why a project is safe enough, do not buy.
13. Pros and Cons of Buying Very Early Crypto Projects
| Potential benefit | Important limitation or risk |
|---|---|
| You may access a project before wider market attention. | Early projects have the highest uncertainty and often no working product. |
| Prices can move quickly if demand grows. | Prices can collapse just as quickly, especially with low liquidity. |
| Community involvement can be meaningful in real projects. | Scam communities can be manufactured with bots and paid promoters. |
| On-chain data allows some verification. | On-chain data can be hard to interpret and can be manipulated with many wallets. |
| Small allocations can be educational. | Learning by losing money is expensive; paper tracking is safer for beginners. |
14. Common Beginner Mistakes and Misconceptions
14.1. Mistake: Trusting a token because it is trending
Trending status often reflects attention, not quality. Scammers deliberately create urgency.
14.2. Mistake: Believing an audit means safe
An audit is a snapshot of specific code at a specific time. It may not cover economic design, future upgrades, team wallets or market manipulation.
14.3. Mistake: Assuming locked liquidity removes all risk
Locked liquidity helps against one method, but insiders can still dump tokens, mint supply, change taxes, abandon the project or exploit admin powers.
14.4. Mistake: Ignoring wallet approvals
A malicious site may ask for permissions that put your tokens at risk even if you never buy the project token.
14.5. Mistake: Buying because a celebrity or influencer mentions it
Promotion does not equal due diligence. Influencers may be paid, mistaken or exiting into their audience.
14.6. Misconception: “The team is doxxed, so it cannot rug”
Public identities reduce some risk but do not remove it. Public teams can still mismanage funds, dump tokens or break promises.
14.7. Misconception: “The chart is going up, so it must be safe”
A honeypot chart may go up because victims can buy but cannot sell.
15. What to Do If You Think You Have Been Rug Pulled
- Do not send more money to “recover” your funds. Recovery scams often target victims after the first scam.
- Screenshot the website, social posts, transaction hashes, wallet addresses, chat messages and any promises made.
- Revoke token approvals connected to the project or suspicious dApps.
- Move remaining funds to a fresh wallet if you suspect your wallet permissions or seed phrase are compromised.
- Report the incident to the relevant exchange, wallet provider, chain analytics tip line, local cybercrime authority or financial regulator where applicable.
- Warn others with facts, transaction hashes and evidence. Avoid doxxing or unsupported accusations.
The FBI warns that cryptocurrency investment fraud is a major and damaging fraud category. If a scammer contacts you privately offering to recover stolen crypto for an upfront fee, treat that as another red flag.
16. Best Practices Checklist Before You Buy
| Check area | Beginner confirmation |
|---|---|
| Project purpose | I can explain what the project does and why the token is needed. |
| Team credibility | I checked whether the team is real, experienced and willing to answer questions. |
| Contract address | I verified the official token contract from multiple official sources. |
| Token holders | I checked top holders and insider concentration. |
| Liquidity | I verified liquidity lock amount, duration and unlock date on-chain. |
| Contract permissions | I checked for minting, blacklist, pause, tax and upgrade powers. |
| Audit | I checked whether the audit is credible, current and relevant. |
| Buy/sell test | I tested a small buy and sell, or chose not to buy if that is not possible. |
| Fees | I reviewed gas, DEX fees, buy/sell tax, slippage and approval risk. |
| Community | I looked for real discussion, not just hype and bots. |
| Position size | I set a maximum loss before buying. |
| Wallet safety | I used a separate wallet and avoided unnecessary approvals. |
| Exit plan | I know when I would sell, reduce exposure or walk away. |
| Evidence | I saved links and notes so I am not relying on memory or hype. |
17. FAQs About Spotting Rug Pulls
17.1. Can a rug pull happen on any blockchain?
Yes. Rug pulls can happen on Ethereum, BNB Chain, Solana, Base, Arbitrum, Polygon and other networks. Faster and cheaper chains may see more low-effort launches because it is inexpensive to create and promote tokens.
17.2. Is every anonymous crypto team a scam?
No. Some legitimate open-source projects have pseudonymous contributors. But anonymity increases risk when combined with fundraising, no audit, unlocked liquidity, vague tokenomics and aggressive promotion.
17.3. Does locked liquidity mean a token is safe?
No. It only reduces one kind of liquidity-removal risk. You still need to check insider holdings, mint permissions, sell restrictions, taxes, upgrades, team behavior and product quality.
17.4. What is a honeypot in crypto?
A honeypot token allows buyers to enter but prevents normal selling or makes selling extremely expensive. The chart may look strong because victims can buy while only insiders can exit.
17.5. How much slippage is too much?
There is no universal number because liquidity varies. But if a normal-sized sell requires very high slippage, or if the estimated received amount is far below the market quote, treat it as a major warning sign.
17.6. Are meme coins always rug pulls?
No, but meme coins often have little fundamental value, intense hype and high insider-risk. Beginners should be extra cautious and avoid assuming community excitement equals safety.
17.7. Can I recover funds after a rug pull?
Sometimes law enforcement, exchanges or analytics firms can help trace funds, but recovery is difficult and never guaranteed. Be very suspicious of anyone promising guaranteed recovery for an upfront fee.
17.8. Should beginners use token scanners?
Yes, as a first filter. But scanners can miss risks or produce false comfort. Use them alongside manual checks of liquidity, holders, team, contract permissions and community behavior.
17.9. What is the safest way to participate in a new launch?
The safest option is often not to participate. If you do, use a separate wallet, start very small, verify the contract, test selling, and avoid projects with unclear liquidity or owner powers.
17.10. How can I tell the difference between a scam and a failed project?
A scam usually involves deception, hidden control, fund misappropriation, blocked selling or sudden disappearance. A failed project may lose value despite honest disclosure, continued communication and no insider abuse.
18. Final Takeaway
The best way to spot a rug pull is to slow down and verify what the project can actually do, not what its marketing says. Check the team, token distribution, liquidity lock, smart contract permissions, fees, sellability, audit quality and community behavior. One red flag may not prove a scam, but several red flags together are usually enough reason to walk away.
For beginners, the most practical rule is simple: if you cannot clearly verify how your money is protected, how you can exit, who controls the contract, and what could go wrong, do not buy.
Sources Consulted and Checked
These sources were consulted and checked while preparing this document to support accuracy and reliability.
- Chainalysis Glossary: What Is a Crypto Scam?
- Chainalysis: 2025 Crypto Crime Trends
- Chainalysis: Crypto Scams 2026
- Chainalysis: 2021 Crypto Scam Revenues and Rug Pulls
- SEC Investor Alert: Exercise Caution with Crypto Asset Securities
- CFTC/SEC Investor Alert: Watch Out for Fraudulent Digital Asset and Crypto Trading Websites
- FBI: Cryptocurrency Investment Fraud
- RPHunter research paper: Unveiling Rug Pull Schemes in Crypto Token Ecosystems
- TRM Labs: 2025 Crypto Crime Report
Reader Advice
This article is provided for educational and informational purposes only and is not personalized financial, investment, tax, legal, cybersecurity, or recovery advice. Crypto assets, new tokens, DeFi projects, NFTs, presales, smart contracts, bridges, and wallet connections can involve fraud, technical failures, extreme volatility, loss of access, and the possible loss of all funds. Rules, policies, laws, enforcement practices, platform terms, fees, and statistics may change over time and vary by country, region, blockchain, and service provider. Before acting, verify important details through current official sources, independently check contract addresses and permissions, and consider guidance from a suitably qualified professional. Never send additional money to anyone promising guaranteed recovery of lost crypto.