A rug pull is when the team behind a crypto token (or NFT) drains the liquidity pool, dumps their pre-mined bag, or remotely disables your ability to sell — and disappears. It is the single most common loss event in DeFi, and unlike a hack, it is almost always invisible to the victim until it's over.
The four flavors of rug
- Liquidity rug. Devs pull the paired ETH/USDC out of the Uniswap pool. The token still "exists" but can no longer be sold for anything.
- Honeypot rug. A hidden function in the contract blocks the *sell* path for everyone except the deployer. You can buy. You can never sell.
- Mint rug. The contract owner mints unlimited new tokens to a private wallet, then dumps onto retail.
- Slow rug. The team simply abandons the project after raising — no devs, no Discord mods, slow bleed to zero. The most common and the hardest to call legally.
The 60-second on-chain checks
Open the token's contract on Etherscan / BscScan / Solscan and look at:
- Holder distribution. Top 10 wallets owning >40% of supply = exit liquidity setup.
- Liquidity lock. Is the LP token locked (Unicrypt, Team.Finance, PinkLock) for >12 months? If no, the dev can pull tomorrow.
- Ownership renounced?
owner() = 0x000...000is good. An active owner means they can still change fees, blacklist holders, or mint. - Mint function present? Search the code for
_mintcalls that aren't constructor-only. That's a backdoor. - Buy/sell tax. Anything above 10% is predatory. Anything above 25% is engineered to trap.
- Same-block deployer activity. If the deployer wallet has launched 4 other tokens that all rugged, you're #5.
The social red flags that come first
- A Telegram or Discord with thousands of "members" but only 10 message in chat — bot-padded.
- A team whose only "doxx" is a Twitter handle with a stock-photo PFP.
- Influencer paid-shill posts that all dropped within a 4-hour window.
- A roadmap full of buzzwords (AI, RWA, agent, L3) with no working demo.
- A presale that requires you to send ETH directly to a wallet rather than through a vetted launchpad.
What "audited" actually means
An "audit" is not a guarantee. Most rug-pulled tokens had a logo from CertiK or a no-name auditor on their site — often a screenshot, not a real report. Always click through to the actual audit PDF, read the *Critical* and *High* findings, and check whether they were resolved. A clean audit on a forked contract from a launchpad is meaningless if the deployer has not renounced ownership.
What to do if you're already in
Don't average down. Don't believe the "we're rebuilding" Discord announcement — over 98% of post-rug "v2" launches rug again within 90 days. Screenshot every transaction, file with your country's fraud agency for the tax write-off, and submit the contract address to GACS so the next person searching it gets a flashing red warning. Your loss becomes someone else's save.
The single best habit
Before any token buy, paste the contract into a free scanner (GoPlus, Honeypot.is, GACS Wallet Checker). It takes 4 seconds and catches the 60% of rugs that are mechanically obvious. The other 40% — the slow rugs and the team rugs — are caught by the social and on-chain checks above. Combined, you'll dodge 9 in 10.