Rug Pulls Explained: How They Work and How to Avoid Them
What a rug pull is, the main types (liquidity pulls, hidden mints, sell blocks), the warning signs to check and practical steps to avoid losing money.
A rug pull is a crypto scam in which the people behind a token or project suddenly take investors' money — by removing the trading liquidity, dumping a hidden token supply or using hidden contract powers — and then abandon the project, leaving holders with tokens that are worthless or impossible to sell. The name comes from "pulling the rug out" from under someone.
Rug pulls are most common with new tokens on decentralized exchanges, where anyone can launch a token and create a market in minutes without any review. They hit beginners hardest, because the warning signs are visible only if you know where to look. This guide explains how rug pulls work and what you can check before buying.
How a Rug Pull Works
Most rug pulls follow a similar pattern:
- 1Launch. A team creates a token, often copying a trending theme or name, and pairs it with a valuable asset such as ETH or a stablecoin in a liquidity pool on a decentralized exchange.
- 2Hype. They promote it through social media, paid influencers, Telegram groups and promises of huge returns or upcoming listings.
- 3Buying pressure. As people buy, the price rises, which attracts more buyers and makes early holders look like winners.
- 4Extraction. At a chosen moment, the insiders remove the valuable side of the liquidity pool, sell their large allocation, or trigger a hidden function.
- 5Disappearance. Websites go offline, social accounts are deleted, and the token's price collapses to near zero.
The whole cycle can take hours or months. Longer "slow rugs" are harder to spot because the team appears to be building for a while. If you want to go further, read Liquidity Pull Detection.
The Main Types of Rug Pulls
| Type | What happens | What to check |
|---|---|---|
| Liquidity pull | Insiders withdraw the pool's ETH or stablecoins, so there is nothing left to sell into | Is liquidity locked, for how long, and by whom? |
| Insider dump | Team wallets sell a large unlocked allocation | Holder concentration and vesting schedules |
| Hidden mint | The contract lets the owner create unlimited new tokens and sell them | Mint functions and who controls them |
| Sell block or honeypot | Buyers can buy but cannot sell, or face extreme sell taxes | Contract code, tax settings, test sells by others |
| Upgrade or admin abuse | An upgradeable contract is changed to drain or freeze funds | Proxy contracts, admin keys, timelocks |
| Slow rug | Team gradually sells and stops delivering while still talking up the project | Treasury and team wallet activity over time |
For more on the sell-block variant, see our guide to honeypot tokens. Our article How to Check a Token's Liquidity Before Buying expands on this point.
Warning Signs Before You Buy
No single sign proves a rug pull is coming, but several together are a strong signal to stay away:
- Anonymous team with no track record and no verifiable history.
- Very concentrated supply. A few wallets — other than identifiable exchange, burn or locked contracts — hold a large share.
- Unlocked or briefly locked liquidity. A lock of a few days protects almost nothing.
- Unverified or copied contract code on the block explorer.
- Owner privileges to mint, pause, blacklist, change taxes or upgrade, with no timelock or multisig.
- Pressure tactics. "Last chance," countdowns and promises of exchange listings.
- Guaranteed returns or unrealistic yields.
- Moderated criticism. Questions about the contract get deleted or users banned.
Our checklist of rug pull warning signs in token contracts shows what each of these looks like on a block explorer.
How to Check a Token Step by Step
- 1Confirm the contract address from official sources; copycat tokens are common.
- 2Open it on a block explorer and confirm the source code is verified.
- 3Look at the top holders. Identify the liquidity pool, burn addresses and lock contracts, then see how much the remaining top wallets hold.
- 4Check the liquidity. Find the pool's LP tokens and see whether they are locked in a known locker contract, and until when. Our guide to liquidity locks explains how to read them.
- 5Review owner functions. Look for functions such as mint, pause, setFee, blacklist or upgrade, and check whether ownership has been renounced or moved to a multisig with a timelock.
- 6Check that people can sell. Look at recent transactions for successful sells by ordinary wallets, not just buys.
- 7Research the team and how the token is being promoted.
If any step raises a question you cannot answer, the safest choice is not to buy.
Why Locked Liquidity and Audits Are Not Enough
Scammers know that buyers look for a "liquidity locked" or "audited" badge, so they provide one. A lock can be short, or cover only part of the liquidity. The team may still hold a large unlocked supply to sell. An audit may be fake, may cover a different contract, or may list serious issues that were never fixed. For a deeper look, see Protocol-Owned Liquidity Explained.
Treat these as one piece of evidence, not a safety certificate. Related reading: Vanity Address Risks and Look-Alike Addresses.
What to Do If You Are Caught in a Rug Pull
- 1Stop interacting with the token's contract and website.
- 2Revoke token approvals you gave to related contracts.
- 3Document everything: transaction hashes, addresses, screenshots of promotions and messages.
- 4Report it to the exchange or platform where you found it, to local authorities, and through our scam report form.
- 5Ignore recovery offers. People who promise to recover your funds for an upfront fee are almost always running a second scam.
Bottom line
A rug pull is planned theft dressed up as an investment. Before buying any new token, verify the contract, check who holds the supply, confirm how long liquidity is locked and look for owner powers to mint, block sales or upgrade. If the answers are unclear, walk away — skipping one opportunity costs nothing compared with losing your whole stake. For more protective habits, browse our security guides.
Frequently asked questions
Is a rug pull illegal?
In many countries, deliberately taking investors' money under false pretenses can be prosecuted as fraud, and authorities have charged people over rug pulls. In practice, anonymous teams, cross-border activity and fast-moving funds make recovery difficult, so prevention is far more effective than hoping for legal action afterward.
Does locked liquidity mean a token cannot be rugged?
No. Locked liquidity removes one method, but a team can still sell a large token allocation, mint new tokens, raise sell taxes or upgrade the contract if it keeps those powers. Check who holds the supply, how long the lock lasts and what admin functions remain in the contract.
Can I get my money back after a rug pull?
Usually not. Blockchain transactions are final, and funds are often moved through mixers or bridges quickly. Report the scam to the platform where you found it and to your local authorities, keep records, and be wary of anyone offering to recover your funds for a fee, since recovery scams commonly target rug-pull victims.
What is the difference between a rug pull and a failed project?
A rug pull involves deliberate deception: insiders plan to extract money and abandon the project. A failed project may lose most of its value because the idea did not work, funding ran out or the market turned, without anyone intending to cheat investors. Both can cost you money, but only one is fraud.