A crypto rug pull happens when developers drain liquidity or abandon a project after collecting investor funds. Spotting one before you lose money requires checking the smart contract, verifying team identities, and analyzing on-chain liquidity data. This guide covers the specific red flags that distinguish rug pulls from legitimate projects.
Rug pulls accounted for over $2.8 billion in losses across the crypto market in 2025, according to Chainalysis data. The mechanics are straightforward: a team launches a token, generates hype, waits for investors to buy in, then removes the liquidity or dumps their holdings. Roughly one in three new tokens launched on Ethereum DEXes in 2025 exhibited rug pull characteristics, data from Solidus Labs reports.
What exactly is a crypto rug pull?
A rug pull is an exit scam where token creators withdraw liquidity from the trading pool or sell their entire allocation, crashing the price to zero. Investors are left holding worthless tokens with no way to sell. There are three main types.
Liquidity pulls are the most common. The developer creates a token, adds initial liquidity to a DEX, waits for buyers to drive the price up, then removes all liquidity. Hard rug pulls happen in a single transaction. Slow rugs involve gradual selling by insiders over weeks, making the dump harder to detect. Soft rugs occur when a team simply abandons the project without a dramatic exit, letting the token die through neglect.
According to a report from Chainalysis, hard liquidity pulls are declining as detection tools improve, but slow rugs and soft rugs are increasing. The tactics evolve faster than most investors realize.
What are the biggest red flags of a rug pull?
No single indicator confirms a rug pull. But multiple red flags appearing together should stop you from investing. Here are the warning signs ranked by reliability, based on patterns from confirmed rug pulls analyzed by blockchain security firms.
| Red flag | Severity | How to check |
|---|---|---|
| Liquidity not locked | Critical | Check liquidity lock on Team Finance or Unicrypt |
| Anonymous team with no verifiable history | Critical | Search LinkedIn, GitHub, public records |
| No smart contract audit | High | Check CertiK, Hacken, or project documentation |
| Contract not verified on block explorer | High | View contract on Etherscan or Solscan |
| Ownership not renounced | High | Check contract owner function on explorer |
| Over 50% of supply held by top 10 wallets | High | Check holder distribution on Etherscan |
| Unrealistic APY or return promises | Medium | Compare claimed yields to DeFiLlama market data |
| Aggressive social media hype with paid promotions | Medium | Check for disclosed sponsorships on influencer posts |
The combination of unlocked liquidity and an anonymous team is the single most predictive indicator. When I last checked data from blockchain security platform GoPlus Security, tokens with both of these red flags had a rug pull rate exceeding 80%.
How do you check if a token’s liquidity is locked?
Liquidity locking means the LP (liquidity pool) tokens are deposited into a time-locked smart contract, preventing the developer from removing them before the lock expires. Two major platforms handle this: Team Finance and UNCX Network.
To verify, find the token contract address on a DEX like Uniswap or PancakeSwap. Look up the liquidity pool address. Then check whether the LP tokens are held by a locking contract or by an externally owned account. If LP tokens sit in a regular wallet, the developer can pull liquidity at any moment.
A lock is necessary but not sufficient. Short lock periods of 30-90 days delay a rug pull rather than prevent it. Meaningful locks are 6-12 months minimum. Projects with permanently burned liquidity (sent to a dead address) offer the strongest protection. Learn more about protecting your holdings in our full guide on how to protect your crypto from hackers and scams.
How do you verify a smart contract is not malicious?
Start with the block explorer. On Etherscan, a verified contract shows its source code publicly. Unverified contracts hide their logic, which is a major red flag. Even if you cannot read Solidity, a verified contract has been reviewed by the community and automated scanners.
Free tools like Token Sniffer and GoPlus Security API scan contracts for known malicious patterns. These tools check for hidden mint functions, transfer restrictions, honeypot mechanics, and excessive owner privileges. Token Sniffer assigns a risk score and flags specific concerns.
Look specifically for these contract functions: mint() with no cap, pause() that can halt trading, transfer taxes above 10%, and blacklist functions that can freeze specific wallets. Any contract with uncapped minting authority is a deal-breaker regardless of other factors. Our research process includes smart contract screening for every project we cover, and our guide on finding new crypto projects covers the broader evaluation framework.
Can you recover money after a crypto rug pull?
Recovery is extremely rare. Blockchain transactions are irreversible by design. Once liquidity is drained, your tokens have no market to sell into. There is no insurance fund, no FDIC protection, and no automatic refund mechanism in decentralized finance.
Report the incident to the FBI’s IC3 (Internet Crime Complaint Center) and your local law enforcement. If the amount exceeds $100,000, blockchain forensics firms like Chainalysis and Elliptic may assist law enforcement in tracing funds. Some victims have recovered assets when stolen funds were routed through centralized exchanges that froze accounts after law enforcement requests.
Prevention is the only reliable strategy. The time investment of checking liquidity locks, verifying contracts, and researching teams takes 30-60 minutes per project. That effort is worth it when the alternative is total loss. Read our guide on the safest ways to store crypto for protecting the assets you already hold.
Frequently Asked Questions
Unlocked liquidity, anonymous team with no verifiable history, no smart contract audit, unverified contract code, and concentrated token supply in a few wallets. The combination of unlocked liquidity and anonymous team is the strongest predictor.
Check the contract’s owner function on the blockchain explorer (Etherscan or Solscan). If the owner address is the zero address (0x000…000), ownership has been renounced. Tools like Token Sniffer also report ownership status.
Recovery is rare because blockchain transactions are irreversible. Report to the FBI IC3 and local law enforcement. If funds were routed through centralized exchanges, those exchanges may freeze accounts upon law enforcement request.
Roughly one in three new tokens on Ethereum DEXes exhibited rug pull characteristics in 2025, according to Solidus Labs data. The actual percentage varies by chain and market conditions.
No. A liquidity lock prevents one type of rug pull but does not protect against hidden mint functions, excessive transfer taxes, or a slow insider dump. Always check the contract code and team credentials alongside liquidity status.
