Rug Pulls: How to Spot One Before You Buy

A rug pull is when a token’s creators take the money and leave. The mechanics vary. The warning signs do not, and they are visible on-chain before anything happens.

Check 1: who holds the supply

Open the token’s contract on a block explorer and look at the holder distribution.

What you are looking for: the share held by the top ten addresses, excluding known liquidity pools and exchange wallets.

The concern: if a handful of addresses hold most of the supply, the market price is set by whoever has not sold yet. Any one of those holders can end it.

Concentration is not proof of fraud. Many legitimate projects start concentrated. It does tell you the price is contingent on a small number of decisions by people you cannot identify.

Check 2: is liquidity locked

Tokens trade against a pool of paired assets. If the creators control that pool, they can withdraw it, which removes the ability to sell at any price.

What you are looking for: whether the liquidity provider tokens are locked in a time-locked contract, and for how long.

The concern: unlocked liquidity is the single most direct rug mechanism. It takes one transaction.

Lock services publish verifiable records. If a project claims locked liquidity without a contract address you can check, treat the claim as false.

Check 3: what the contract permits

This is the most technical check and the most informative. Many explorers show verified source code.

Look for: a mint function that lets someone create unlimited new tokens, an owner address with the ability to pause transfers, a blacklist function that can prevent specific addresses from selling, or a modifiable transaction fee.

The concern: a contract where the owner can block sales is a honeypot. You can buy all day and never exit.

If you cannot read the code, at minimum check whether it is verified at all. An unverified contract means nobody can see what it does, and that fact alone is sufficient reason to stop.

Check 4: the team and the timeline

Look for: how long the project has existed, whether the team is identifiable, whether there is a product rather than a roadmap, and whether the token existed before the product.

The concern: anonymity is not disqualifying in this sector, and a token launched before anything works usually means the token is the product.

The signals that appear right before

In cases documented after the fact, several things recur in the final days.

• Marketing spend increases sharply
• Promised deadlines are quietly moved
• The team becomes less responsive to specific technical questions while remaining active in general channels
• Large transfers move from team addresses to exchange deposit addresses
• Liquidity is reduced in stages rather than all at once

The last one is visible on-chain in real time and almost nobody watches for it.

What to do with all this

The four checks take about ten minutes together. That is a small cost against a total loss, and it filters out the large majority of what is offered.

The uncomfortable truth is that most people who lose money this way did not perform any of these checks, not because they are difficult but because the decision to buy was made before any checking started. The research, when it happens, is usually constructed to support a decision already taken.

If you find yourself checking after buying, that is the actual warning sign, and it is about you rather than the token.

For anything you intend to hold, buying an asset that is listed on a venue with a real review process, such as a licensed exchange with a published address, removes most of this category before any checking is needed.