Rug pull warning signs: spot crypto scams before you lose

This guide shows you how to spot a rug pull before you buy a new token. You will learn how to combine human due diligence, on-chain checks, tokenomics review, and a rug pull checker instead of trusting any single red flag.

The 2026 rule is simple: anonymous teams, high APY, and unlocked liquidity still matter, but they are not enough. Sophisticated rug pull crypto projects can buy weak audits, lock only part of liquidity, and manufacture community activity. Your protection comes from checking five locks: team, holders, liquidity, code, and claims.

What is a rug pull in crypto?

A rug pull in crypto is a scam where insiders remove liquidity, dump a large token allocation, or use contract controls that make regular buyers unable to sell. The result is the same: buyers hold tokens with little or no market value while the team or attacker keeps the funds.

You need this definition before you connect a wallet or buy a token. A rug pull is not only a project that disappears. It can also be a live-looking token where selling is blocked, liquidity is quietly removed, or insiders drain value through hidden permissions.

A clear case is the SQUID token in November 2021. The token's price rose by more than 75,000% before collapsing, and the people behind it reportedly took about $3.38 million (the BBC, November 2021). Holders found they could not sell during the collapse.

Rug pulls have also been large enough to affect industry-wide crime statistics. Chainalysis reported that rug pulls took in about $2.8 billion in 2021 (Chainalysis, December 2021). That history is why beginners should treat every new token as unproven until the checks below are complete.

Hard rug pulls vs soft rug pulls

Not every rug pull happens in one dramatic transaction. The difference matters because each type leaves different evidence.

• Hard rug pulls are technical and fast. The smart contract may contain a hidden mint function, a backdoor that drains a liquidity pool, a blacklist function, or a sell restriction that blocks ordinary wallets.
• Soft rug pulls play out over days, weeks, or months. The team may slowly dump its allocation, redirect treasury funds, stop shipping updates, or abandon the community after a presale.

Both types can cost you money. Hard rugs are easier to label after the event. Soft rugs are harder because the team may claim delays, market conditions, or strategic changes while value leaves the token.

Why rug pulls still work in 2026

Rug pulls still work because scammers compress your decision time. A token can launch, trend on social media, and collapse within 48 hours. That window is shorter than the time many beginners need to verify a contract, read holder data, and test sell conditions.

Cross-chain launches also make review harder. A token may appear on Ethereum, BNB chain, Base, and Solana at once. Beginners then have to confirm which contract is official, which pool has real liquidity, and whether the same insiders control supply across chains.

Fake social proof is cheaper than ever. Follower counts, Telegram activity, low-quality audit badges, and influencer posts can be bought. The practical answer is not cynicism. It is a repeatable checklist.

Andreas Antonopoulos, author and educator, is included in this guide because his public education focuses on self-custody and personal verification. That principle fits rug pull protection: do not delegate your safety to a logo, a badge, or a crowd.

Lyn Alden, founder of Lyn Alden Investment Strategy, often writes about separating signal from narrative in digital assets and macro markets. Apply that mindset here: first measure what can be verified on-chain, then decide whether the story deserves your money.

What you'll need before checking a token

Before you run a rug pull checker, gather the tools you need and keep your main wallet away from unknown sites. This setup prevents a research mistake from becoming a wallet-draining mistake.

Open these items before you start:

• A block explorer: Etherscan for Ethereum, BscScan for BNB chain, Solscan for Solana, or BaseScan for Base.
• A liquidity and chart page: dexscreener.com or a similar live market page.
• A rug pull checker: RugCheck or tokensniffer.com for automated contract warnings.
• The project website and social channels: you will compare claims against on-chain evidence.
• The token contract address: copy it only from an official, verified source.
• A separate wallet with no major funds: use it only for testing unfamiliar sites.

Warning: Never paste your seed phrase into any scanner, website, browser extension, support chat, or recovery form. No legitimate rug pull checker needs it. Any page asking for it is trying to steal your wallet.

Tools to open before you start

Each tool category answers a different safety question. Do not expect one scanner to catch every risk.

A contract can pass a rug pull checker and still be unsafe if one wallet controls most of the supply, the liquidity lock expires tomorrow, or an admin key can change selling rules. Use automated tools as your first filter, not your final decision.

Wallet safety setup

Your wallet setup matters as much as your research. Do not research unknown tokens using the same browser profile that holds your main wallet sessions.

1. Open a fresh browser profile. Chrome and Brave support separate profiles. Use one with no saved sessions and no unnecessary extensions.
2. Use read-only checks first. Tools such as Zapper let you view public addresses without connecting a wallet.
3. Create a burner wallet for testing. Fund it only with money you can lose. If you need wallet options, see our DeFi wallet comparison.

Self-custody gives you control, but it also makes you the last line of defense. If you have not reviewed why self-custody matters, do that before connecting to any new protocol.

Step 1: verify the team, website, and community

Start with the people and the public presence before you touch the contract. This step costs nothing and often reveals the first rug pull warning signs.

Check founder and contributor history

Search every named team member on LinkedIn, GitHub, X, and the project's own documentation. You are looking for a consistent trail: past work, public code, conference talks, technical writing, or other work that can be independently checked.

If the team claims to be doxxed, ask who verified it. Self-reported doxxing is weak evidence. If a project uses a know-your-customer provider, open the provider's site directly and confirm that the claim appears there.

Also search the founders' names beside older token names. Repeat failures, deleted sites, and abandoned communities are relevant. If you cannot verify the people, the project needs stronger evidence in every other category.

Scan the website for trust gaps

Run the domain through DomainTools or another WHOIS lookup. A domain registered in the past 30 to 90 days is not proof of fraud, but it is common in fast-launch token schemes.

Read the whitepaper. Copy unusual paragraphs into a search engine and check whether the text was lifted from another project. Watch for missing legal pages, partner logos that do not link anywhere, broken documentation, and roadmaps with no dates.

Pressure copy is also a warning sign. Phrases such as "presale ends tonight" or "only a few spots left" are designed to make you act before you check.

Read the community like a skeptic

Join the Telegram or Discord and ask a specific technical question: "What percentage of liquidity is locked, where is the locker address, and when does it open up?" Then watch the response.

Healthy teams answer clear questions or point you to public documentation. Risky projects often mute you, bury the question under bot replies, or redirect you to vague hype posts.

Pro tip: Follower counts are not proof. A group with 50,000 members can still have little real discussion. Scroll through replies. Repeated phrases, read-only channels, and deleted questions about tokenomics are stronger signals than the member count.

If moderators remove questions about vesting, liquidity, taxes, or admin keys, stop. Real teams do not need to hide basic control information from buyers.

Step 2: inspect token distribution and holder concentration

Next, check who owns the token supply. If a small group controls most tokens, they can dump into the market even if the website looks professional.

Open the holders tab on a block explorer

1. Copy the contract address from the official project source. Do not search by token name because scam copies often use similar names.
2. Cross-check it against the trading pair. Open the pair on the exchange or chart site and confirm the address matches exactly.
3. Paste the address into the correct block explorer. Use the explorer for the chain where the token trades.
4. Click the holders tab. Review the ranked list of wallets by percentage of supply.

Use these working thresholds. If the top non-contract wallet holds more than 10% of supply, treat it as a yellow flag. If one wallet holds 20% or more, treat it as a serious rug pull warning sign unless the project proves it is a locked vesting, treasury, or exchange wallet.

Look for whale wallets and connected clusters

Large individual wallets are only part of the risk. Several wallets holding 3% to 5% each may belong to one insider group.

Use the Three-Point Cluster Test:

1. Same funding source: did several wallets receive gas or tokens from the same original wallet?
2. Same funding date: were they created or funded within the same short window?
3. Similar token receipt timing: did they receive token allocations in the same transaction batch?

If all three points match across multiple wallets, you may be looking at one owner split across addresses. Willy Woo, on-chain analyst, is cited here because his public work centers on reading market behavior from on-chain data. For new tokens, holder structure is often more useful than marketing claims.

Check vesting and release schedules

Holder distribution can look safe today and change next month. Team, advisor, and investor tokens may open up after a cliff and add heavy sell pressure.

Look for a vesting schedule in the tokenomics page. It should show the team allocation, investor allocation, cliff date, open up frequency, and full release date. If the schedule is missing, treat that absence as a warning sign.

On-chain token vesting contracts are stronger than promises because they enforce release timing through code. If the team says tokens are vested but cannot show the contract address, assume the schedule is not enforceable.

Warning: A vague vesting chart is not enough. You need a contract address, transaction history, or a clear custody arrangement that matches the published schedule.

Step 3: check liquidity locks, trading controls, and contract permissions

Token distribution tells you who holds supply. Contract permissions tell you who controls the rules. This is where many beginners stop too early.

Confirm whether liquidity is locked or burned

When you buy through a decentralized exchange, funds enter a liquidity pool. If the team controls the pool tokens and those tokens are unlocked, it can remove the pool and leave buyers with no market to sell into.

If you need a refresher, read our guide on how liquidity pools work. Then open the token's chart page and find the liquidity section.

You will usually see one of three setups:

• Burned liquidity: pool tokens were sent to a dead address. This is usually the strongest signal.
• Time-locked liquidity: pool tokens sit in a locker contract until a stated date.
• Unlocked liquidity: pool tokens remain in a wallet that can remove them at any time.

Click the locker link if one appears. Confirm the locked amount, the locker address, and the open up date. A six-month lock that expires next week is not meaningful protection.

Warning: A lock badge can be misleading. If only 10% of liquidity is locked and the rest is in the owner's wallet, the badge does not protect buyers.

Search for honeypot and sell-block mechanics

A honeypot lets you buy but blocks or punishes selling. This is one of the clearest rug pull warning signs because buyers may not discover it until funds are trapped.

Look for a sell tax above 10%, a buy tax of 2% paired with a sell tax of 45%, blacklist or denylist functions, transfer pauses, or a maximum transaction rule that blocks normal exits. Anything near a 100% sell tax should be treated as a hard stop.

Check recent on-chain trades. If you see many buys and almost no sells from normal wallets, pause. Use a small test sell only from a burner wallet, never from your main wallet.

Review owner privileges and upgradeability

Not every admin function is malicious. Smart contract access control is a normal part of protocol design. The risk comes when powerful permissions are hidden, unexplained, or controlled by one wallet.

Search the verified contract source for functions such as mint, pause, blacklist, setTax, excludeFromFees, upgradeTo, and emergencyWithdraw. If you cannot read code, paste the contract into a scanner and then verify any warning manually on the explorer.

Upgradeable contracts need extra care. A clean contract today can become unsafe later if an admin can replace the logic without a public timelock.

Use a rug pull checker, but do not stop there

A rug pull checker can flag known issues quickly. RugCheck and tokensniffer.com may identify unverified code, suspicious taxes, mint permissions, liquidity problems, or known scam patterns.

The limitation is false confidence. A token can pass automated checks while still having dangerous holder concentration, a near-term liquidity open up, or an admin key that can change transfer rules after launch.

Use the table below as your on-chain checklist.

Step 4: review audits, code, and on-chain activity

An audit badge is not a safety guarantee. It only matters if the audit covers the exact code you are about to use and if serious findings were fixed.

As a dated reminder, the FTC updated its endorsement guidance in 2023 to require clear disclosure of paid endorsements (FTC, June 2023). Treat undisclosed promotions and audit-badge marketing with the same skepticism: claims should be checked at the source.

Compare the audit to the live contract

Open the audit from the audit firm's own website, not from a screenshot on the token site. Look for the contract address, commit hash, chain, audit date, and final status of findings.

Then open the deployed contract on the block explorer. Confirm that the address or commit matches the report. If the report covers a different address, the audit does not cover the token you are buying.

Scan for unresolved critical or high-severity issues. If a finding is marked acknowledged instead of fixed, the team chose to leave that risk in place.

Check multisig, timelocks, and admin controls

Ask one direct question: who can move treasury funds or change the contract? A single admin wallet with no timelock can act faster than holders can respond.

A multisig wallet that requires 3 of 5 approvals is stronger than a single signer. A timelock is stronger still because it creates a delay, often 24 to 72 hours, before a major change executes.

You can search treasury addresses on Safe. If the team claims a timelock, verify the timelock contract on the block explorer and check recent queued transactions.

Read on-chain activity for real usage

Fake usage is common. A token can show thousands of transactions while the same small wallet group trades back and forth.

Use the 3-point activity test:

1. Wallet diversity: do many unique wallets interact, or does the same cluster repeat?
2. Liquidity consistency: does liquidity grow steadily, or does it spike before promotions and then fall?
3. Owner activity: has the deployer wallet suddenly moved tokens or called admin functions?

Round-number trades repeating at regular intervals can signal wash trading. Real user activity is usually messier.

Warning: Do not trust a landing-page audit badge by itself. Trace the report to the source, match the contract address, and confirm high-risk findings were fixed.

Step 5: test market claims, APY promises, and launch mechanics

Some rug pull warning signs do not appear in contract code. They appear in APY promises, launch countdowns, influencer posts, and fake partnership claims.

Question unrealistic APY and guaranteed returns

High APY is not automatically fraud. The question is where the yield comes from. Sustainable yield should connect to trading fees, lending interest, real revenue, or clearly disclosed token emissions with a finite schedule.

If a project promises 1,000% APY and cannot explain the funding source in plain English, walk away. If the answer is only "growth," "community," or "ecosystem rewards," assume new buyers are funding old buyers until proven otherwise.

Pro tip: Ask the team to show the fee source, emission schedule, and dashboard that supports the advertised APY. If they cannot, do not buy under pressure.

Verify exchange, partner, and influencer claims

Scammers often claim exchange listings or partner deals before those claims appear on the other party's official channels. Check the exchange blog, verified account, or announcement page directly.

For influencers, check whether the post is labeled as paid. A promotion without a disclosure can still move markets, but it should not count as independent validation.

Deepfake promotions are another 2026 risk. If a famous person appears to promote a small token in a short video, verify the post from that person's official account before believing it.

Watch presale and airdrop pressure tactics

Countdown timers, bonus tiers, and "last allocation" banners exist to make you rush. Slow down when a site tries to make waiting feel expensive.

A common airdrop attack works like this:

1. You see a social post offering a free token claim.
2. The link opens a site that imitates a real protocol.
3. You connect a wallet and are asked to approve a transaction.
4. The approval gives a malicious contract permission to drain tokens.

Never enter your seed phrase on an airdrop page. Scan the contract before connecting, and use a burner wallet if you decide to test at all.

What to do if you fell for a rug pull

If you think you were rugged, your first job is not recovery. Your first job is to stop more losses.

Act within the next 30 minutes if possible. The FBI's 2023 cryptocurrency report recorded more than 69,000 crypto-related complaints and over $5.6 billion in reported losses (FBI IC3, September 2024). Fast reporting and clean evidence matter.

Secure your wallet first

Stop interacting with the token site. Do not try to unstake, claim, or approve anything else from the suspect contract.

Open Revoke.cash and revoke approvals granted to the suspicious contract. After that, move unaffected assets to a clean wallet created on a device and browser profile that did not interact with the project.

For a full refresher, see our guide to self-custody wallet safety. You may also review crypto insurance options for future holdings, but read exclusions carefully because rug pulls are often treated differently from smart contract exploits.

Warning: Recovery scammers often contact victims within hours. They may claim to be investigators or support agents. No legitimate service can reverse confirmed transactions, and anyone asking for your seed phrase is trying to steal from you.

Document evidence for reporting

Save evidence before websites and social accounts disappear. Capture:

• Transaction hashes for every interaction.
• Your wallet address and the token contract address.
• Screenshots of the website, whitepaper, tokenomics page, and claim page.
• Full URLs for the site, app, presale page, and social posts.
• Discord and Telegram handles of admins.
• Timestamps for announcements and messages.

Use your browser's save function and archive pages through web.archive.org. Then report the incident to your national financial regulator, local law enforcement, and the FBI's IC3 portal if you are in the US.

If the loss is large, review our guide on when to hire a crypto lawyer. A qualified lawyer can advise on jurisdiction, tax records, and whether any recovery route is realistic.