Rug pulls: the on-chain warning signs before a token collapses
Every rug pull takes one of three exits. How each one works, and the four on-chain checks that can catch it before you buy.
A new token is up 400% in a day, the chart only goes one way, and the group chat is loud. Then, in a single block, the price drops to almost nothing. That's a rug pull: the people behind a token take the money and leave holders with a worthless asset. And it's common. Between January 2024 and March 2025, about 98.6% of the 7 million-plus tokens launched on one popular Solana launchpad were linked to rug pulls or pump-and-dump schemes. This guide explains the three ways a rug pull happens and the on-chain checks that can catch each one before you buy.
Last updated: November 2026
What is a rug pull?
A rug pull is a crypto scam in which a token's creators or insiders drain its value and abandon it, leaving buyers with tokens they can't sell for anything close to what they paid. The name comes from the image of the rug being pulled out from under the holders' feet.
Rug pulls are concentrated in new, small tokens, especially meme coins launched in minutes with no track record. In the first half of 2025, researchers studying 100,063 tokens newly issued on three Solana exchanges flagged 76,469 of them as rug pulls. On the launchpad mentioned above, only about 97,000 of more than 7 million tokens kept even $1,000 of liquidity.
Hard rug vs soft rug
Rug pulls come in two speeds:
- Hard rug. A sudden exit, often within minutes or hours of launch. The team removes the trading liquidity or uses a hidden contract power, and the price collapses in one move.
- Soft rug. A slow exit. Insiders sell their large allocation over days or months while the project appears to carry on. There's no single crash, just a chart that bleeds and a team that goes quiet.
Soft rugs are harder to prove, because the contract code can be clean. A code audit checks what the contract can do, not what the founders decide to do with their tokens.
Rug pull, honeypot or pump and dump?
These three get mixed up because they often overlap. The difference is where the money goes.
| Scam | What happens | What you see |
|---|---|---|
| Rug pull | Creators remove liquidity or dump their supply and leave | Price crashes; the pool is empty or the team wallets have sold |
| Honeypot | The contract lets you buy but blocks or taxes your sell | Buys go through, sells fail |
| Pump and dump | Promoters hype a token, then sell into the buying | Sharp rise, then a crash; the project may still exist |
A honeypot is really a rug pull built into the code from day one. Our guide to honeypot tokens covers that case in detail.
The three ways a rug pull happens
Every rug pull ends the same way, but the exit runs through one of three routes. Knowing which route a token leaves open tells you which check matters most.
1. The liquidity pull
A new token trades against a liquidity pool: the token paired with something of real value, such as SOL, ETH or a stablecoin. The team that created the pool holds LP tokens, which act as the receipt for that liquidity. If those LP tokens aren't locked or burned, the team can withdraw the paired assets at any moment. The pool empties, and the token has nothing left to trade against.
This can happen fast. On January 20, 2026, the developers of Trove Markets removed about $2.5 million of liquidity minutes after the token launched on Solana. Its fully diluted value fell from $20 million to about $110,000, a 98% drop, and early buyers got no refunds.
2. Contract powers the team kept
Some rug pulls don't touch the pool at all. They use powers written into the token contract that the team never gave up:
- Mint authority. The team can create new tokens and sell them into the pool, diluting everyone else.
- Freeze authority or a blacklist. The team can stop chosen wallets from moving or selling the token. Freeze-authority abuse was one of three recurring rug patterns among Solana tokens launched in the first half of 2025.
- Changeable taxes. The owner can raise the sell tax after launch, sometimes so high that selling stops making sense, which turns the token into a honeypot.
- Hidden backdoors. Code that lets the owner move funds or pause trading.
None of these is proof of a scam on its own, since some legitimate projects keep admin powers for upgrades. But on a brand-new meme coin with no clear reason for them, each one is a door the team can walk through.
3. The insider dump
The quietest rug pull needs no special code. A few wallets linked to the team hold a large share of the supply, often bought at near-zero prices or allocated before launch. As buyers arrive, those wallets sell in pieces. The price drifts down instead of crashing, and the project keeps posting updates until it doesn't.
This is the soft rug, and it's the one a contract scan can't catch. The warning sign is in who holds the supply, not in what the code says.
How to spot a rug pull before you buy
You can spot most rug pulls by checking four things before you buy: whether liquidity can be pulled, what the contract still allows, who holds the supply, and whether you can actually sell. Each check maps to a different exit.
| Check | What to look for | Where to look | Rug it catches |
|---|---|---|---|
| Liquidity | LP tokens locked or burned, how much is locked, and when the lock ends | DEX analytics page, the lock contract | Liquidity pull |
| Contract powers | Mint and freeze authority revoked; no blacklist, pause or changeable tax | Block explorer, token scanner | Mint dump, freeze, honeypot |
| Holders | No single non-pool wallet with a large share; team wallets identified | Block explorer "Holders" tab | Insider dump |
| Sell side | Recent successful sells from many wallets; a tiny test sell works | Trade history, a small test | Honeypot, sell tax |
Coin98 Super Wallet adds a first look when you add a token by its contract address: our Custom Token screen shows an Anomaly Report alongside the symbol and decimals, with anomaly scanning on BSC, BTC, SOL and ETH. Treat it, and any scanner, as a starting point, not a verdict.
Check the liquidity, and when the lock ends
"Liquidity locked" is the most quoted safety signal and the most misread. We suggest asking three questions:
- How much is locked? A lock on 10% of the pool leaves the other 90% free to pull.
- When does it end? A 30-day lock protects you for 30 days. Check the unlock date, not just the word "locked".
- Are there other pools? The team may lock one pool and keep a second one unlocked.
Burned LP tokens, sent to an address no one controls, are stronger than a time lock, because they can't come back.
Check what the contract still allows
On Solana, look for mint authority and freeze authority set to "disabled" or "revoked". On EVM chains, check whether ownership is renounced and whether the contract has functions to mint, blacklist, pause or change fees. If the contract source isn't verified on the block explorer, you can't see what it does, and we'd recommend treating that as a high-risk token.
Renounced ownership helps, but it isn't a guarantee. A team can mint itself a large supply first and renounce ownership afterward.
Check who holds the supply
Open the token's "Holders" tab and look at the top 10 wallets. Set aside the liquidity pool, exchange wallets and burn addresses, then ask how much the rest hold. If one or two unexplained wallets control a large share, the price depends on them not selling. Wallets that received tokens straight from the deployer, or that were funded from the same source, are often the team.
Check that you can sell, and who's selling
Scroll the trade history for sells from many different wallets. If you only see buys, that's a honeypot warning. A very small test buy and sell shows you the real tax before you commit more. Our Solana meme coin guide walks through this due-diligence routine for new launches.
The social side is a signal too. An anonymous team, "guaranteed" returns, countdown pressure and a website registered last week each add risk. None proves a rug pull alone, but several together should make you walk away.
What to do if a token you hold gets rugged
If a token you hold has been rugged, the money is usually gone: the liquidity has left the pool, and there's no counterparty to give it back. What you can control is making sure it doesn't cost you more.
Don't chase it
We'd recommend against trying to sell or swap a token your wallet flags as a scam. Our Wallet Health guidance is to hide a flagged scam token rather than interact with it, because some contain logic that can trigger a wallet drain when you try to trade them. Buying more to "average down" into an empty pool only adds to the loss.
Clean up the wallet
- Hide the token so it stops cluttering your balance. Hiding a token takes a long press on it in Coin98 Super Wallet.
- Revoke approvals you gave to the token or the dApp you bought it on. Wallet Approval lets you review and revoke allowances across supported chains; our explainer on token approvals covers why they outlive the trade.
- Run a Wallet Health scan to catch risky dApp connections and approvals you've forgotten.
Report it, and ignore "recovery" offers
Save the token's contract address, the transaction hashes and screenshots of the project's channels, then report it to the platform where you bought it and to your local authorities. Expect messages from "recovery agents" promising to get the funds back for a fee. They're a second scam aimed at people who've just lost money. Our guide on what to do if you've been scammed lists the steps in order.
FAQ
What is a rug pull in crypto?
A rug pull is a scam in which a token's creators or insiders drain its value and abandon it. They do it by removing the trading liquidity, using a contract power such as minting or freezing, or slowly selling a large allocation. Holders are left with tokens that are worth little or nothing.
What's the difference between a soft rug and a hard rug?
A hard rug is sudden: the team pulls the liquidity or uses a hidden contract function, and the price collapses in one move. A soft rug is slow: insiders sell their tokens over time while the project appears to continue. Soft rugs are harder to spot, because the contract code can look clean.
Does locked liquidity mean a token is safe?
No. Locked liquidity only rules out one exit, and only for as long as the lock lasts. Check how much of the pool is locked, when the lock ends, and whether other pools exist. A locked pool doesn't stop insiders from dumping a large supply or using mint and freeze powers.
Can you get your money back after a rug pull?
Usually not. Once liquidity is removed, there's nothing left in the pool to sell into. Report the token to the platform you used and to authorities, since teams are sometimes traced. Be wary of anyone who offers to recover the funds for a fee.
Are rug pull checkers reliable?
Token scanners are useful for spotting open mint authority, blacklist functions, high taxes and honeypot code. They can't judge intent, so they won't catch a team that slowly sells its own tokens. Use them as one check alongside liquidity, holder and trade-history checks.
Conclusion
A rug pull is one of three exits: pulling the liquidity, using a contract power the team kept, or slowly dumping a large supply. Four checks (liquidity, contract powers, holders and the sell side) cover all three, and they take a few minutes before you buy. Hold new tokens in a wallet you control, like Coin98 Super Wallet, and use its Anomaly Report and Wallet Health scan as part of that routine.
