A rug pull is a type of crypto exit scam where developers create a project, attract capital, and then abruptly remove that capital, leaving investors with worthless tokens. The term comes from “pulling the rug out.” In 2023, rug pulls and exit scams accounted for approximately $2.8 billion in losses according to Chainalysis. They range from obvious pump-and-dump schemes to sophisticated multi-month projects with audits and KYC that still exit.
How rug pulls and common scams actually work
The classic DEX rug: a new token is deployed on Uniswap or PancakeSwap. The developer adds liquidity (ETH + TOKEN) to create a trading pair. As buyers pile in, the token price rises. The developer, who controls a large percentage of supply, sells their allocation into the rising price, or withdraws the entire liquidity pool in one transaction. Buyers are left holding tokens with no liquidity and no exit. The entire operation can take 48 hours from token deployment to rug.
Harder-to-detect variants: audit-passing rugs use honeypot contracts that allow buys but block all sells via a hidden condition in the transfer function (often checking if the seller is not the deployer address). Token goes up because only the deployer can sell, everyone else is locked in. The deployer sells everything, price collapses. Slow rugs run for months or years: team gradually reduces activity, stops development, and quietly exits via small daily sells from team wallets until price implodes. Squid Game token (2021) is the canonical example of a fast rug, token went from $0.01 to $2,856 in days, then developers pulled liquidity and it dropped to $0 in minutes. On-chain analytics tools and the signals they generate are covered in our on-chain analytics guide, the same infrastructure that detects wash trading catches many rug patterns early.
What this means for traders
Pre-investment on-chain checks take five minutes and eliminate most obvious rugs. Check the token contract on Etherscan or BSCScan: is it verified (source code visible)? Does the contract include functions like setMaxTx, setFee, excludeFromFee, or blacklist that give the deployer privileged control? Use tools like Token Sniffer, Honeypot.is, or De.Fi Scanner to run automated checks, they flag sell restrictions, honeypot patterns, and deployer concentration in seconds. Check the liquidity lock: is LP liquidity locked in a time-lock contract (Unicrypt, Team.Finance) for at least 6–12 months? An unlocked LP means the developer can drain it instantly.
Social red flags often match on-chain red flags: anonymous team with no verifiable history, a Telegram with 10,000 members that appeared in two weeks, promises of unrealistic returns, pressure to buy immediately, and celebrities promoting the token (which is often paid promotion or a compromised account). The 2022 Kim Kardashian/EthereumMax case resulted in a $1.26M SEC settlement, promoted tokens should be assumed to be at-risk until proven otherwise. The liquidity analysis that helps separate genuine projects from rugs connects to our TVL explainer for how to evaluate protocol liquidity depth.
A concrete example
You discover a new Ethereum token: NOVA. Contract is verified on Etherscan. You check Token Sniffer: “Owner can modify fees, max fee currently 0%, but can be set up to 99%.” Red flag 1: the fee function exists and the deployer can change it. LP is not locked, the deployer wallet still holds all LP tokens. Red flag 2: liquidity can be removed at any time. Top 10 wallets hold 87% of supply, the deployer team wallet holds 45% alone. Red flag 3: extreme supply concentration. Telegram shows 8,000 members, but the Telegram was created 6 days ago and posts are almost entirely from one account. You skip the investment. Three days later, NOVA’s price rises 15x as bots and social media hype it. Then the deployer removes all LP in one transaction, $2.1M drained. You missed a 15x gain but avoided a 100% loss. In scam-rich environments, avoiding loss is the primary skill.
Frequently asked questions
Can audited tokens still be rug pulls? Yes. Audits verify that code does what it says it does, they do not verify that what it says it does is honest. If an audit confirms “the owner can set fees up to 99%,” that is technically correct code but economically a backdoor. Some projects also use audit logos from non-existent or paid-for audit firms. A genuine audit from CertiK, Trail of Bits, or OpenZeppelin is meaningful; an audit from an unknown firm with no public track record is not.
Is it possible to recover funds from a rug pull? Rarely. Blockchain transactions are irreversible. In some cases, law enforcement has traced and frozen funds (Wormhole hack recovery, Poly Network partial recovery), but these involved centralized intermediaries that could be pressured. A DEX rug where the developer cashed out through multiple wallets and mixing services is practically unrecoverable for retail investors.
What is a soft rug vs a hard rug? A hard rug is an instant exit: liquidity removed, developer wallet empties, project goes dark simultaneously. A soft rug is gradual: developers quietly reduce activity over weeks or months, community engagement drops, and the team eventually stops responding while slowly exiting their token positions. Soft rugs are harder to detect and often get characterized as “failed projects” rather than intentional scams, even when the on-chain evidence shows coordinated team wallet activity preceding the price collapse.
