What Is a Rug Pull in Crypto? How They Work and How to Avoid Them

What Is a Rug Pull?

A rug pull is an exit scam specific to crypto — most commonly DeFi — where the people behind a project deliberately collapse it and take the money. The phrase comes from "pulling the rug out" from under investors.

The typical structure: a team creates a new token, builds hype through social media and influencer promotion, attracts buyers who push the price up, and then the founders either drain the project's liquidity pool or dump their own large token holdings at the top. The token price crashes instantly to near zero. The founders leave with the proceeds; buyers hold tokens that are now effectively worthless.

Rug pulls are distinct from projects that simply fail. Legitimate projects can run out of funding, lose market traction, or make bad decisions — those are risks of investing, not scams. A rug pull is intentional: the founders planned to exit with investors' money from the beginning.

---

The Three Types of Rug Pulls

Hard Rug Pull: Liquidity Drain

This is the most dramatic and immediate type. A liquidity pool (LP) holds two assets — typically the new token and a major currency like ETH or BNB — that allow users to swap between them. When someone "adds liquidity," they deposit equal value of both assets into the pool.

In a hard rug pull, the developers hold the LP tokens (which represent ownership of the pool's liquidity) and have not locked them. At a chosen moment — usually after the price has risen significantly and many investors are holding — they use those LP tokens to withdraw all the liquidity from the pool. In seconds, there is no liquidity left. Any attempt to sell the new token finds no buyers; the price drops to zero. The developers hold the ETH or BNB they removed.

Understanding what DeFi is helps clarify why this works: in decentralised finance, there is no central party to stop the transaction. The smart contract permits the withdrawal if the caller holds the LP tokens, regardless of intent.

Soft Rug Pull: Developer Token Dump

In this type, the liquidity itself may be locked, but the developers allocated themselves a large portion of the token supply at launch or in early rounds. Once the token price rises on buying pressure, they sell their holdings in large amounts — a "dump." This floods the market with supply, collapses the price, and leaves other holders underwater while the founders profit.

This is harder to call definitively a scam (versus bad behaviour), because some dumping by early participants is a normal feature of any token market. The difference is scale and timing: a coordinated dump of 30–50% of the supply shortly after launch, with the team then going silent, is effectively a rug.

Smart Contract Rug: Code Backdoor

The most sophisticated type is a contract coded with a hidden function — often disguised as a routine function — that allows the deployer to mint unlimited tokens, disable selling for all wallets except the founder's, or transfer arbitrary user funds. Users interact with what looks like a legitimate DeFi protocol, but the contract includes a trapdoor only the deployer can activate.

These require a code audit to detect. Without one, the backdoor is invisible to ordinary users checking the contract on a block explorer.

---

Warning Signs Before You Invest

Unlocked liquidity. If the LP tokens are not locked with a third-party service (Team Finance, Unicrypt, or similar), the developers can drain the pool at any time. Check the token's liquidity lock on DexTools or DexScreener. No lock = the single biggest red flag.

Anonymous, unverifiable team. Many legitimate projects operate pseudonymously, but entirely anonymous teams with no public track record and no social history carry substantially higher risk. If the founding team has no verifiable identity and no prior project history, there is nothing at stake if they exit.

No code audit. Smart contract audits by named security firms (Certik, Hacken, Peckshield) are not foolproof — audits have missed bugs — but their absence removes even the basic check. Any project claiming to be a serious DeFi protocol should have a published audit.

Concentrated token holdings. Look at the token distribution on a blockchain explorer. If the top 1–5 wallets control 30–50% or more of the supply, a coordinated dump can destroy the price. Healthy projects distribute tokens broadly.

Aggressive urgency and hype. Rug pulls often rely on FOMO — "this is going 100x, don't miss it, buy now." Legitimate early-stage projects still have time to let you evaluate the fundamentals. Manufactured urgency is a sales tactic, not a sign of genuine scarcity.

Copied or minimal code. Many rug tokens are a copy-paste of a legitimate token's contract with minimal changes. Comparing the contract code to known audited contracts can reveal how much effort went into the project.

---

How to Check a Token Before Buying

Step 1: Verify the contract address. Find the official contract address from the project's own website (not from a Telegram link or social post). Check that address on Etherscan or BSCScan to see who deployed it and when.

Step 2: Check token distribution. Click on the "Holders" tab on Etherscan. Look at the top holders list. If one or two wallets hold a third or more of the supply, that is a concentration risk.

Step 3: Verify the liquidity lock. Search for the token on DexTools or DexScreener and look at the liquidity section. Confirm that the LP tokens are locked, who holds the lock, and when it expires. A one-week lock is meaningless; a year or more is more meaningful (though still not a guarantee).

Step 4: Look for an audit. Check the project's website and GitHub for a published audit from a named firm. Read the audit summary — particularly any "Critical" or "High" severity issues and whether they were resolved.

Step 5: Assess the team. Can you find the founders on LinkedIn, GitHub, or through prior projects? Have they shipped anything before? Are there VCs or investors with reputations at stake?

Step 6: Check tokenomics. What is tokenomics explains the key numbers to look at. How much of the supply is allocated to founders and early investors? What is the vesting schedule? Is there a mint function that could inflate the supply?

---

What Happens When a Rug Pull Occurs

The sequence is fast. A large sell order hits the pool or LP is drained; the price graph shows a near-vertical drop to zero or near-zero in seconds or minutes. Social media channels go quiet or are deleted. The project website goes offline. The founding team's social accounts vanish.

Token holders are left with assets that cannot be sold for meaningful value because there is no liquidity. Even if a secondary market forms at pennies on the dollar, the founders are long gone with the primary exit proceeds.

Tracking down the wallet addresses involved is possible on-chain, and some high-profile rug pulls have led to arrests. Most do not — especially if the founders operated anonymously and used mixing techniques to obscure fund flows.

---

After a Rug Pull: What You Can Do

Report to relevant authorities: the FTC and FBI IC3 in the US, Action Fraud in the UK. Preserve all evidence: screenshots, contract addresses, transaction hashes. If you used a centralised exchange to buy the token, report the associated contract address to the exchange — they can sometimes flag the addresses connected to the scam.

Beyond reporting, there is often little recourse. This is why prevention — specifically the on-chain checks described above — is far more effective than any post-facto remedy.

You can monitor cryptocurrency prices and established markets to understand what healthy, liquid markets look like as a baseline for comparison.

---

This article is for educational purposes only and does not constitute financial, legal, or investment advice. DeFi investments carry substantial risk including the risk of total loss. Always conduct independent due diligence before investing in any token or protocol.