Rug Pull: What It Is and How It Works

How a rug pull works

Rug pulls usually target new tokens launched on a decentralized exchange, where anyone can list a token without review. The pattern is similar each time: create a token, generate hype, attract buyers, then take the money. The main techniques are:

1. Liquidity removal. To make a token tradable, the developers pair it with a valuable asset such as ETH or a stablecoin in a liquidity pool. As buyers swap in, the pool fills with that valuable asset. If the developers control the pool's liquidity tokens, they can withdraw everything at once. Holders are left with a token that has nothing to be sold against.

2. Honeypots and hidden code. The smart contract is written so that ordinary buyers cannot sell, or pay a huge hidden tax when they do, while the developers' wallets can. Some contracts include a hidden function that mints unlimited new tokens. The chart only goes up because nobody else can sell, which attracts more buyers.

3. Insider dumping. The team or early insiders hold a large share of the supply, promote the token aggressively, and sell into the demand. If it happens all at once it is a hard rug; if the team sells gradually while claiming the project is still being built, it is sometimes called a soft rug, which is harder to prove as deliberate fraud.

In every case, late buyers become the exit liquidity for the people who planned the scheme.

Permissionless listing is what makes this possible: a DEX does not check who deployed a token or ask for identity documents, so a new token can be live and tradable within minutes. The same openness that lets legitimate projects launch without a gatekeeper lets scammers launch, too.

Hard vs soft rug pulls

The best-known honeypot was the "Squid Game" (SQUID) token, which traded on the popularity of the Netflix series in October–November 2021 but had no connection to its producers. Buyers could buy but not sell. The price rose sharply for several days, then collapsed to almost nothing on 1 November 2021, and the project's website and social accounts disappeared.

Worked example: how a liquidity pool is drained

This example is hypothetical and priced only in ETH, to show the mechanism; it does not describe a real project.

A developer launches a new memecoin and seeds the pool with:

• 1,000,000 tokens, minted by their own contract at almost no cost;
• 10 ETH, the only real money they put in.

The marketing works and buyers deposit 90 more ETH to buy the token, so the pool now holds 100 ETH. Because the developer supplied the initial liquidity and holds most of the liquidity-provider (LP) tokens, they have a claim on most of the pool. With one transaction they withdraw that share and take most of the ETH. The remaining holders have nothing to sell into, and the price drops toward zero.

The developer put in 10 ETH and walked away with most of the pool; the loss is the ETH the buyers deposited. This is why a liquidity lock matters: if the LP tokens are locked in a lock contract for a set period, the developer cannot make this withdrawal until the lock expires.

Real cases: centralized exchanges and NFT projects

Rug pulls are not limited to small DEX tokens.

Centralized exchanges. The Turkish crypto exchange Thodex halted withdrawals "temporarily" in April 2021 and soon became unreachable. Its founder, Faruk Fatih Özer, left the country, was arrested in Albania in 2022 and extradited to Turkey, and in September 2023 was sentenced to a very long prison term for defrauding thousands of customers. Chainalysis's 2022 Crypto Crime Report counted more than $2.8 billion taken in rug pulls in 2021 and attributed roughly 90% of that to a single fraudulent exchange, Thodex. The case shows that an "exit" can happen wherever one company controls user funds, including on a centralized exchange.

NFT projects. On 24 March 2022 the U.S. Attorney's Office for the Southern District of New York charged two founders of the "Frosties" NFT collection with wire fraud and money-laundering conspiracy. According to prosecutors, the January 2022 sale brought in more than $1 million; right after it sold out the founders shut down the website and moved the funds to wallets they controlled. They were preparing a second collection when they were arrested. The case is regarded as one of the first criminal prosecutions of an NFT rug pull in the United States.

NFT rug pulls usually follow the same arc: a collection is announced with a roadmap and community promises, the mint revenue is collected, and the team disappears along with its Discord server, social accounts and website.

Warning signs of a rug pull

• Unlocked liquidity: check whether the pool's liquidity is locked or burned, for how long and by whom.
• Concentrated supply: a few wallets, often including the deployer, hold most of the tokens.
• Unverified or unaudited contract code, owner functions that can mint, pause trading, blacklist addresses or change taxes.
• Anonymous team with no track record, and a brand-new website and social accounts.
• Unrealistic promises: guaranteed returns or extremely high APY.
• Pressure and hype: countdowns, paid influencers and FOMO messaging, often around memecoins.
• Cannot sell a test amount: if a small sale fails or is heavily taxed, treat the token as a honeypot.

None of these proves a scam on its own, and passing all of them does not prove a project is safe.

• Large team allocation: if the tokenomics give the team and early backers a big share with short or no vesting, the ground is prepared for a sell-off.
• One-sided governance: in DeFi protocols, a team holding most governance tokens can change the rules alone, including emptying the treasury.
• Stalled development: a code repository gone quiet, silent founders and milestones that keep slipping can signal a soft rug.

How to protect yourself

Do your own research before buying new tokens: read the contract on a block explorer or through a token-scanner tool, check holder distribution and liquidity locks, and look for independent audits. Only use money you can afford to lose on new, small tokens, and be wary of approving contracts you do not recognize. Many rug pulls cross national borders, which makes recovering funds very difficult; reporting to the police or a consumer-protection authority can still help investigations. This is general information, not advice on any token.

What careful investors still miss

• "Audited" does not mean "safe". An audit may cover an old version of the code, have a narrow scope, or miss an admin function added later. Check which contract address and which code version the report covers.
• Liquidity locks expire. A lock of a few days looks reassuring, but on the day it ends the team can legally withdraw. Look at the unlock date, not just the "locked" label.
• Transferable or extendable locks: some lock contracts let the owner move the lock to another address or unlock early. Check who controls the lock.
• Contracts that close selling later: a small test sale on day one can succeed, and a contract that can change taxes or blacklist addresses can still block sales afterwards.
• The asymmetry of losses: skipping a project costs nothing, while a single rug pull can wipe out the whole amount invested. Treating an unaudited, anonymous, newly listed token as high-risk until shown otherwise is a reasonable starting point.

For a wider overview of common frauds, see the guide to crypto scams to avoid.

Rug pull vs other crypto scams

A rug pull is an exit scam by the people behind a project. It differs from a pump and dump, where outsiders coordinate buying and then sell, from a hack, where an outside attacker exploits a bug, and from phishing, where a victim is tricked into giving up keys or signing a malicious approval. The same token can suffer more than one of these.