A rug pull is when a project team removes liquidity or dumps their allocation, leaving holders with a worthless token. The main warning signs are unlocked liquidity, an anonymous team with no track record, a large team allocation, an unverified contract, very few holders, and functions in the code that let the deployer mint, pause or blacklist.
Hard rugs and soft rugs
| Type | What happens | How fast |
|---|---|---|
| Liquidity removal | The team withdraws the trading pool, so nobody can sell | Minutes |
| Honeypot contract | Code prevents everyone except the deployer from selling | Immediate, by design |
| Insider dump | The team sells a large allocation into the buying | Hours to days |
| Slow rug | The team stops working, quietly sells, and lets it fade | Weeks to months |
The ten minute check
Is the contract verified?
On a block explorer, look for verified source. Unverified means nobody can read what the code does. That alone is enough to walk away.
Is liquidity locked, and for how long?
If the deployer can withdraw the pool, they can end it at any moment. Look for a lock with a credible locker and a meaningful duration. A one month lock is barely a lock.
How concentrated is the supply?
Check the top holders on the explorer. Exclude exchange and contract addresses. If one wallet holds a large share, that wallet decides the price.
How many holders are there?
A large market cap with a few hundred holders is not a market, it is a setup waiting for buyers.
What can the deployer still do?
Search the verified source for mint, pause, blacklist, setFee and setMaxTx. Their presence is not automatically malicious, and it tells you exactly what can still be done to you.
Can you actually sell?
Use a token scanner that simulates a sell before you buy. Honeypots look perfect until you try to exit.
Is the team real?
Anonymous is not automatically bad, and it does remove all accountability. Look for a track record, a GitHub with real history, and public appearances.
Does the social activity look organic?
Thousands of followers with no engagement, replies that are all the same phrase, a Telegram where nobody asks a critical question. Bought communities look bought.
Immediate red flags
Unverified contract
Nobody can read the code. There is no upside to this and every reason to avoid it.
Liquidity not locked
The pool can be withdrawn at any moment, which ends trading instantly.
Guaranteed returns
Nothing is guaranteed. A promised fixed yield with no explained source is a red flag on its own.
Urgency
Limited spots, presale ending, act now. Urgency exists to stop you checking.
Huge team allocation
Above thirty percent to the team with no long vesting means their exit is the plan.
Copied whitepaper
Paste a paragraph into a search engine. If it appears verbatim elsewhere, you have your answer.
A realistic expectation
These checks filter out obvious theft. They do not tell you whether something is a good investment, and they do not catch a team that intends to work honestly and then changes its mind.
Common questions
What is the difference between a rug pull and a project failing?
Intent. A rug pull is theft planned in advance. A failure is a genuine attempt that did not work. From the outside, and especially in hindsight, they can look identical.
Are locked liquidity tokens safe?
Safer, and not safe. Locks expire, some lockers are controlled by the same team, and locked liquidity does nothing about a large team allocation being sold.
Can I get my money back after a rug pull?
Effectively never. Occasionally there are civil actions and occasionally exchanges freeze deposited funds. Neither should factor into your decision to buy.
Where to go next
Get a second pair of eyes on your setup
A security session reviews what you hold, where it sits, what approvals are open and what would happen if your laptop were compromised tomorrow. Most people find at least one thing worth fixing.