Crypto Rug Pulls: How to Spot a Scam Project Before You Lose Everything

A rug pull is when a crypto project’s developers abandon the project and run away with investors’ funds, leaving behind a worthless token. The term comes from the phrase “pulling the rug out” from under investors.

In 2025, rug pulls and exit scams cost crypto investors an estimated $2.7 billion globally. The majority involved tokens on Solana through platforms like Pump.fun, where anyone can launch a token in 30 seconds. Many lasted less than 24 hours before the developers disappeared with the funds.

Understanding how rug pulls work and what to look for is one of the most valuable skills in crypto.

How Rug Pulls Work

There are two main types of rug pull.

Hard rug pulls involve deliberate theft. Developers write malicious code into the smart contract from the start — a hidden function that lets them mint unlimited tokens, drain the liquidity pool, or freeze everyone else’s tokens. They build hype, attract investors, then execute the theft and disappear.

Soft rug pulls (or exit scams) do not necessarily require malicious code. Developers create a real token, build a community, raise liquidity — then simply abandon the project and sell their token allocation. They have not necessarily broken any law (in many jurisdictions), but investors lose their money.

Both result in the same outcome for investors: the token price collapses to zero and the money is gone.

Eight Warning Signs of a Rug Pull

1. Anonymous team: This is the single strongest predictor of rug pull risk. Legitimate projects almost always have publicly identifiable founders with verifiable track records. Anonymous teams have no reputational stake — walking away costs them nothing. Always search for team members’ real identities.

2. Unlocked or concentrated liquidity: In DeFi, token liquidity should be locked in a smart contract for a meaningful period (6 months minimum, ideally longer). “Locked liquidity” means developers cannot instantly drain the trading pool. Check whether liquidity is locked using tools like Team.Finance or Unicrypt. Also check whether team-controlled wallets hold a dominant share of the supply.

3. Unable to sell your tokens: Some rug pull contracts include a hidden “honeypot” function that allows buying but not selling. Before investing in any new token, use a honeypot checker tool. Send a very small test amount and try to sell it. If you cannot sell, walk away immediately.

4. No audit: Reputable projects have their smart contract code independently audited by firms like CertiK, Trail of Bits, or Hacken. An audit is not a guarantee of safety, but its absence is a meaningful red flag. No established auditor would sign off on code containing theft mechanisms.