What Is Rug Pull in Crypto and How to Spot One
Learn what is rug pull in crypto, how scammers drain liquidity, the warning signs to watch for, and practical strategies to protect your portfolio.
GeckoScreener Team
Aug 8, 2026 · 14 min read
Updated 8 days ago
A rug pull is a crypto exit scam where insiders drain liquidity or dump holdings, leaving investors unable to sell. In 2021, rug pulls accounted for 37% of all cryptocurrency scam revenue, and total rug-pull proceeds exceeded $2.8 billion (Chainalysis).
Table of Contents
- The Scale of the Rug Pull Problem
- The Mechanics of Rug Pulls
- Warning Signs and Risk Indicators
- Real-World Rug Pull Case Studies
- How to Screen Tokens Before You Trade
- Rug Pulls Versus Legitimate Project Failures
- Your Pre-Trade Security Checklist
The Scale of the Rug Pull Problem
Rug pulls are not edge cases. They moved from a niche DeFi scam into a major source of crypto fraud in a single year, with 37% of all cryptocurrency scam revenue in 2021 and more than $2.8 billion in proceeds tied to rug pulls (Chainalysis). That shift matters because it shows a structural change in how scammers monetize token launches, not just a wave of isolated incidents.
The mechanism is simple, even if the packaging isn't. Insiders raise capital, control the liquidity or the contract, then remove the market structure that lets buyers exit. Once the sell path disappears, the token can still sit in a wallet, but it's functionally stranded.
Why the problem scales so fast
The reason rug pulls spread so quickly is that decentralized token markets make creation and abandonment cheap. A project can launch, attract attention, and disappear before many buyers have time to inspect the contract or the holder structure. That's especially dangerous in markets where social proof, momentum, and low-friction trading can replace real due diligence.
A later Solana study formalized the scam more precisely. It defined rug pulls as projects that combine an abrupt and near-total liquidity withdrawal, a stop in meaningful on-chain activity, and a collapse in price or volume to a negligible state. That definition is useful because it separates fraud from a normal market drawdown.
Practical rule: if the market can't support an exit, the token is already broken, even if the chart still looks alive.
A 2026 analysis of major Solana decentralized exchanges found 76,469 rug-pull scam tokens out of 100,063 newly issued tokens in the first half of 2025, or about 76% of new listings in that sample (Security Scientist). Another summary of that research described the same period as nearly three quarters of new Solana tokens being rug-pull scams in the sample. Those numbers don't mean every chain is identical, but they do show that scam density can become extreme in fast-moving token markets.
The broader lesson is straightforward. A rug pull isn't just a failed idea or a weak token. It's a fraud pattern built around control of liquidity and market access, and that makes it a trading risk you have to screen for before entry.
The Mechanics of Rug Pulls
A rug pull usually depends on control over one of two choke points. The first is liquidity removal from a decentralized exchange pool. The second is an owner-controlled sell restriction written into the token contract itself (YouTube). Both routes end the same way, a holder is left with a position that cannot be exited on fair terms.
Liquidity removal from a DEX pool
In the classic setup, insiders seed a token pair with a base asset such as ETH, then market the new token so buyers rush in. Once enough capital accumulates in the pool, they withdraw the paired liquidity. The token may still exist, but the pool no longer has depth, so there is nowhere meaningful to sell.
That structure explains why DeFi is such a common venue for rug pulls. CoinMarketCap notes that they're “almost unheard of on centralized exchanges” but happen frequently in DeFi (CoinMarketCap). The market structure matters more than the branding. If insiders control the liquidity, they control the exit.
Contract-level sell traps
The second mechanism is more technical, but the effect is just as severe. A smart contract can be coded so only the creator can sell, or so regular holders can't transfer out. Buyers think they own a liquid token, but the contract blocks the one action that matters most.
If a token lets you buy but makes selling impossible, it's not a market. It's a trap.
The visible symptom is price collapse. The underlying damage is the loss of market function. Once liquidity is gone, or transfers are restricted, the token can't behave like a tradable asset anymore. Holders usually discover the scam only when they try to exit.
A useful way to read the setup is to separate market depth from transfer rights. If liquidity sits in a pool the team can drain, the chart can still print trades right up until the pool empties. If the contract can block sales, the token can appear active while exit access is already gone. Traders who want to verify those conditions before entering can compare token behavior with on-chain chart data using how to read crypto charts.
Video reference for the underlying mechanics:
Warning Signs and Risk Indicators
The strongest rug-pull signals tend to appear together, not in isolation. Anonymous teams, liquidity that can be withdrawn, high wallet concentration, and missing audit evidence are the core technical and behavioral markers to check first (Binance). None of those alone proves fraud, but when several line up, the risk changes fast.
What to weigh before you enter
A lot of traders overreact to one red flag and ignore the rest of the structure. That's the wrong approach. Anonymous founders can exist in legitimate projects, and new tokens can launch with concentrated supply for innocent reasons, but those same traits also make a clean exit scam much easier.
The better method is to stack the signals:
- Anonymous or unverifiable team: If nobody can be identified, there's little accountability if the project vanishes.
- Liquidity not secured: If liquidity isn't secured for a meaningful period, insiders may be able to remove it at any time.
- High wallet concentration: If a few wallets control a large share of supply, dumping pressure can be concentrated and sudden.
- Missing audit evidence: If the contract hasn't been reviewed, buyers may be exposed to hidden permissions or backdoors.
Internal permissions matter too. Security guidance consistently points to hidden functions such as creator-only withdrawal paths, sell restrictions, or transfer controls. Those are the exact levers scammers use to trap buyers after launch.
How to screen the control points
The right question isn't “does this token have one red flag?” It's “who can change the rules, and what happens if they do?” That means checking holder distribution, liquidity-lock status, and contract permissions before trade entry. A token with weak transparency, concentrated control, and no credible audit deserves far more skepticism than a token with just one awkward feature.
For a practical read on chart context alongside these checks, see how to read crypto charts. Chart structure won't prove fraud by itself, but it can show whether a move is supported by real participation or just by a temporary burst of attention.
Best practice: treat every new token as guilty of bad structure until it proves otherwise.
That sounds harsh, but it's the correct default in low-liquidity markets. If the team is hidden, the liquidity is loose, the supply is concentrated, and the code can't be independently checked, the market has handed insiders too much control.
Real-World Rug Pull Case Studies
The clearest way to understand rug pull mechanics is to examine how apparent legitimacy is built before the exit. Projects often launch with active social channels, influencer promotion, and visible trading, which makes the collapse feel sudden to late buyers. On-chain records usually show the structure was fragile long before the liquidity disappeared.
The pattern traders miss
The 2021 SQUID token collapse is one of the most cited examples because the exit mechanics were visible after the fact. The token traded into heavy attention, then the team drained liquidity and buyers were left with tokens they could not realistically sell. The lesson is straightforward. Price action can look active while the actual exit path is already under insider control.
The social layer can still look persuasive even when the structure is broken. A busy Telegram group, repeated influencer mentions, and a fast-moving chart can create the impression of demand, but those signals do not answer the hard questions. Who owns the supply? Who controls the pool? Can holders sell?
What on-chain evidence tends to show
The 2021 Meerkat Finance incident on BSC showed how quickly control over a treasury or liquidity path can change the outcome. After the exploit, analysts traced a large withdrawal from the project's funds, and the market treated the event as a collapse of trust rather than a normal price drawdown. That distinction matters because the chain can separate a failed trade from a controlled drain.
On-chain evidence usually points to a narrow set of structural faults. Wallet concentration can show that insiders never distributed supply to the market in a meaningful way. Liquidity status can show that the pool was not protected long enough to support normal trading. Contract permissions can show that the creator retained the ability to block exits, alter behavior, or move funds.
That is why a rug pull often looks less like a sudden market accident and more like a controlled shutdown. The token may trade normally for a short window, then the liquidity moves, the price collapses, and activity stops. The project did not merely disappoint, it lost the market structure that made trading possible.
Why pattern recognition matters
Rug pulls are rarely identical, but the control logic is consistent. Buyers are encouraged to treat early traction as proof of quality while the people in charge keep the levers that matter most. When liquidity is thin and distribution is narrow, a few insiders can decide when the exit closes.
A lively launch does not make a token safe. On-chain control beats social momentum every time.
For traders who want to test those control points before entering a position, a structured screen using crypto market analysis tools can help separate visible hype from actual transferability and liquidity risk.
How to Screen Tokens Before You Trade
A good pre-trade workflow starts with the contract, not the narrative. Before risking capital, check whether the token gives insiders power over liquidity, transfers, taxes, or supply changes. The point is to test whether the market is open enough to let you exit on your own terms.
What to inspect first
Begin with the basics that affect tradeability:
- Liquidity lock status: Locked liquidity is not a guarantee of safety, but absent a lock is a direct warning that insiders may be able to remove depth.
- Holder distribution: If a few wallets dominate supply, the token can be dumped or manipulated faster.
- Contract permissions: Creator-only sell paths, blacklists, pause functions, and hidden minting rights deserve immediate scrutiny.
- Audit evidence: No audit doesn't prove fraud, but it leaves you without independent proof that the code is clean.
A screening tool is useful when it helps you reduce the question set before you trade. GeckoScreener's crypto market analysis tools are relevant here because the objective is not speed for its own sake, it's compressing the time between token discovery and structural review.
Build a repeatable habit
Traders get into trouble when they rely on sentiment, then ask questions after the position is open. A better process is to screen every token the same way and reject anything with unclear control points. That doesn't require perfection, just consistency.
Rule of thumb: if you can't explain who can move the liquidity, you don't understand the trade.
That mindset also keeps you from confusing a fast-moving market with a safe one. A strong candle can still be built on a weak structure. What matters is whether the token can survive scrutiny on ownership, liquidity, and permissions before you buy.
Rug Pulls Versus Legitimate Project Failures
Not every collapse is fraud. In 2025 to 2026 market conditions, that distinction matters more because scams overlap with memecoin hype, influencer promotion, and low-float launches. A token can fail because demand never materialized, or because insiders removed the market structure and left buyers trapped.
The difference is control
A legitimate failure usually comes from weak adoption, bad timing, or poor token design. A rug pull comes from someone in control of liquidity or the contract taking action that prevents normal exits. That's the line that matters.
The confusion gets worse because some red flags are common in both settings. Anonymous teams appear in real early-stage projects. Liquidity that is not locked can exist in experimental launches. High concentration can happen before wider distribution. Those traits are warnings, but they're not proof by themselves.
How to separate fraud from bad outcomes
The practical test is to ask whether the collapse involved deliberate control. Did liquidity disappear? Did the contract block selling? Did the team vanish after taking funds? If the answer to one of those is yes, the event looks much closer to fraud than to a normal market failure.
That distinction helps traders avoid a common mistake. People often label every ugly chart a scam, then miss the structural evidence that matters. A failed project can go to zero without being a rug pull, but a rug pull always leaves evidence of control somewhere in the path to collapse.
The smartest approach is to combine signals instead of overreacting to one of them. If the team is anonymous, the liquidity is freely available, the supply is concentrated, and the contract is opaque, the odds of fraud rise fast. If only one of those is true, you still need caution, but you don't yet have enough to call it a rug pull.
Your Pre-Trade Security Checklist
A repeatable pre-trade process beats intuition. Before entering any new token, verify who controls the liquidity, who can change the contract rules, and whether the holder structure looks reasonable. If those checks don't hold up, the trade isn't cheap, it's exposed.
Rug Pull Risk Assessment Matrix
| Warning Sign | Risk Level | Action to Take |
|---|---|---|
| Anonymous or unverifiable team | High | Pause until identity, track record, or credible proof appears |
| Unlocked liquidity | High | Avoid entry unless there's a clear, verifiable lock structure |
| High wallet concentration | High | Review holder distribution and size down or skip the trade |
| Missing audit evidence | High | Treat as unresolved code risk and demand more verification |
| Opaque contract permissions | Very High | Reject until you can confirm sell rights, mint rights, and admin controls |
The matrix is blunt for a reason. Rug pulls are built around control, and control usually shows up in the same few places: liquidity, permissions, and wallet ownership. If those points are unclear, you're not late to an opportunity, you're early to a problem.
For broader risk discipline, how to set stop loss is a useful complement to pre-trade screening. A stop loss can't prevent a rug pull, but it can reduce the damage when a token's structure breaks after entry.
Final check: if you can't verify the exit, don't trust the entry.
GeckoScreener gives traders a way to screen crypto markets with technical filters, candlestick pattern detection, and strategy validation in one place. If you're checking tokens for liquidity risk, wallet concentration, or contract structure, visit GeckoScreener and use it as part of a stricter pre-trade review before you put capital at risk.
GeckoScreener Team
Written for the GeckoScreener community. Join us on Telegram →
Start screening cryptocurrencies for free
Apply strategies like this one in real-time across 250+ coins.
Try GeckoScreener →