How to Detect Honeypot Tokens 2026: A 5-Step Checklist to Avoid Getting Trapped

📋 Table of Contents

• TL;DR Summary
• What Is a Honeypot Token? The Code Trap You Can Enter but Not Leave
• 6 Common Honeypot Variants: There's More Than One Trick
• Honeypot vs Rug Pull: Know the Difference Before You Defend
• The 5-Step Pre-Buy Checklist: One Red Flag and You Stop
• Detection Tools, Compared
• You Already Bought a Honeypot — Now What
• After You Get Scammed: 3 Things Not to Do, 2 Things to Do
• The Bottom Line: Two Counter-Intuitive Truths
• FAQ
• About the Author

TL;DR Summary

A honeypot token is a scam in one sentence: it lets you buy in, but it won't let you sell. The contract hides a blacklist, a sell check, or a 95-100% sell tax, and your money is trapped the moment you buy. Before buying any new coin, run this 5-step checklist: ① scan the contract with Honeypot.is and GoPlus ② check the buy/sell tax ③ check whether liquidity is locked ④ check holder concentration ⑤ buy a tiny amount and immediately try to sell — one red flag means stop. Remember two counter-intuitive truths: an open-source contract is not a safe contract, and a rising price does not mean you can actually sell. ¹²

What Is a Honeypot Token? The Code Trap You Can Enter but Not Leave

A honeypot token is a malicious coin whose contract is written to let funds in but not out — one of the most common on-chain scams. To a casual buyer it looks normal: you can buy, the chart is going up, everyone is aping in. But underneath, the contract does one thing: stops you from selling.

Scammers rely on three main mechanisms:

• Blacklist/whitelist: the contract keeps an address list. Whitelisted addresses (the team) can trade freely; everyone else is blocked from selling after they buy. The price action you see is often the team itself painting the chart;
• Sell-function checks: the sell function is gated by conditions such as "you must hold a whole number of tokens," "you must hold for N days," or "you must hold another token." If you can't satisfy the condition, the contract rejects your sell;
• 95-100% sell tax: the token doesn't block selling outright, but takes 95-100% of the proceeds as tax. Selling wipes you out, which is the same as not being able to sell at all.

In Chinese crypto communities this kind of coin is nicknamed a "貔貅币" (píxiū coin) — after the mythical creature that only consumes and never excretes. Detecting a honeypot is essentially detecting a contract that only lets value in, never out.

6 Common Honeypot Variants: There's More Than One Trick

A honeypot isn't a single piece of code — it's a family of "block-your-sell" tricks, at least 6 of them, and the later ones get increasingly sneaky. Know all of them so you know what to look for.

1. Sell-tax honeypot: a 95-100% sell fee. Looks sellable, but selling means losing almost everything. The classic, and the easiest to detect;
2. Whitelist/blacklist honeypot: the contract keeps an address list and blocks non-listed addresses from selling. They let you buy early, then update the list once you're in;
3. Modifiable-tax honeypot: the team keeps the power to change parameters and can raise the tax from 5% to 100% at any moment. This is the nastiest one — a contract that can change its tax can lock your money at any time;
4. Time-based honeypot: the contract is hardcoded to flip its state at a specific moment. "It traded fine at launch, then suddenly I couldn't sell days later" is usually this variant;
5. Targeted-address honeypot: a 100% tax is applied only to specific addresses (whales, or addresses that bought big). Small buyers look fine until they buy more and get trapped;
6. Combined honeypot: honeypot plus liquidity drain stacked together. Lock the sellers in with a honeypot, build up the pool, then pull the rug for a double payday.

The first two show up in a simple scan. The last four require you to read contract permissions and sell taxes — which is exactly the habit the 5-step checklist below builds.

Honeypot vs Rug Pull: Know the Difference Before You Defend

First, get the concepts straight: a rug pull empties the pool, a honeypot locks you in, and a "trap token" is just another name for a honeypot. Mixing these up leads to mixing up your defenses.

Scam type	Core mechanism	What happens to you	How to spot it
Honeypot (trap token)	Contract blocks or punishes selling	You can buy but can't sell; money stuck	Sell tax, contract permissions, test-sell
Rug pull	Team drains the liquidity pool	You still hold the coin, but it's worth zero	Liquidity lock status
Honeypot + rug pull combo	Block selling first, drain pool later	Can't sell, then worth zero	Check both

For a deeper look at rug pulls, see how to identify scam coins and exit scams. This guide focuses on the honeypot side. The outcome is the same either way — your money is gone — but you check different things. Checking liquidity doesn't replace checking the sell tax.

The 5-Step Pre-Buy Checklist: One Red Flag and You Stop

Before buying any new coin — especially low-cap, meme, or freshly launched tokens — assume it's a scam and verify it against these 5 steps. This isn't meant to scare you off; it turns "should I buy?" into a repeatable checklist instead of a snap decision.

Step 0 (mindset): assume high risk by default. Deploying a token on-chain costs almost nothing, a scammer can spin up hundreds of contracts a day, and the vast majority of new coins exist to take your money.¹

Step 1: scan the contract. Open Honeypot.is or GoPlus Security and paste the contract address. Look at buy/sell tax, whether it's mintable, and whether the owner has blacklist or pause-trading powers. Walk away from anything with a sell tax above 10%, and be wary of "modifiable tax," "blacklist," or "pausable trading" flags.²³

Step 2: check the buy/sell tax. On the token page in DexScreener or DEXTools, look at buy/sell tax and trading status. If you see "selling disabled" or failing sell transactions, it's almost certainly a honeypot.⁴⁵

Step 3: check liquidity. Find out whether the liquidity pool is locked or burned. If it isn't, the team can drain the pool at any time — that's the other half of the risk.⁶

Step 4: check holder concentration. Open the token's holders page on Etherscan/BscScan. If a few top addresses hold an outsized share, or most of the supply sits with the team, the price is controlled by a handful of wallets that can dump or lock you out at will.⁷

Step 5: buy a tiny amount and test-sell (the ultimate test). All the tools above can be wrong, so a real test-sell is the last line of defense: buy the minimum (a few dollars), then immediately try to sell. If it goes through, you're fine; if it fails or takes 90%+, that's a confirmed honeypot.

Stop condition: if any of these five steps throws a red flag, stop. There is no "I'll buy a little first" — with a honeypot, any amount you buy is money donated.

Detection Tools, Compared

Tools reduce your cost of being wrong, but each has blind spots — the right way to use them is combined and cross-checked. Here's the set that covers the basics:²³⁴

Tool	What it does	Best for	Caveats
Honeypot.is	Scans a contract address for honeypot behavior and buy/sell tax	Everyone; the simplest option	Coverage is mainly EVM chains
GoPlus Security	Contract security scan with a list of risk items	Everyone	Free, multi-chain, fairly complete results
DexScreener / DEXTools	Charts, buy/sell tax, trading status, liquidity	Everyone	Check the "trading status" and sell-tax fields first
Token Sniffer	Scores a contract 0-100 for safety	Users with some experience	A low score doesn't always mean a problem — read the details
Etherscan / BscScan	Manually review contract permissions and holders	Advanced users	Most reliable, but you need to read the contract

Two misconceptions to correct: ① "the tool says safe, so it's safe" — tools only catch known patterns and can miss new tricks, which is why step 5 (test-sell) isn't optional; ② "my token shows a risk flag, so it's a scam" — some legitimate coins get flagged (e.g. "mintable") and are perfectly fine, so look at which specific alert fired, not just the score.

You Already Bought a Honeypot — Now What

If you think you bought a honeypot, first stay calm, and second, don't put another cent in. Panic leads to bad decisions — and the urge to "immediately fix it" after a loss is exactly what follow-up scammers prey on.

Work through these steps in order:

1. Test-sell with the minimum: it might just be high slippage or a high tax rather than a full lock. Sell a few dollars' worth and see if it goes through;
2. If you can sell, take the loss: even at a 10-20% tax, get out. Don't wait for a "recovery" — a honeypot will never let you recover;
3. Check the contract permissions: if the team holds "change tax" power, the lock is only a matter of time. Don't gamble on it;
4. Document everything: screenshot the on-chain transaction, contract address, and buy time. For larger amounts, report through the project's public channels and the exchange/wallet's official support. Recovery odds are tiny, but your record can protect others.

After cutting the loss, move your funds somewhere you fully control — an exchange or a self-custody wallet — instead of leaving them in a new token on-chain. Review the crypto wallet guide to confirm your assets sit in your own address.

After You Get Scammed: 3 Things Not to Do, 2 Things to Do

What you do after being scammed matters more than you think — because the scammers will come back for round two. Remember the "3 don'ts and 2 do's":

• ❌ Don't pay an "unlock fee" or "processing fee": anyone who DMs you offering to "recover your funds for a fee" is running a follow-up scam. Don't send another cent;
• ❌ Don't trust "official support" reaching out privately: real support never DMs you to resolve on-chain token issues. Anyone claiming to be a rep is a scammer;
• ❌ Don't average down: averaging into a honeypot does nothing except lose you more money;
• ✅ Do: record the evidence: save the transaction hash, contract address, and the project's social accounts for later reporting;
• ✅ Do: report through legitimate channels: contact the wallet/exchange's official support and the project's public community. For significant amounts, consider filing a report with your local police or regulators.

To learn more scam patterns, read the common crypto scams guide and the anti-phishing guide. Know the full playbook so you can spot the next one early.

The Bottom Line: Two Counter-Intuitive Truths

Avoiding honeypots doesn't require reading code — it requires remembering two counter-intuitive truths. These are the two things this article most wants you to take away:

1. Open source ≠ safe. Open source just means you can see the code; it doesn't mean the code is honest. Many honeypots are precisely "openly hiding the trap";
2. A rising price ≠ you can sell. Honeypots use a fake pump to lure you in — the chart is bait. The moment you buy, the only one who can sell is the team.

The full action plan is three lines: run the 5-step check before buying, test-sell with a tiny amount after buying, and stop the moment anything looks wrong. Master this flow and you won't be avoiding "one specific scam" — you'll be avoiding every contract that's built to take value in and never let it out.

Who this is for: this checklist is aimed at on-chain users who come into contact with new coins, low-cap or meme tokens. If you only hold major coins like BTC/ETH, trade only on exchanges, and never touch unfamiliar tokens on-chain, you're unlikely to run into a honeypot and won't need most of these steps — though it's still worth reading once, because fake contracts impersonating major coins do appear. And don't treat this as a reason to avoid all DEX tokens outright: the goal is to filter out high-risk contracts, not to stop interacting on-chain.

⚠️ Risk warning: This article is educational on-chain security content, not investment advice. On-chain tokens (especially new low-cap or meme coins) carry extreme risk; detection tools can miss or falsely flag. Always verify contract and project details yourself before trading, and only use money you can afford to lose.

FAQ

Organized by real search queries, so you can find your case quickly.

Where do I see a token's buy/sell tax? Which page do I look at?

Open the token page on DexScreener or DEXTools — the buy/sell tax percentages are usually shown right next to the token symbol, or under the "transactions" / fees info panel; some tools flag "sell tax too high" directly. If the page shows sell transactions failing over and over, it's almost certainly a honeypot. An easier route is pasting the contract address into Honeypot.is, which lists the buy/sell tax figures for you.

If I bought a honeypot, can I get my money back? Does reporting to the police help?

In the vast majority of cases, no. Honeypot teams are anonymous and ready to vanish, on-chain transfers are irreversible, and no support desk will refund you. For significant amounts you can file a police report with on-chain evidence — cases can freeze linked accounts, but cross-border crypto tracing is hard and success rates are low. Never trust any third party offering to "recover your funds for a fee"; that's usually a follow-up scam.

What is an LP lock? Where do I check whether liquidity is locked?

An LP (liquidity pool) lock means the team has locked its LP tokens in a contract for a period, during which the pool's money can't be pulled out. If liquidity is "unlocked" or "not burned," the team can drain the pool at any time — the classic rug-pull setup. Check the Liquidity/Pool info panel on DexScreener or DEXTools, or look up the LP contract's lock record on BscScan/Etherscan.

A new coin is tiny but everyone is buying it — can I take a small position?

You can, but understand this is speculation, not investing: only use money you can afford to lose entirely, test-sell right after buying to confirm you can actually sell, and be mentally ready for the value to go to zero. Don't size up just because "the community is hyping it and it's pumping" — honeypots use exactly that to lure you in. Run the 5-step check first, and skip it if any step raises a red flag.

I can't read contract code — how do I check for backdoor permissions?

Three non-technical routes: ① scan with Honeypot.is/GoPlus for dangerous powers (modifiable tax, pausable trading, blacklist); ② check on DEXTools/DexScreener whether the team has renounced ownership — once renounced, parameters can't be changed and risk drops a notch; ③ look for an audit from a recognized firm. You don't need to read code; the key question is "what contract-changing powers are still in the team's hands?"

If I only buy major coins on exchanges, can I still run into honeypots?

Almost never. Coins listed on Binance, OKX, and similar exchanges go through platform review, so major coins like BTC/ETH aren't honeypots. Honeypots concentrate in unlisted new tokens on on-chain DEXs (PancakeSwap, Uniswap, etc.). If you only trade major coins on exchanges, your exposure is minimal — this checklist is mainly for people buying new tokens on-chain with a wallet.

About the Author

CoinVado Research is the content research team behind CoinVado, focused on blockchain education, on-chain data, and crypto risk awareness. We keep every data point verifiable and never fabricate facts, so newcomers can build a sound understanding of crypto security.

⚠️ Risk warning: This article is educational content and does not constitute investment advice. Detection tool results are for reference only and are not guaranteed to be accurate. Cryptocurrency investment and on-chain interaction carry extreme risk; please act according to your own risk tolerance.

---

📖 Related reading:

• Web3 Security Complete Guide 2026 — systematic security knowledge from private keys to contract approvals
• How to Identify Scam Coins and Exit Scams (Rug Pulls) — rug-pull detection, complementary to this guide
• Common Crypto Scams Guide 2026 — a broader breakdown of scam tactics
• Crypto Phishing Guide 2026 — fake sites, approval phishing, and fake support
• DeFi Contract Approval Security: Revoking Unused Approvals — practical guide to cleaning up token approvals
• On-chain Guide (CoinVado) — more on-chain data and crypto education

Footnotes

1. On-chain deployment facts: on Ethereum/BSC a standard ERC-20/BEP-20 contract can be deployed for a single transaction fee, with no audit or approval required — which is why large numbers of low-quality and malicious tokens exist on-chain. See CoinGecko's scam statistics and chain explorer documentation for background. ↩ ↩²

2. Honeypot.is (https://honeypot.is/) — public tool that detects honeypot contracts and buy/sell tax from a contract address. Verified accessible 2026-08-14. ↩ ↩² ↩³

3. GoPlus Security (https://gopluslabs.io/) — decentralized security data platform providing contract risk scanning APIs and a web interface. Verified accessible 2026-08-14. ↩ ↩²

4. DexScreener (https://dexscreener.com/) and DEXTools (https://www.dextools.io/) — on-chain token data platforms showing buy/sell tax and trading status. Verified accessible 2026-08-14. ↩ ↩²

5. Typical honeypot signatures (disabled sells/failed sell transactions, 95-100% sell taxes) from public contract security tool documentation and on-chain scam case analyses, verified 2026. ↩

6. Liquidity lock status is public on-chain data, queryable via DexScreener/DEXTools and chain explorers such as https://bscscan.com/. ↩

7. Holder distribution is queryable on the Token Holders pages of https://etherscan.io/ and https://bscscan.com/. Verified accessible 2026-08-14. ↩