CoinVado
CoinVado.com
Scam Guide View guide → Home：Wallet Security Guide →
Rug Pull scam concept illustration - a rug being pulled out from under crypto tokens and investors, symbolizing crypto exit scams and fraudulent projects.
Scam Guide • • • Author：CoinVado Research • 5 reads • 6 min

What is Rug Pull? How to Identify Scam Coins 2026 Guide

Complete 2026 guide to Rug Pull scams. Learn how to identify scam coins, meme tokens, and exit projects. Hands-on on-chain tools to check contracts, read audits, verify liquidity, and avoid getting rugged.

Table of Contents

What is Rug Pull?

Rug Pull — the name comes from the English idiom "pull the rug out from under someone" — suddenly yanking the rug from under someone's feet and making them fall. In the world of cryptocurrency, this term describes a malicious act where a project team carefully orchestrates a scheme and then abruptly absconds with investor funds.

A typical Rug Pull goes like this:

  1. The project team creates a new token contract (usually on BSC, ETH, or Solana)
  2. Spend a few hundred dollars on a website, whitepaper, and social media presence
  3. Recruit a few small KOLs to shill the project, build WeChat/Telegram groups to generate hype
  4. Provide liquidity on PancakeSwap or Uniswap and enable trading
  5. Retail investors see the price rising and FOMO in
  6. One day, the project team executes a "privileged" function in the contract — draining all liquidity, or minting massive amounts of tokens and dumping
  7. The token price crashes 99%+ in an instant, turning retail investors' holdings into worthless paper
  8. The project team disappears with the money, only to rebrand and do it all over again

The harsh truth is: Dozens of Rug Pull projects launch every single day. Most people never even get a chance to spot them before they're already rugged.

Five Common Types of Rug Pull

1. Liquidity Withdrawal

This is the most classic Rug Pull. The project team creates a trading pair on a DEX (Decentralized Exchange) and adds liquidity. After users have bought in heavily, they call a privileged function to transfer all funds from the liquidity pool to their own wallet.

Once liquidity is drained, the token can no longer be bought or sold — even if you still hold tokens in your wallet, they are worth nothing.

Typical signs:

  • Liquidity is not locked, or the lock-up period is extremely short (a few days)
  • The contract contains special functions like withdraw() or removeLiquidity()
  • The liquidity pool is shallow (under $100,000)

2. Unlimited Minting / Backdoor Mining

The project team leaves a minting function that only the admin can call in the contract. After a large amount of user funds has poured in, the project team uses this function to issue a massive number of tokens and then dumps them on the market.

Your tokens become infinitely diluted as the supply explodes, and the price has no bottom.

Typical signs:

  • The contract has no maximum supply cap
  • There is a Mint function with special admin permissions
  • The team address holds a large amount of unlocked tokens

Rug Pull scam process flow illustration, showing the complete chain from project creation to liquidity withdrawal to token crash, dark warning-style palette

3. Honeypot

This is the nastiest Rug Pull variant — you can buy, but you can never sell.

The project team writes code into the contract that restricts selling. When you see the price going up and try to sell, the transaction keeps failing ("execution reverted"). Meanwhile, the project team and whitelisted users can sell normally. Your money was doomed the moment it went in.

Typical signs:

  • Buy slippage is normal, but sell always fails
  • The contract contains _isBlacklisted() or abnormally high sell fee code
  • Among holder addresses, the top addresses keep buying but never sell

4. Token Ownership Abuse

Some projects set high buy/sell taxes upfront (e.g., 20%), creating the illusion that "the team is building for the long term." But the contract has a updateFees() or similar privileged function hidden in it. Once enough funds accumulate in the pool, the project team sets the tax to 100%, trapping everyone's assets in the contract.

Another variant is that the Owner can pause trading at any time (pause function), creating a "technical glitch" to prevent users from selling.

Typical signs:

  • The contract has special privileged functions (Owner-only)
  • The project team has not renounced contract ownership
  • The contract has a pause/emergency stop function

5. Fake Audit / Fake KYC

This is actually one of the most common Rug Pull tactics — deceiving user trust.

The project team pays an unknown third-party "audit" firm for a report (or simply forges one), then loudly proclaims on their website that they "passed a Certik audit" (which is fake). Some project teams even hire people to pose as "verified KYC individuals," when in reality those identities are stolen or purchased.

Typical signs:

  • The project name in the audit report differs from the actual project
  • The audit firm is a little-known, obscure institution
  • The KYC certification cannot be verified through official channels
  • The so-called "team member identities" can't be traced to real people online

Common Characteristics of Scam Coins

Not every scam coin will Rug Pull, but every Rug Pull project is essentially a scam coin at its core. Identifying scam coins early is your first line of defense against Rug Pulls.

Here are the ten most common signs of a scam coin:

Feature Description Risk Level
❌ Anonymous Team No public info or LinkedIn profiles for team members ⚠️ High Risk
❌ Copied Whitepaper Whitepaper content directly copied from other projects ⚠️ High Risk
❌ Over-the-top Marketing A flood of "100x gem," "next SHIB" slogans everywhere ⚠️ Medium Risk
❌ Suspicious Audit Report Unknown audit firm or overly vague audit content ⚠️ High Risk
❌ Unlocked Liquidity Liquidity lock-up period less than 6 months or no lock at all 🔴 Extreme Risk
❌ Concentrated Holdings Top 10 addresses hold over 80% of the token supply 🔴 Extreme Risk
❌ Unverified Contract Contract source code is not open to the public 🔴 Extreme Risk
❌ Social Media Bots Telegram group full of bot messages and spam ⚠️ Medium Risk
❌ No Actual Product Only concepts and promises, no working product ⚠️ High Risk
❌ Unrealistic Returns Promises of "guaranteed returns," "1% daily" 🔴 Extreme Risk

A simple rule: If any 3 of the above apply, this project is high risk — walk away immediately.

Real Case Studies

Case 1: Squid Game Token (2024)

After Netflix's "Squid Game" exploded in popularity, a wave of identically-named tokens emerged. The most notorious one launched on Uniswap, skyrocketing hundreds of thousands of times in a few days and attracting massive FOMO buying from retail investors.

Then one day, all holders suddenly found that they could no longer sell the token. The price crashed from its peak to nearly zero. The project team made off with approximately $3.38 million in liquidity before vanishing.

Victims: Over 40,000 investors Losses: Approximately $3.38 million Key takeaway: 99% of hype-chasing, meme-chasing projects are scams; any token without a real product is just hot air.

Case 2: Frozenog (2025)

A "gaming + DeFi" project launching on BSC, claiming to build a blockchain-based metaverse game. The website was beautifully designed, the whitepaper looked professional, and several mid-tier KOLs promoted it. TVL once reached $20 million.

A month after launch, the project team used a mint() backdoor function in the contract to mint $12 million worth of tokens in one shot and dumped them. By the time the community noticed, it was too late — the token price crashed 99.7%.

Victims: Approximately 12,000 investors Losses: Over $20 million Key takeaway: A polished website does not mean a real project; even with high TVL, you must check whether the contract permissions are secure.

Case 3: A Chinese "Meme Token" Project (March 2026)

This was a textbook Chinese "meme token" project — aggressively promoted in WeChat groups and crypto communities, claiming to be "community-driven" with a "fair launch." After launching on PancakeSwap, the token surged over 50x in three days, with the community in a frenzy.

However, eagle-eyed users noticed that the project team's wallet address was selling off in batches every time the price pumped, and the amount of tokens in that wallet far exceeded the publicly stated "team allocation." On the fourth day, the project team posted a "thank you for your support" message in the group, then deleted all communities and drained approximately $5 million from the liquidity pool.

Victims: Over 8,000 investors Losses: Approximately $5 million Key takeaway: "Community-driven" without locked liquidity is just a fancy way of saying "the team can run at any time."

Step-by-Step: The Four-Step Identification Method

Before investing in any token, spend 10 minutes going through the following four checks — this will filter out over 95% of Rug Pull projects.

Step 1: Check the Contract

Find the token contract address on Etherscan, BscScan, or Solscan.

What to check:

  • ✅ Is the contract source code open?
  • ✅ Is the source code verified?
  • ✅ Are there any special privileged functions in the contract (onlyOwner, mint, pause, blacklist)?
  • ✅ Does it contain honeypot-like code?

Recommended tools:

Step 2: Check Liquidity

Liquidity is the foundation for a token to trade normally. Liquidity withdrawal is the most common Rug Pull technique.

What to check:

  • ✅ Is the liquidity locked?
  • ✅ Lock-up expiration — at least 6 months or more to be safe
  • ✅ Total liquidity pool value — be highly cautious if under $50,000
  • ✅ Project team's share of the liquidity pool — if over 50%, they can drain it at any time

Recommended tools:

Pre-investment checklist illustration: four check items including contract audit, liquidity lock, holder distribution, and community activity, blue safety theme

Step 3: Check Holder Distribution

The distribution of holder addresses can reveal whether a token is heavily controlled by a "whale" or market maker.

What to check:

  • ✅ How much do the top 10 addresses hold? Over 80% is a warning sign
  • ✅ Does the team/project address hold a large position?
  • ✅ Is there an address continuously buying large amounts (possibly the project team manipulating the market)?
  • ✅ Does the holder count grow organically?

Recommended tools:

Step 4: Check Audit and Community

What to check:

  • ✅ Is there a complete audit report from a reputable audit firm?
  • ✅ Does the audit report list risks? Are the risks acceptable?
  • ✅ Verify the audit report's authenticity — check on the audit firm's official website, don't just look at the PDF provided by the project
  • ✅ Are community members real people? Is there reasonable discussion in Telegram/Discord?
  • ✅ Are the team's LinkedIn or GitHub profiles genuine and trustworthy?

Reputable audit firms:

  • Certik — Industry's highest standard
  • SlowMist — Top-tier Chinese security team
  • Hacken — Renowned European firm
  • OpenZeppelin — Smart contract security standard

If the project hasn't been audited by any reputable firm, do not touch it under any circumstances. An audit (costing $5,000–$50,000) is the most basic investment any legitimate project should make. Projects that skip auditing either don't have the money, or intentionally avoid it (because the audit would expose their backdoors).

7 Iron Rules to Avoid Rug Pulls

  1. Never invest in projects without a reputable audit — no Certik/SlowMist/Hacken audit report? Treat it as if the project doesn't exist.
  2. Never invest in projects with unlocked liquidity — liquidity locked for less than 6 months? Treat it as a scam coin.
  3. Never invest in projects with anonymous teams — if they won't even show their faces, who will you chase when they run?
  4. Never invest in pure hype-chasing meme tokens — Squid Game tokens, animal coins of all kinds... here today, gone tomorrow.
  5. Never use funds you can't afford to lose — even after all checks, unknown risks still exist.
  6. Test with a small amount using a fresh wallet — before investing, buy the minimum amount and test if you can sell (check for honeypots).
  7. Check approvals regularly — for long-term holdings, check the token contract status once a month for any changes.

What to Do If You Get Rugged

If you've already been Rug Pulled, time is money. Act fast:

  1. Sell immediately to cut losses — if the token is still tradeable (liquidity hasn't been fully drained), sell at the current price immediately, even if it's down 99%. Every dollar you recover counts.
  2. Revoke contract approvals — immediately use Revoke.cash to revoke all approvals for the project's contract. Even if the token is already worthless, the malicious contract may still have permission to take other assets from your wallet (like USDT, ETH).
  3. Flag the scam address — mark the project team's address as "Fake_Phishing" or "Scam" on the blockchain explorer to help other users avoid falling for it.
  4. Gather evidence and report to authorities — save all transaction hashes, social media screenshots, group chat records, etc. While the chance of recovery is extremely low (funds usually flow through mixers or privacy chains), filing a report helps with future维权 (rights protection) and industry regulation.
  5. Warn the community — post an alert in the community (with the scammer's address) to prevent more people from being scammed.

The biggest lesson: If you don't invest, you can never lose. For small investors, the best way to avoid Rug Pulls isn't learning to identify them — it's fundamentally avoiding high-risk, non-mainstream tokens altogether. Buy mainstream assets on top-tier exchanges like Binance, OKX, etc., and over 99% of people will never encounter a Rug Pull problem.

Further Reading

FAQ

Q1: What is a Rug Pull scam?

A: A Rug Pull is one of the most malicious scams in DeFi. The project team creates a seemingly legitimate token project, uses marketing to attract investor funds, then at some point suddenly drains all liquidity from the pool or mints massive amounts of tokens through a contract backdoor, causing the token price to crash to zero and leaving investors with nothing.

Q2: What's the difference between a scam coin and a Rug Pull?

A: A scam coin refers to a token with no real value backing, purely driven by hype — essentially a zero-value speculative instrument. A Rug Pull is a malicious act deliberately carried out by the project team. Not all scam coins will Rug Pull (some just naturally die off when hype fades), but Rug Pulls are 100% intentional fraud. The two often overlap: scam coin + Rug Pull = worst case scenario.

Q3: How can I tell if a token is a scam coin or Rug Pull project before investing?

A: Four-step verification: 1) Check the contract — use BscScan/Etherscan to see if the source code is verified, if there are mint functions or special permissions; 2) Check liquidity — use DEXTools or PooCoin to check liquidity lock ratio and lock duration (less than 6 months is a red flag); 3) Check holder distribution — if the top 10 addresses hold over 80%, it's likely market manipulation; 4) Check the audit — look for a complete audit report from reputable firms like Certik, SlowMist, or Hacken, not just a so-called "audit" done by the project team themselves.

Q4: What should I do if I've been Rug Pulled?

A: Act immediately: 1) If the token is still trading on a DEX, sell right away to cut losses (even if the price has already dropped 90%); 2) Revoke all approvals for the project's contract (use Revoke.cash); 3) Hide or block the token in your wallet to prevent accidentally signing malicious contracts later; 4) Mark the project team's address as a scam address on the blockchain explorer; 5) Save all transaction records and chat evidence, then report to local authorities. But honestly, Rug Pull funds are almost never recovered — prevention is the best protection.

Q5: What is a Honeypot?

A: A Honeypot is a variant of Rug Pull. The project team writes code into the token contract that restricts selling — you can buy in, but you cannot sell out. Once purchased, your funds are permanently trapped. How to identify: Test buy/sell slippage on PooCoin or DEXTools. If buying works but selling directly fails, it's a honeypot. You can also use Honeypot.is to check the contract.

Q6: How do I check for backdoors in a contract on Etherscan?

A: On Etherscan (or BscScan), go to the token contract page, click "Contract" → "Read Contract" to view the public function list, then click "Contract" → "Write Contract" to view write functions that require permissions. Key things to look for: mint() (token creation), pause() (pause trading), functions with the ownerOnly modifier, and blacklist() (blacklist functionality). If you see these, the project team has privileged control over the contract.

Q7: What is a "honeypot token" and how do I detect one?

A: A "honeypot token" is a malicious token where the contract code intentionally includes logic that restricts selling. Regular users cannot sell after buying — only the project team or whitelisted addresses can trade. Detection methods: 1) Use Honeypot.is with the token address for automatic detection; 2) Check on DEXTools for abnormal buy/sell slippage; 3) First buy the minimum quantity and test if you can sell.

Q8: Are all tokens on decentralized exchanges (DEX) unsafe?

A: No. DEXs themselves are secure, neutral platforms (like Uniswap, PancakeSwap). The problem is that anyone can list a token on a DEX without any screening. Legitimate quality projects also launch on DEXs, but typically they have thorough audits, liquidity locks, and transparency measures. The key is to judge the quality of the token itself, not to dismiss it just because it's on a DEX.

Q9: What is a "Soft Rug Pull"?

A: A Soft Rug Pull is when the project team doesn't directly drain liquidity, but instead slowly siphons value by gradually reducing their holdings, selling unlocked team tokens, or stopping project maintenance. This tactic is harder to detect and define because the team hasn't technically committed outright wrongdoing. How to identify: Monitor changes in the team wallet address, continuously track token supply changes, and pay attention to whether project development is progressing steadily.

Disclaimer: This article is for educational and reference purposes only and does not constitute investment advice. Cryptocurrency investment carries risk. Please make informed decisions based on your own circumstances.