A new crypto project’s growing community, rapidly rising price, and ambitious promises can seem reassuring. Behind that appearance, however, there may be a scheme designed to drain users’ funds or prevent them from selling their tokens.
Understanding a rug pull requires looking beyond the price chart. Control over liquidity, token distribution, and smart contract permissions can reveal more than a project’s promises.
What Is a Rug Pull, and How Does It Happen?
A rug pull describes a situation in which the people controlling a crypto project mislead users into committing funds, then extract value at those users’ expense. The term comes from the expression “pulling the rug out from under someone.”
While users trust the project, the liquidity or activity supporting that trust suddenly disappears. The process does not always follow the same pattern. The team may withdraw assets from a pool, prevent users from selling, or secretly sell its large token holdings. In some cases, several methods work together.
However, not every failed project or sharp price decline qualifies as a rug pull. Market conditions, technical failures, and insufficient demand can also cause losses. Assessing a potential rug pull requires examining misleading conduct, fund movements, and the use of control permissions.
Building trust and extracting funds
A crypto rug pull often follows these stages:
- A new token, platform, or investment concept is announced.
- Social media campaigns, partnership claims, and promises of returns attract attention.
- Users buy tokens or deposit assets into the protocol.
- Those in control withdraw liquidity, change selling conditions, or sell their holdings.
- Users cannot sell their assets or face substantial losses.
A professional website, busy community chats, and extensive advertising may all form part of this process. None of these features independently proves that a project is trustworthy.
What Are the Different Types of Rug Pulls?
Rug pulls can involve different technical and economic mechanisms. Understanding how users lose money also helps identify which checks matter.
Liquidity removal
Users on decentralized exchanges often trade through liquidity pools. For example, a pool pairing a token with USDC enables swaps between those two assets. If the project team controls most of the pool’s liquidity and its position is unlocked, it can remove that liquidity. This reduces the market depth available to users trying to sell, potentially increasing price impact and making sales economically impractical.
The token’s price does not have to fall to exactly zero. Alongside the amount of money in the pool, consider who can withdraw the liquidity and under what conditions.
Selling restrictions and honeypots
Some tokens appear available to buy but create obstacles when users try to sell. In arrangements known as honeypots, the contract may block certain addresses from selling or impose fees that consume almost all the sale proceeds.
For example, the system may allow only approved wallets to sell. Other users can see the price rising but cannot realize their gains.
Uniswap’s security documentation associates high selling fees, whitelist functions, and blacklist functions with these risks. However, a single failed transaction does not prove fraud.
Insufficient network fees, low liquidity, or transaction settings can also cause failures.
Team sell-offs and pump-and-dump schemes
If the team or affiliated wallets hold a large share of the supply, heavy selling can put pressure on the price. The risk increases when the distribution is concealed or actual transactions contradict public statements.
In a token pump-and-dump scheme, misleading promotion drives up the price, and the organizers sell into the resulting demand. This behavior can overlap with a rug pull, although the terms describe different mechanisms.
The people organizing a pump-and-dump do not necessarily develop the project or control its contract.
For example, the SQUID token capitalized on the popularity of the Netflix series Squid Game despite having no official connection to it. Following complaints that users could not sell, its price collapsed to almost zero within minutes, and the project’s website and social media accounts disappeared.
It remains one of the best-known rug pull examples associated with selling restrictions.
How Can You Assess Rug Pull Risk?
A single security badge or screening result is insufficient. Assess the project’s team, code, liquidity, and token economics together.
Research the team’s history and promises
Compare the team’s previous work, public statements, and development activity. Check whether a functioning product supports the technical claims in the whitepaper.
Having anonymous developers does not automatically make a project fraudulent. Likewise, using real names and photographs provides no guarantee.
What matters is whether independent sources can verify the claims and whether the team answers critical questions openly.
Check partnership announcements through the other party’s official channels. A company logo displayed on a project’s website does not establish a verified partnership.
Examine the scope of the liquidity lock
A liquidity lock can restrict withdrawals from a particular position for a specified period. Its scope matters as much as its existence:
- Which pool and liquidity position are locked?
- How much of the total liquidity does the lock cover?
- When does the lock expire?
- Can anyone withdraw early or intervene through administrative permissions?
- Can you verify the information using a block explorer?
Locked liquidity does not automatically prevent the team from selling its token holdings or abusing other administrative permissions. A “liquidity locked” claim therefore does not mean that all rug pull risks have disappeared.
There is also no universally safe amount or ideal percentage for Total Value Locked (TVL). TVL may include different assets across protocols and is not equivalent to liquidity immediately available for selling.
Check token distribution and administrative permissions
Block explorers help you examine major token holders and transfers. However, the number of addresses does not reveal the number of independent investors.
One person can distribute their holdings across many wallets. Try to identify whether large addresses belong to exchanges, bridges, burn mechanisms, or the project team.
Then examine the contract’s permissions, including whether anyone can mint new tokens, pause transfers, or change fees.
Verified source code means that the code is available for inspection; it does not prove that the code is safe. Assess claims of renounced ownership alongside token distribution and other control mechanisms.
Do not treat selling checks as a guarantee
Review transaction history to see whether different users can sell. Security tools may provide useful information about selling restrictions, but their results can be incomplete or inaccurate.
A successful small sale does not guarantee that future sales will remain possible. Contract conditions may change, or restrictions may apply to particular addresses.
Buying a suspicious token solely to test it can also expose you to losses. If transactions repeatedly fail, investigate the cause instead of continuing to retry; each attempt may incur additional network fees.
Read the details of the audit report
A smart contract audit allows specialists to examine code and design for security vulnerabilities. The review may cover logic errors, access controls, and risks associated with upgradeable contracts.
Do not rely solely on a claim that the project “has been audited.” Verify the report through the auditor’s own source, and check its date, the version reviewed, excluded components, and unresolved findings.
If the audited code differs from the deployed contract, the report has limited relevance. An audit also cannot guarantee the team’s future behavior or the token’s economic sustainability.
Investigate the source of returns
When you see a high APY, investigate where the rewards come from. Determine whether they rely on genuine usage fees, newly issued tokens, or funds deposited by new participants.
A falling token price can offset high returns paid through newly minted tokens. Arrangements that secretly use new participants’ money to pay earlier participants show signs of a Ponzi scheme.
Claims such as “guaranteed profits,” “no risk of loss,” and “join immediately” should prompt you to pause and investigate.
How Are Rug Pulls Treated Legally?
A rug pull is not a standalone criminal category defined under the same name in every country. Depending on the circumstances, it may involve fraud, market manipulation, or other legal violations.
A “hard rug” generally refers to directly extracting value through code or control permissions. A “soft rug” typically describes behavior such as heavy team selling or abandoning a project.
These are not formal legal classifications. Calling something a soft rug does not make it lawful.
For example, in an announcement dated October 7, 2026, the U.S. Department of Justice reported that the creator of Kishu Inu had been charged over an alleged rug pull involving misleading statements and concealed token sales.
What Should You Do If You Suspect a Rug Pull?
Your priority should be to stop new transactions that could increase your losses and preserve relevant records:
- Record transaction hashes, wallet addresses, dates, and amounts.
- Save the project’s promises, correspondence, and website addresses.
- Review suspicious token spending approvals and revoke them through trusted tools where necessary.
- If your recovery phrase has been exposed, do not rely solely on revoking approvals; consider moving your remaining assets to a new, secure wallet.
- Contact the relevant law enforcement or judicial authorities in your country and seek legal assistance where needed.
Revoking an approval does not restore withdrawn liquidity or recover lost funds. Also be wary of anyone demanding an upfront payment while promising to recover your money. The FBI warns that fake recovery services can target crypto fraud victims again.
Frequently Asked Questions
We hope you never encounter a situation like this, but recognizing the risks and knowing how to respond to suspicious activity matters. Below, we answer frequently asked questions about rug pull scams:
- Why are rug pulls commonly associated with DeFi projects?: Permissionless platforms can make it easy to create tokens and pools. A token’s availability for trading does not mean it has passed an independent security review.
- What is the difference between a rug pull and a pump-and-dump?: A rug pull generally involves people controlling a project extracting value. A pump-and-dump involves misleadingly inflating the price and selling into the resulting demand; both can occur in the same scheme.
- How can you check whether a token’s liquidity is locked?: Identify the correct pool address and examine the relevant lock contract and position using a block explorer. Verify the locked amount, expiry date, and withdrawal permissions.
- How is a smart contract audit conducted?: Specialists examine the code, architecture, and permissions using various analytical and testing methods. Users should verify that the published report is authentic and covers the contract actually in use.
- What legal options are available to rug pull victims?: Victims can submit transaction records and other evidence to the relevant authorities. The process depends on the country and circumstances; filing a report does not guarantee recovery.
- Is every project with anonymous developers a rug pull?: No. Anonymity alone is not proof; assess it alongside control permissions, transparency, token distribution, and verifiable activity.
When evaluating a project’s promises, consider potential returns alongside who controls the funds and the conditions under which you can exit. Follow JrKripto’s guides to learn about crypto security checks and make more informed assessments of digital asset risks.
