8 Ways to Check if a Token Is a Scam Before You Buy

A token scam is a token built to take money from buyers instead of delivering a working product. Most chains let anyone deploy a token in minutes with any name, ticker and logo, so there is no gatekeeper between a scammer and your wallet. The checks below work on Ethereum-style chains and, with small changes, on Solana and others.

The usual patterns are:

• Rug pull: the creator removes the liquidity from the trading pool, leaving buyers with tokens nobody will buy.
• Honeypot: the contract lets you buy but blocks or heavily taxes selling.
• Hidden mint or owner abuse: the owner can create unlimited new tokens, blacklist wallets, pause trading or change fees after you buy.
• Copycat token: a fake version of a real token that uses the same name and ticker but a different contract address.
• Airdrop bait: unknown tokens sent to your wallet to lure you to a phishing site or a harmful approval.
• Pump and dump: insiders hold most of the supply and sell into hype.

No single check catches everything, and passing all of them doesn't make a token a good investment, only less likely to be an outright trap. The eight checks are:

1. Confirm the contract address.
2. Read the contract on a block explorer.
3. Test for honeypots and taxes.
4. Inspect the liquidity.
5. Examine holder distribution.
6. Verify the team, audits and documents.
7. Watch trading and social behaviour.
8. Protect your wallet and limit your exposure.

This guide is educational, not financial advice. Crypto is volatile, and legitimate tokens can lose value too.

Fake tokens copy real names and tickers, so the first question is whether you are looking at the right contract. The token's name on a chart or in a wallet is not an identifier. The contract address on the correct chain is.

Steps

1. Open the project's official website, which you reached by a bookmark or a reliable source rather than a search ad or a message, and find the contract address in its documentation.
2. Cross-check that address against a second independent source, such as a major price-tracking site or the project's verified official channels.
3. Paste the address into the relevant block explorer and confirm the name, symbol, decimals and total supply match what the project describes.
4. Confirm the chain. Many projects have a native token on one chain and bridged versions on others, and each has its own address.
5. Compare activity. The genuine token normally has far more holders and transfers than lookalikes with the same ticker.

Red flags

• The address came from a reply, a direct message or a sponsored search result.
• Several tokens share the ticker and you can't tell which is official.
• The project's own site doesn't list a contract address at all.
• The token was created very recently but claims to be an established project.

For stablecoins and bridged assets, use the issuer's or bridge's own published address list. Bookmark the official pages once you have verified them, so you never have to search again.

A block explorer shows what a token contract can actually do, regardless of what the marketing says. You don't need to be a developer to spot the main warning signs.

What to look at

• Verified source code. If the explorer shows the contract as unverified, nobody can read what it does. Treat that as a serious red flag.
• Creation details. Note the creation date and the creator wallet, and look at what else that wallet has deployed. A history of abandoned tokens is a bad sign.
• Privileged functions. Look for owner-only functions such as mint, blacklist, pause trading, set fees or set maximum transaction limits. A power to change fees at will means the rules can change after you buy.
• Ownership. Check whether ownership is renounced or held by a multisig. Renouncing helps, but it doesn't cancel risky logic already built in.
• Upgradeable proxies. A proxy contract lets the owner swap the underlying code later. That isn't always malicious, since many legitimate protocols use proxies, but it means the code you reviewed may not stay the same.

On Solana, tokens work differently. Look at the mint authority, which allows creating more supply, and the freeze authority, which allows freezing holders' accounts. Revoked authorities are generally better for holders.

Automated scanners can give a quick first read of these properties. They are helpful but imperfect, so treat their score as a prompt for questions, not a verdict.

A honeypot is easy to enter and hard to leave, so test the exit before you commit real money.

Ways to test

1. Run the address through a honeypot or token-security checker. Most simulate a buy and a sell and report the tax on each, along with any failure.
2. Open the token's trade history on a decentralised exchange chart. Many buys with almost no sells, or sells that keep failing, point to a trap.
3. Look at the tax. High buy or sell taxes eat into your money, and a tax the owner can change at any time can be raised to near 100 percent after you buy.
4. If you still want exposure, try a very small buy followed by a small sell. The gas cost is tiny compared with losing a larger position.

Limits of testing

• Some scams let small sells go through and block large ones, or switch the trap on later.
• A scanner only shows the contract's state now. If the owner can change the rules, today's result may not hold tomorrow.
• Needing very high slippage settings just to sell is a warning sign in its own right.

Approvals

Never grant unlimited spending approval for a token you haven't vetted. Approve only the amount you need, and review the wallet's transaction preview before signing. A scam token can reach other assets in your wallet through an approval you gave it.

Most rug pulls work by draining the liquidity pool, so liquidity is the most important thing to inspect. If the pool is thin or the creator controls it, you may not be able to exit at any sensible price.

What to check

• Pool size. Compare the liquidity with the token's claimed market value. A huge valuation backed by a tiny pool means the price is easy to manipulate and impossible to sell into.
• Who holds the LP tokens. The tokens that represent a share of the pool decide who can withdraw the liquidity. If a single unlocked wallet holds them, it can remove the pool at any moment.
• Lock or burn status. Projects often lock the LP tokens in a locker contract for a stated period, or burn them. Locking services such as Team Finance exist for this. Open the lock record yourself, confirm that it points to the same pool as the token you are buying, and check the unlock date and the share of the pool that is actually locked.
• Lock length. A lock that expires in days offers little protection.
• Multiple pools. A project may lock one pool and leave a bigger one unlocked.

Remember

A locked pool stops the liquidity from being pulled, but it doesn't stop other abuse, such as unlimited minting or a sell tax set to extreme levels. Combine this check with the contract review.

Holder distribution shows who can crash the price. A token where a handful of wallets hold most of the supply is a pump-and-dump waiting to happen, however good the website looks.

How to read it

1. Open the token's holders tab on the block explorer.
2. Identify and set aside addresses that belong to the liquidity pool, a burn address, a locker contract or a known exchange. Those aren't insiders.
3. Look at the remaining top holders. If a few wallets together control a large share, expect heavy selling pressure.
4. Check where the top wallets got their funds. Many wallets that were funded from the same source at about the same time often belong to one person trying to look like a crowd.
5. Look for sniping, where wallets bought in the very first block of trading, which suggests insiders got in ahead of everyone.
6. If the team claims tokens are vested, find the vesting contract and read the schedule rather than relying on a promise.

Tools

Visual wallet-cluster tools can draw connections between holders, which makes hidden links easier to see. Treat their output as a lead to investigate.

Context matters

Some early-stage tokens are concentrated for legitimate reasons, such as treasuries, foundations and investor allocations. The question is whether the concentration is disclosed, vested and consistent with what the project says. Undisclosed concentration is the red flag.

Real projects usually leave a trail you can verify: named people, published code, documentation that goes into detail and audits you can trace.

Team

An anonymous team is not proof of a scam, since some respected projects began that way, but it removes accountability and should lower the amount you are willing to risk. Check whether named team members have verifiable histories on their own accounts and not only on the project's page.

Audits

1. Find the audit report on the auditing firm's own website, not just a logo on the project's site. Fake audit badges are common.
2. Check that the audited contract address or code version matches the one deployed.
3. Read the summary of findings and see whether serious issues were fixed or acknowledged.
4. Note the scope. An audit of one contract says nothing about the rest of the system.

Security firms such as Sherlock run audits, contests and bug bounties, and many reputable projects publish their reports. An audit reduces risk but can't guarantee safety, and it can't tell you whether the team will behave honestly.

Documents and website

• Whitepapers copied from other projects, or that never describe how the token has any use.
• Guaranteed returns or fixed daily yields.
• A very new domain, a copied site layout or a missing GitHub.
• A roadmap made of vague slogans with no technical detail.

Scams leave behavioural traces in trading patterns and community conduct.

On-chain signs

• Wash trading. The same few wallets trade back and forth in similar sizes to fake volume. High volume with few unique traders is suspicious.
• A chart that only goes up with no natural dips, followed by a sudden collapse.
• Very new tokens with sudden attention from accounts that mostly promote new launches.

Community signs

• Chats where criticism and questions are deleted or members are banned.
• Bots filling channels with excitement and screenshots of profits.
• Pressure language such as last chance, guaranteed or about to be listed.
• Unsolicited direct messages offering early access, giveaways or a private sale. Treat those as scams by default.

Unknown tokens in your wallet

Tokens you never asked for are usually bait. Don't visit their websites, don't connect your wallet to claim anything and don't try to sell them. Hide them in your wallet.

What an exchange listing means

Centralised exchanges such as OKX, Bitvavo, Gate and Bitget run their own listing reviews, and standards and token-selection policies differ between them. A listing suggests some screening, but it isn't a safety certificate, and listed tokens can be delisted or fall sharply. Check each exchange's own listing policy, and remember that exchange availability depends on where you live.

Even careful research can fail, so the last check is about limiting the damage if you are wrong.

Wallet habits

• Keep long-term holdings in a hardware wallet, and use a separate wallet with a small balance for new or unproven tokens.
• Read what you sign. If a transaction preview shows an unlimited approval or a request that doesn't match what you were trying to do, reject it.
• Be cautious with off-chain signature requests, which can authorise token movements without an obvious transaction.
• Never enter your recovery phrase on any website, and never share it with anyone, including people claiming to be support.

Approvals

Periodically review and revoke old token approvals using the approval checker on your chain's block explorer or a reputable revoke tool. Each approval you leave open is a standing permission.

Position size

Decide in advance how much you can afford to lose entirely, and keep each new token well inside that amount. Don't borrow to buy, and don't chase a price after it has already moved sharply.

Take your time

Scammers rely on urgency. If a token is real, you will still be able to buy it after you have spent an hour verifying it. If you feel rushed, that feeling is itself information.

Use this table as a quick pass before buying. A single serious red flag, such as an unsellable token or an unlocked pool with a single controlling wallet, is reason enough to skip.

Check	What to confirm	Red flag
1. Contract address	Matches official site and a second source, right chain	Address from a DM, an ad or a reply
2. Contract code	Source verified, limited owner powers	Unverified code, owner can mint, blacklist or change fees freely
3. Sell test	Sell simulation succeeds, reasonable tax	Failed sells, extreme or changeable tax
4. Liquidity	Meaningful pool, LP locked or burned for a long period	Thin pool, LP held in one wallet
5. Holders	Spread across many unrelated wallets	A few wallets with most supply, linked wallets
6. Team and audits	Verifiable people, traceable audit that matches the code	Fake audit badge, copied whitepaper
7. Behaviour	Organic trading, open questions allowed	Wash trading, deleted criticism, DMs
8. Wallet safety	Limited approvals, small test position	Unlimited approvals, large first purchase

How to use it

Work through the rows in order, because the early checks are fast and rule out the most obvious fakes. If a row is unclear, treat it as a flag and not as a pass. For anything time-sensitive, such as current liquidity, holder counts or lock dates, read them live from the block explorer or the locker's page at the moment you are deciding, since they change.

Passing the checklist reduces the chance of a trap but says nothing about future price. Even legitimate tokens can be volatile and illiquid.

If you suspect you bought or interacted with a scam token, act calmly and in this order.

1. Stop adding money. Don't buy more to average down, and don't send funds to a site or person that promises to fix it.
2. Revoke approvals. Use the approval checker on the block explorer for the chain you used, and revoke anything tied to the suspect token or site.
3. Protect remaining funds. If you signed something suspicious or entered your recovery phrase anywhere, assume the wallet is compromised. Create a new wallet with a fresh phrase and move your assets there, starting with the most valuable. Be aware that a compromised wallet may have a sweeper bot watching it.
4. Record evidence. Save transaction hashes, wallet addresses, token contract addresses, screenshots of chats and website addresses.
5. Report it. Flag the token on the block explorer and any decentralised exchange or data site that offers a reporting option. If you used an exchange to send funds, contact its support team. Report to your local consumer-protection or financial-crime authority, because rules and channels vary by country.
6. Beware recovery scams. People who contact you offering to retrieve lost crypto for a fee are almost always running a second fraud.
7. Keep tax records. Losses may have tax treatment in your jurisdiction, so ask a qualified professional.

Recovery is often not possible, which is why the checks above matter before you buy. This section is general information, not legal advice.