Rug Pulls: How to Spot the Usual Suspects in 2026

A rug pull is a scam in which the people who create or control a crypto token remove the value that buyers put in, then leave. The name comes from the image of pulling a rug out from under people standing on it.

The term covers several patterns that look different on the surface but share one feature: holders cannot sell at a fair price because the exit has been closed or emptied.

• Hard rug pull: the deployer removes the liquidity from a trading pool, so there is nothing left to sell into.
• Soft rug pull: insiders and early holders sell slowly over weeks while the community is kept hopeful. This is harder to spot because nothing dramatic happens at once.
• Pump-and-dump: the price is pushed up through hype, bots or fake volume, and insiders sell into the rise. It often overlaps with a rug pull.
• Honeypot: the contract lets some wallets buy but blocks others from selling, so the price looks healthy while holders are trapped.

The usual sequence is that liquidity is added, the price rises, attention builds, and then value is extracted. Knowing that sequence helps you ask the right questions at each stage. Most of the evidence is public: contract settings, pool ownership and token holder lists can be checked on the block explorer for the chain where the token trades.

Scams like this are rarely run by a single anonymous figure acting alone. The people behind them often follow recognisable patterns, and these are the signals worth taking seriously.

• Vague or missing team details, or a team that uses stock photos and a profile with no history.
• Founders who avoid answering direct questions about the code, the token supply or their own holdings.
• Promises of guaranteed or extraordinary short-term returns, which should be treated as a red flag in their own right.
• Pressure to buy quickly, such as countdown timers, claims of limited allocation or messages that make doubters look foolish.
• A pattern of abandoning past projects. Searching the developer names or wallet addresses can show whether earlier tokens ended in a similar way.
• Copycat projects that borrow the name, logo or website of an established protocol.

An anonymous team is not proof of a scam by itself, since many legitimate developers use pseudonyms. The concern is the combination of anonymity with control over funds and no way to verify what the team can do. Look at what the people behind the token can actually change, not only at how they present themselves.

The token contract is the rulebook for the token. On an EVM chain, many tokens are deployed from source code that you can read on the block explorer if it has been verified. If the source is not published, you cannot easily check what the code does, which is a serious warning sign on its own.

Look for owner-only functions that could hurt holders:

• Mint functions that let the owner create new tokens and sell them into the pool.
• Blacklist or blocklist functions that can stop chosen wallets from selling.
• Fee or tax settings that can be raised without limit after launch, sometimes to near total levels.
• Pause functions that can freeze all transfers.
• Ownership that has not been renounced or moved to a timelocked multisig, when the project claims it has.

On Solana, token mints can carry a mint authority and a freeze authority. If the mint authority is still active, supply can be increased. If the freeze authority is active, accounts can be frozen. Checking whether those authorities have been removed is a basic step for any new Solana token.

An audit report can help, but it reviews a specific version of the code at a specific time. Confirm that the audited code matches what is deployed, and do not assume an audit covers later changes.

Liquidity is the pool of tokens and paired assets that lets people trade. Whoever controls the pool's liquidity provider tokens can usually withdraw the underlying assets, so this is often where a hard rug pull happens.

The key questions are:

• Who holds the liquidity provider tokens? If one wallet holds them, that wallet can remove the liquidity at any time.
• Are the tokens locked in a liquidity locker, and for how long? A short lock or a lock that can be shortened or ended early offers little protection.
• Have the tokens been sent to a burn address? A burn can make the liquidity permanent, but only if you verify the transfer on the explorer rather than relying on a claim.
• How deep is the pool? A pool with very little paired asset means a small sell can move the price sharply, which makes exits expensive even without a deliberate rug.
• Which pool is the main one? Some tokens have multiple pools, and the one with real depth may be different from the one the project promotes.

For decentralised exchanges such as Uniswap V3, PancakeSwap and Jupiter on Solana, the pool pages and transaction history show who added liquidity and when it moved. Compare the displayed price with the depth of the pool before assuming a quote is fair.

Token distribution shows how much control insiders have. Even with honest intentions, a few wallets holding most of the supply can crash the price by selling.

What to look at:

• Top holder list: if the top handful of wallets hold a large share, ask whether any of them are the team or linked to it.
• Developer or deployer wallet: check how many tokens it holds and whether it has moved tokens to exchanges or to fresh wallets.
• Vesting: if team and investor tokens are locked, check the schedule and whether the lock is enforced on-chain or only promised.
• Fresh wallets: many new wallets buying in the same few minutes, funded from the same source, can indicate bundled buying that props up the price before insiders sell.
• Sell activity: confirm that ordinary holders can sell. Test with a very small amount only if you understand the risk, and check the transaction result rather than the displayed balance.

A well-distributed holder list is not a guarantee, but a concentrated one is a strong warning. Explorers and analytics tools can show these patterns, although you should double-check any single figure against the chain itself.

Hype is not a verification tool, but certain marketing patterns tend to appear around projects that later collapse. Treat them as prompts for closer checks rather than as proof.

• Price talk dominates the channels, with little discussion of the product, users or code.
• Moderators delete critical questions, ban people who ask about liquidity, or only allow positive posts.
• Large paid influencer campaigns start before there is anything to use.
• Claims about partnerships or listings that cannot be confirmed through the partner's own channels.
• Urgency built around a launch or a presale, with the message that waiting will cost you.
• Sudden name changes, account changes or a rapid move from one chat platform to another.

A useful test is to ask what the token does. If the answer is only about price, the project may not have a purpose beyond attracting buyers. A real protocol will usually be able to describe its function, its users and its risks in plain language, and its claims can be checked against the live product and its documentation.

A repeatable routine is more reliable than memory or instinct. The steps below can be done for any new token, on any chain, before you commit funds. They are general checks and not a guarantee.

1. Confirm the contract address from an official source, and check that it matches the one you are about to trade. Fake tokens often copy names and logos.
2. Open the contract on the block explorer and confirm the source code is verified.
3. Look for mint, blacklist, pause and fee functions, and check whether ownership has been renounced or sits with a multisig.
4. For Solana tokens, check the mint and freeze authorities.
5. Identify who holds the liquidity provider tokens and whether they are locked or burned, and for how long.
6. Review the top holder list and whether the deployer holds a large share.
7. Check the pool depth relative to the size of your intended trade.
8. Search for the team and developer names and wallet addresses to see if they were linked to earlier failed projects.
9. Decide the maximum amount you can lose in full, and do not exceed it.
10. Set a plan for leaving: know which pool you would sell into and what slippage you would accept.

Writing down your answers to each step helps you notice when you are ignoring a warning that you would otherwise have caught.

Several tools help with these checks, but none is a substitute for reading the evidence yourself. Each one answers a different question.

• Block explorers show verified source code, holder lists, transaction history and wallet activity for the chain you are using. This is the foundation for most checks.
• DefiLlama aggregates total value locked, volume and fees for DeFi protocols across many chains. It is useful for confirming that an established protocol has real activity, but it does not assess new meme tokens.
• Uniswap V3, PancakeSwap and Jupiter show pool information and swap routing on their respective chains. Their pool and route pages help you see depth and where a trade would go.
• Sharpe describes itself as a trading intelligence terminal with rug checks among its features. Use any rug check as a starting point and confirm the findings against the explorer.

Remember that automated scanners can miss new tactics, misread complex contracts or lag behind a change. A clean result means fewer known red flags, not that a token is safe. Check the tools' own documentation for what each measure covers, and keep your own judgement in the loop.

If you suspect a project has been used for a rug pull or you have lost funds, the next steps matter more than the cause. Acting quickly can limit further damage, though recovery is uncommon.

• Stop sending funds to the token or to any address the project asks you to pay.
• Revoke token approvals you no longer need, using a reputable approval management tool on the relevant chain, and confirm each transaction carefully.
• Save the contract address, transaction hashes, wallet addresses, screenshots and any messages from the project.
• Report the incident to the exchange or platform where you traded, and to the authorities in your country.
• Be cautious of anyone offering to recover funds for a fee or asking for your seed phrase or private keys. Legitimate services never need those.
• Review your other wallets for the same pattern, and consider moving remaining assets to a wallet you control with a fresh seed phrase if you think it was exposed.

After the event, a short written review of what you noticed and what you missed can make your next decision better. The aim is steady improvement rather than blame.