Quick Answer
A crypto rug pull is when developers drain liquidity or dump tokens, leaving investors with worthless holdings. The top red flags: anonymous team, unlocked liquidity, no contract audit, concentrated token distribution (top wallet holds 10%+), and unrealistic yield promises. Protect yourself by using regulated exchanges like Coinbase and storing crypto on a Ledger hardware wallet.
Rug pulls remain the most common form of crypto fraud in 2026. Despite increased regulation and better detection tools, scammers continue to steal billions by exploiting greed, FOMO, and a lack of due diligence. In 2025 alone, rug pulls and exit scams accounted for over $2 billion in losses across DeFi, memecoins, and NFT projects.
This guide teaches you the exact red flags that professional crypto investigators look for. Learn these 12 warning signs, and you will avoid the vast majority of scams.
What Is a Rug Pull?
A rug pull occurs when crypto project developers create a token, generate hype to attract investment, then execute one of these exit strategies:
- Liquidity drain: Remove all liquidity from the trading pool, making the token untradeable and worthless. This is the most common type.
- Token dump: Developers hold a large percentage of supply and sell all at once, crashing the price to near zero.
- Honeypot contract: The smart contract allows buying but blocks selling for everyone except the developer.
- Slow rug: Developers gradually sell their holdings over weeks, letting the price bleed out slowly while maintaining the appearance of a legitimate project.
The 12 Red Flags
Red Flag #1: Anonymous or Unverifiable Team
If you cannot find real names, LinkedIn profiles, or verifiable work history for the core team, proceed with extreme caution. Legitimate projects have doxxed teams because they stake their professional reputation on success. Cartoon avatars and Discord handles are not accountability.
Exception: Bitcoin was created by the pseudonymous Satoshi Nakamoto. But Bitcoin launched with no pre-mine, no team tokens, and no liquidity pool to drain. Modern token launches are fundamentally different.
Red Flag #2: Unlocked Liquidity
If the liquidity pool is not locked through a verified service (like Unicrypt, Team.Finance, or PinkSale), the developer can drain it at any time. Check the liquidity lock on the token's blockchain explorer. It should be locked for a minimum of 12 months, ideally 2+ years.
Red Flag #3: No Smart Contract Audit
Unaudited contracts can contain hidden functions that allow minting unlimited tokens, pausing trading, blacklisting wallets, or draining funds. Reputable auditing firms include CertiK, Hacken, Trail of Bits, OpenZeppelin, and Quantstamp. Self-proclaimed "audits" by unknown firms are worthless.
Red Flag #4: Concentrated Token Distribution
Check the token holders on Etherscan, BscScan, or Solscan. If the top 10 wallets hold more than 50% of the supply (excluding exchange wallets and locked vesting contracts), the project is extremely vulnerable to a dump. A single wallet holding more than 5% of circulating supply is a concern.
Red Flag #5: Unrealistic Yield Promises
"1,000% APY" and "100x guaranteed" are scam language. Sustainable DeFi yields in 2026 range from 3-15% APY. Anything promising consistently higher returns is either taking extreme risk with your funds or running a Ponzi scheme where new deposits pay old investors.
Red Flag #6: Aggressive Paid Influencer Campaigns
If the project is spending heavily on Twitter/X influencers, TikTok promoters, and Telegram shilling groups instead of building product, they are likely manufacturing FOMO to attract liquidity they intend to drain. Legitimate projects build first, market second.
Red Flag #7: No Working Product
A flashy website and a whitepaper are not a product. Can you actually use the protocol? Is there a working dApp? Is there real on-chain activity from non-team wallets? Projects that launch tokens before delivering any product have a disproportionately high rug-pull rate.
Red Flag #8: Copy-Paste Smart Contract
Many rug pull tokens use copied code from other projects with minor modifications (often just adding hidden mint or pause functions). Check the contract on Etherscan's "Similar Contracts" feature. If it matches dozens of other tokens, it was likely generated from a rug-pull template.
Red Flags #9-12: Additional Warning Signs
- #9 Honeypot mechanics: You can buy but cannot sell. Test with a tiny amount first, or use honeypot detection tools.
- #10 Extremely high buy/sell tax: Token taxes above 5% (especially sell taxes of 10%+) make it nearly impossible to profit. Some scam tokens have 99% sell tax.
- #11 Discord/Telegram censorship: If critical questions are deleted and questioners are banned, the community is manufactured.
- #12 Pressure to buy immediately: "Price goes up at midnight," "Only 100 spots left," and similar urgency tactics are designed to prevent you from doing research.
How to Protect Yourself
Use Regulated Exchanges
The simplest protection against rug pulls: buy crypto only on regulated exchanges. Coinbase vets every token before listing. You will never find a rug-pull token on Coinbase, Kraken, or Gemini. The trade-off is you cannot access brand-new tokens, but that is a feature, not a bug.
Store Crypto on a Hardware Wallet
A Ledger hardware wallet keeps your private keys offline and under your control. Even if an exchange is compromised, your funds are safe. This is the single most important security step you can take as a crypto investor.
Critical: Never enter your seed phrase on any website or share it with anyone. Ledger and other wallet companies will never ask for your seed phrase. Anyone requesting it is a scammer.
Pre-Investment Checklist
Before investing in any new crypto project, verify all of the following:
- Team identities are verifiable (LinkedIn, past projects, public records)
- Smart contract is verified and audited by a reputable firm
- Liquidity is locked for 12+ months via a verified locker
- Top 10 wallets hold less than 30% of circulating supply
- There is a working product you can actually use
- Community discussion allows critical questions without censorship
- Token tax is below 5% on both buy and sell
- The project has been live for 30+ days with consistent activity
Free Rug Pull Detection Tools
- Token Sniffer (tokensniffer.com) — Automated scam detection scoring
- RugDoc (rugdoc.io) — DeFi project reviews and risk ratings
- Etherscan / BscScan / Solscan — Verify contracts and check holder distribution
- DEXTools (dextools.io) — Real-time trading data, liquidity info, holder analysis
- Honeypot.is — Test if a token is a honeypot before buying
- GoPlusLabs (gopluslabs.io) — Comprehensive token security API
- Scam.ink — Our sister site for scam reporting and tracking
For additional security tools, spunk.codes offers 290+ free tools including hash generators, encoding utilities, and security checkers that are useful for verifying contract data and signatures.
What to Do If You Get Rug Pulled
- Document everything: Screenshot the website, contract address, transaction hashes, team social profiles, and any communications.
- Report to authorities: File a complaint with IC3.gov (FBI), the FTC, and your local police. Include all documentation.
- Report to the platform: If the token was listed on a DEX, report the contract to the platform. Uniswap and PancakeSwap maintain warning lists.
- Check for tracking: Blockchain analytics firms like Chainalysis and Elliptic sometimes track stolen funds. Monitor the wallet addresses for any movement.
- Warn others: Post details on Scam.ink and crypto forums to prevent others from falling victim.
- Do not pay "recovery services": Companies claiming they can recover your stolen crypto are almost always scams themselves. This is called a "recovery scam" and is designed to victimize you a second time.
Frequently Asked Questions
What is a crypto rug pull?
A scam where developers create a token, attract investment, then drain liquidity or dump tokens, leaving investors with worthless holdings. Over $2 billion was lost to rug pulls in 2025.
How do I check if a crypto project is a scam?
Verify: doxxed team, locked liquidity (12+ months), audited smart contract, decentralized token distribution, and a working product. If any of these are missing, treat it as high risk.
How do I protect myself from crypto scams?
Buy only on regulated exchanges like Coinbase. Store long-term holdings on a Ledger hardware wallet. Never connect your wallet to unverified DApps. Never invest more than you can afford to lose.
Can you recover money lost in a rug pull?
Recovery is extremely rare (under 5%). Report to IC3.gov, FTC, and local police. Do not pay "recovery services" -- they are almost always scams themselves.
What are the biggest red flags?
Anonymous team, unlocked liquidity, no audit, concentrated token distribution, unrealistic yield promises (1000%+ APY), paid influencer shilling, and no working product.
Stay Safe in Crypto
Use trusted platforms and hardware wallets. Never risk more than you can afford to lose.
Safe Trading on Coinbase Protect with Ledger Wallet Report Scams at Scam.ink