Research
Rug Pulls in Crypto: How They Happen and How to Spot Them Before It's Too Late
A rug pull isn't a hack — it's the team stealing from the investors who trusted them. Here's how hard and soft rug pulls work, and the on-chain red flags you can check before you invest.
TL;DR
- A rug pull is theft by the team, not an outside hack. The people who built and promoted the project use their control over the contract, tokens and liquidity to exit at investors' expense.
- Two types. A hard rug pull is instant — the team yanks the liquidity or blocks everyone else from selling. A soft rug pull is slow — insiders dump their allocations over weeks while the price bleeds out.
- Four checks before you buy. Is the liquidity locked? Is the contract audited? How concentrated are the top wallets? Is the team doxxed? Failing these is a hard stop.
- FOMO is part of the scam. The fast pump that makes a new token exciting is the same setup that makes the theft most profitable — that correlation is by design, not chance.
The Squid Game Token
In October 2021, a token called Squid Game launched off the back of the Netflix show's global viral moment. Within days it had risen 45,000%. Then the developers activated a sell restriction that prevented anyone except themselves from exiting, sold their entire allocation, and disappeared. The token dropped 99.99% in minutes. Millions in retail capital transferred to anonymous wallets that were never recovered. No hack occurred, no code was exploited by an outside party. The people who built the project stole from the people who trusted it. That is the defining characteristic of a rug pull in crypto: not external attack, but internal betrayal executed against investors who had no way to verify the project's integrity before committing capital.
What a Rug Pull Is and How It Differs From a Hack
The term refers to the image of pulling a rug from under someone standing on it. The victim is on apparently solid ground, a project with momentum, community, and rising price action, until the floor disappears. The distinction from a hack matters because it determines both the prevention strategy and the accountability framework.
A hack is an attack by external parties who exploit code vulnerabilities to steal funds. The team did not intend the theft; they may even work to recover funds afterward. Rug pulls invert this entirely. The people who created and promoted the project are the thieves. Their privileged position, controlling the smart contracts, holding large token allocations, owning the liquidity pool positions, is exactly what they leverage to exit at retail investors' expense.
The legal treatment differs too. External hackers, if identified, face criminal prosecution in most jurisdictions. Rug pull perpetrators commit fraud, which is theoretically prosecutable, but the combination of anonymous teams and cross-border crypto transfers makes prosecution practically rare. The anonymity that DeFi's permissionless architecture enables is what makes the rug pull viable as a business model at scale. No reputational cost, no legal cost, keep the proceeds.
According to Chainalysis data, rug pulls accounted for approximately 37% of all crypto scam revenue in 2021, representing over $2.8 billion in losses that year. The scale reflects how the DeFi explosion created infrastructure that lowered the barrier to launching a fraudulent project to near zero.
The Two Main Mechanisms
Hard rug pulls and soft rug pulls describe different execution methods with different signatures.
A hard rug pull is immediate and total. The most common version involves liquidity removal: the project deploys a token, pairs it with ETH or BNB in a decentralised exchange liquidity pool, attracts buyers who push the token price up, and then withdraws the ETH from the pool in a single transaction. The withdrawal takes seconds. After it executes, the liquidity pool contains only the worthless project token. Anyone trying to sell receives almost nothing because there is no valuable paired asset to receive. The ETH is gone, transferred to wallets the developers control.
The Squid Game token used a variation: a code-level restriction in the smart contract that blocked any wallet except the developers' from executing sell transactions. Buyers could purchase freely; only the developers could sell. When the price had risen far enough to maximise the extraction, they sold, collapsed the price, and disabled the contract.
A soft rug pull is slower and less dramatic but no less deliberate. Founders receive large allocations at token launch, sometimes through vesting schedules that allow gradual selling. They sell progressively as community demand keeps prices elevated, disguising their exits as routine portfolio management. The price declines slowly under the sustained insider selling pressure, and by the time the project is clearly abandoned and the team has stopped communicating, they have captured most of the value that retail participants provided.
Soft rug pulls are harder to distinguish from projects that simply failed legitimately. The on-chain signature, a pattern of sustained selling from large wallets concentrated in team-linked addresses over weeks or months, is identifiable in retrospect but harder to confirm before the collapse makes intent obvious.
The Red Flags: What to Check Before Investing
The on-chain nature of crypto provides tools for pre-investment due diligence that no equivalent in traditional finance offers. A 30 to 60 minute checklist can identify the structural characteristics that make rug pulls possible.
Liquidity lock status is the single most important check for DEX-listed tokens. A liquidity pool represents the paired assets that give the token its exchange value. If the liquidity provider tokens are not locked in a time-lock contract with a third-party platform such as Unicrypt or Team Finance, the project team can withdraw the liquidity instantly with no restriction. Verifiable liquidity locks, with lock duration and contract address visible on-chain, provide the most meaningful structural protection against the hard rug pull mechanism. No lock, or a lock of only a few days, is a hard stop for any serious diligence process.
Smart contract audit status comes second. Unaudited contracts may contain intentional backdoor functions that allow the deployer to mint unlimited tokens, pause trading for all wallets except their own, set fees to 100%, or drain contract balances. A mint function accessible to the contract owner is the classic rug pull instrument: the owner can create tokens at will and sell them into the market, diluting every other holder to nothing. Reading the contract on Etherscan to identify these functions takes ten minutes and does not require programming expertise, only the ability to search for function names and check who can call them.
Token distribution concentration reveals the supply-side risk. When the top ten wallet addresses hold 40 to 60% of total supply, the holders of those wallets have the capacity to execute a devastating dump regardless of any other project characteristics. Blockchain explorers show this distribution directly. Reasonably distributed supply, with no single non-exchange wallet holding more than 5 to 10%, dramatically limits the scale of insider selling that any single party can execute.
Team identity is the accountability factor. A team with no verifiable real-world identities faces zero reputational or legal consequences from executing a rug pull. Doxxed founders who have published their identities, have prior verifiable work histories in related fields, and would face meaningful professional and legal consequences from fraud have a structural deterrent that anonymous teams entirely lack. This does not guarantee integrity, but it changes the cost-benefit calculation for the team. Anonymous founders eliminate that deterrent entirely.
| Red flag | Why it matters | How to check |
|---|---|---|
| Unlocked liquidity | Team can withdraw paired assets instantly | Unicrypt, Team Finance, on-chain |
| Unaudited contract | May contain mint or pause backdoors | Etherscan, contract code review |
| Concentrated supply | Large holders can dump and collapse price | Blockchain explorer, top holders tab |
| Anonymous team | No accountability, zero deterrent to fraud | Team page, social media, previous work |
| Guaranteed high APY | Ponzi mechanics requiring constant new capital | Tokenomics documentation |
The Role of FOMO in Making Rug Pulls Work
The Squid Game token's 45,000% rise in days did not happen in a vacuum. It was engineered to happen quickly, by capitalising on genuine viral attention around a popular cultural moment, creating urgency through scarcity mechanics and rising prices, and exploiting the documented tendency of retail participants to chase performance. The faster a token rises, the more FOMO it generates, the more new buyers enter, and the more value is concentrated for the developers to extract.
This pattern is not accidental. Rug pull architects understand retail psychology and design their projects to trigger it. Timing the launch around a trending topic, generating social media buzz through coordinated promotion, and creating artificial scarcity or urgency are standard elements of a professionally executed rug pull rather than incidental features. The viral marketing is part of the theft mechanism.
Understanding this changes how a trader should respond to a rapidly rising new token with no established history. The characteristics that make a token exciting, sudden price appreciation, social media momentum, community hype, are identical to the conditions that make a rug pull extraction maximally profitable for the perpetrators. The correlation is not coincidental. It is causal.
What Separates New DeFi Tokens From Established Assets
The risk profile of participating in a new DEX-listed token is categorically different from holding Bitcoin, Ethereum, or large-cap assets with years of trading history and transparent, publicly known teams.
Established assets carry market risk: the price can fall significantly due to macroeconomic conditions, sentiment shifts, or project-specific news. The risk is directional price movement. Rug pull risk is absent because no single party controls sufficient supply to execute a meaningful dump, the teams are publicly known and have years of operation to demonstrate, and the projects have not disappeared or abandoned development.
New DeFi tokens on permissionless exchanges carry both market risk and fraud risk simultaneously. The research process for a new token position is not the same as the research process for an established asset. It requires smart contract inspection, liquidity lock verification, team background research, and tokenomics analysis before the question of whether the project's actual use case is compelling even becomes relevant. If the structural fraud risk checks fail, the fundamental analysis is moot.
Conclusion
A rug pull is not a market outcome that happens to investors. It is a planned theft executed against them by the people they trusted with their capital, using privileged access to project infrastructure that no outside party had the ability to check before committing funds. The structural features that enable it, anonymous teams, unlocked liquidity, unaudited contracts with admin backdoors, concentrated supply distributions, are all visible before investment to anyone willing to look. The Squid Game token and the thousands of smaller rug pulls that occurred alongside it were not inevitable outcomes of participation in new token markets. They were the predictable result of investing without doing the pre-investment checks that the on-chain nature of crypto makes possible. The tools to avoid them exist. Using them consistently is the practice that separates protected participation from unprotected exposure to a market where fraud is a product category in its own right.