Exit Scam Crypto: How to Spot One on Solana
Exit scam crypto means operators drain liquid funds and vanish. See rug pulls, Solana red flags, and on-chain proof that separates a scam from a dead token.
Published
Updated
Exit scams accounted for 37% of cryptocurrency scam revenue in 2021, according to a Chainalysis estimate discussed in this academic review of rug-pull detection. That reframes the exit scam crypto traders worry about: the danger isn't only someone breaking into a protocol. It's someone using control they already have to take the assets buyers expect to trade against.
On Solana, the useful question isn't whether a chart looks rugged. It's whether transaction records show deliberate extraction, who authorized it, and what happened immediately before and after. A red candle gives you an outcome. A timed trail of pool withdrawals, token transfers, and insider sales gives you something to investigate.
Table of Contents
- What an Exit Scam in Crypto Means
- What the 2025 Rug-Pull Numbers Show
- Four Ways Operators Take the Liquidity
- Solana Red Flags You Can Check On Chain
- When a Collapse Is Not an Exit Scam
- What to Do After the Money Is Gone
- Check the Pool Before You Buy
What an Exit Scam in Crypto Means
An exit scam is when the people who control a token, a liquidity pool, or a platform remove the valuable assets and leave holders with something that has little or no executable market. On decentralized exchanges, this pattern is commonly called a rug pull. The terms overlap, although people also use rug pull more loosely for manipulation or abandonment.
Say a creator launches a meme coin paired with SOL. Buyers exchange SOL for the token, attracted by promotion and rising prices. If the creator then withdraws the liquidity they control, holders may still see tokens in their wallets but have no meaningful route back into SOL.
It's like a market stall where customers fill the lane, then the operator wheels away the cash box. The operator doesn't need to hack another business. Control of the pool is enough.
The Loss Figures Have a Wider Scope
The FBI's 2023 Cryptocurrency Fraud Report announcement records more than 69,000 cryptocurrency-related complaints and over $5.6 billion in reported losses. Cryptocurrency complaints represented about 10% of financial-fraud complaints, but nearly 50% of reported financial-fraud losses.
Those totals aren't an exit-scam count. They include other crypto-enabled fraud, so using them as a measure of stolen decentralized-exchange liquidity would misrepresent the evidence. They do establish why deception around digital-asset investments deserves attention alongside technical exploits.
- The reporting boundary matters. Victim complaints capture reported losses, not every incident.
- The mechanism matters. A fraudulent investment platform and a drained token pool can both leave users stranded, but their evidence trails differ.
- The label matters. A meme coin can lose its market without anyone withdrawing its pool.
Embarrassment, uncertainty about reporting, and recovery difficulties can leave losses unreported. But incomplete reporting doesn't justify calling every failed investment a scam. For a particular token, the strongest starting point is still an identifiable action involving assets, permissions, or insider inventory.
What the 2025 Rug-Pull Numbers Show
During the first part of 2025, crypto rug pulls caused nearly $6 billion in losses, compared with $90 million during the comparable period in 2024, a reported 6,499% increase, according to Sherwood News, citing DappRadar. Read that as reported value lost under the publisher's classification, not a count of convicted operators or independently established criminal exits.
The distinction changes how you use the figure. A loss total measures financial impact. It doesn't tell you how many independent schemes occurred, how losses were distributed, or whether a token in your watchlist shares their mechanics.
Separate Losses From Complaint Volume
A different measure also increased: cryptocurrency investment-scam complaints received by the FBI rose 29% in 2024, from 32,094 in 2023 to 41,557, according to the Congressional Research Service. That measures complaints about investment scams, not Solana rug pulls specifically.
You can't combine those figures into a token-level probability. Their populations, periods, and definitions differ. A trader asking how many Solana traders get rugged needs to inspect the denominator before treating any headline as personal odds.
For practical screening, keep distinct questions separate:
- Frequency: How many incidents or affected traders did the measurement include?
- Severity: Did it measure money lost, price decline, or inability to sell?
- Attribution: Was the classification based on observed behavior, allegations, or an adjudicated finding?
What the Trend Changes Before a Trade
These figures justify checking structural exposure before a token shows trouble. Waiting for a visibly broken chart means waiting until other holders may already be trying to leave.
The useful response isn't blanket certainty that new launches are fraudulent. It's a consistent inspection process that doesn't relax because a ticker is trending or a pool currently looks busy.
Practical rule: Use aggregate losses to calibrate scrutiny, not to accuse a particular creator.
A market-wide trend can't identify your counterparty. Nor can it establish that a token will repeat a historical pattern. That requires evidence from the mint, its pools, and the wallets capable of changing the trading conditions.
Four Ways Operators Take the Liquidity
The shared mechanism is control. An operator creates a token, pairs it with SOL, ETH, or a stablecoin, attracts buyers, and then extracts the valuable side through withdrawal, selling, or abusive permissions. No conventional exchange hack is necessary.
How common crypto exits take the liquid side
| Pattern | What the operator does | On-chain signature | Usual timing |
|---|---|---|---|
| Liquidity pull | Redeems a controlled liquidity-provider position | Valuable-side reserves drop abruptly alongside a liquidity-removal instruction | After buyers have funded the pool |
| Supply dump | Sells a concentrated inventory into the pool | Deployer or linked early wallets sell while the pool still exists | After incoming demand creates an exit |
| Pump and dump | Builds artificial demand, then insiders sell | Wash-like volume followed by insider sales while liquidity remains | During promotion, after demand builds |
| Freeze or mint abuse | Retains token controls and uses them against holders | Freeze instructions, new issuance, or retained privileged authority | After buyers arrive, when the controller exercises the permission |
Read the Instruction, Not Just the Balance
For a liquidity pull, inspect the transaction that redeems the liquidity position. A falling SOL reserve alone isn't enough: ordinary swaps can also reduce the quote asset held by a pool. The instruction type and destination account help distinguish withdrawal from trading.
A supply dump leaves a different trail. The pool can remain open while concentrated sellers exchange tokens for its valuable asset. Check token receipts into those wallets before checking their sales. Otherwise, you may identify a large seller without understanding whether they received an insider allocation.
A pump and dump adds a demand-manufacturing stage. Repeated trading among related wallets can warrant inspection, but repetition alone doesn't establish common control. Look for funding relationships and coordinated timing rather than assuming every active wallet belongs to the creator.
For authority abuse, separate capability from use. Retained mint authority creates issuance risk; an actual mint instruction establishes that new supply was created. Update authority concerns metadata and shouldn't be treated as equivalent to freeze authority or the power to issue tokens.
Why a Single Checkbox Falls Short
An academic review available through Cambridge's repository identifies 34 underlying rug-pull causes, while commonly used datasets covered only 7, about 20%. The causes include hidden ownership, ownership transfer, unverified contracts, external calls, distribution abuse, and fake liquidity-provider locks.
That gap explains why a reassuring contract result can't settle the whole question. Permissions describe what an account can do. Distribution shows who can sell. Liquidity control shows who can withdraw. Trading history shows which capabilities someone has exercised.
The actionable sequence is a rapid increase in valuable-asset liquidity followed by an abnormal withdrawal or coordinated selling from deployer-linked wallets. Preserve the intervening transactions. Without them, a before-and-after balance comparison can hide the very action you're trying to identify.
Solana Red Flags You Can Check On Chain
An academic study of newly issued Solana tokens examined 100,063 tokens on major decentralized exchanges during the first half of 2025 and identified 76,469, approximately 76.4% of the sample, as rug-pull tokens. Those are behavioral classifications within the study's sample, not court findings or the odds that every Solana purchase will be rugged.
Run the Checks Against the Exact Mint
Use a Solana block explorer to inspect accounts and transaction signatures, then compare those records with the relevant decentralized exchange's pool view. Search by mint address, not ticker, because a name doesn't establish token identity.
Confirm the market you're buying. Match the mint, pool address, and quote asset. Compare available depth and the route's quoted price impact with your intended order. Fail condition: the pool is a different market, or execution would move the price beyond your tolerance.
Read the authorities separately. Inspect mint and freeze authority, then metadata update authority. Record whether each is retained or revoked and what it controls. An unexplained live freeze authority is a control risk, not proof it has already been abused.
Verify liquidity withdrawal rights. Identify the owner of the liquidity-provider position and inspect any claimed lock. Check expiry, early-exit rights, and whether a claimed burn corresponds to the actual position. Fail condition: the advertised lock can't be matched to on-chain control.
Trace the deployer and early recipients. Follow initial token transfers, funding connections, bundled purchases, and later sales. A wallet receiving tokens directly from the creator deserves a closer look than a wallet merely trading at a similar time. Unexplained allocations that sell into fresh buying are a reason to pause.
Measure usable holder concentration. Separate pool accounts from ordinary holder wallets before judging concentration. Inspect whether a single holder or plausibly connected group could overwhelm the available market. A misleadingly dispersed wallet list doesn't resolve common-control questions.
Compare events across time. Align liquidity additions, removals, and swaps over recent minutes and hours. Fail condition: valuable-asset reserves rise and then disappear through a creator-linked withdrawal that you can't explain.
Inspect execution patterns. Look for wash-like repetition, bundle clusters, and sales immediately before a pool drop. Test whether the pattern has supporting wallet connections. A volume spike without clearly independent demand warrants investigation, not an automatic fraud verdict.
Record What You Couldn't Verify
A missing authority field isn't a revoked authority. An unavailable wallet history isn't a clean history. Mark unresolved checks unknown, with the account or transaction you still need to inspect.
Size the trade against executable depth, not the market-cap number beside the ticker.
Thin liquidity creates slippage risk even without theft. If you can't establish what your proposed order would receive, you don't yet have a workable entry or exit assumption.
When a Collapse Is Not an Exit Scam
A crash isn't a verdict. Failed experiments, abandoned launches, insider selling, wash trading, malicious withdrawals, and compromised deployer keys can produce similar red candles. Their consequences can look alike while responsibility and intent remain unresolved.
The behavioral categories also differ: DeepStrike's discussion of Solana rug-pull statistics describes 60,402 pump-and-dump cases, 15,606 suspected liquidity withdrawals, and 461 freeze-authority-abuse cases among candidate patterns. Those classifications identify different traces, not interchangeable legal conclusions.
Evidence that changes the label
| Trace | Supports an exit-scam label | Can also be a failed or messy token |
|---|---|---|
| Deployer withdraws valuable-side liquidity as volume spikes | Yes, especially when timed with promotion | Outsider selling can thin reserves, but isn't the same withdrawal trace |
| Creator-linked wallets sell before the drop | Supports coordinated extraction | Could be profit-taking without stealing the pool |
| Wash-like or bundled volume | Supports manipulation and a possible staged exit | Wash trading can occur without liquidity theft |
| Freeze or mint authority used against holders | Supports authority abuse | Isn't explained by ordinary loss of demand |
| Funds move through linked addresses after the drop | Strengthens a coordinated-exit account when combined with extraction evidence | Transfers alone don't establish fraud |
| Price collapses while liquidity stays and no linked dump appears | Weak evidence by itself | Fits disappearing demand |
Build a Timeline Before Choosing the Label
Suppose a creator wallet sells before a sharp decline. That supports investigating extraction, but it doesn't establish that the creator removed liquidity, deceived buyers, or controlled every early seller. The distinction between a rug pull and profit-taking turns on the action, its context, and the strength of the wallet attribution.
Now suppose a liquidity-removal transaction sends the quote asset to the deployer immediately after promotion. That's a more specific trace. Yet even then, a compromised key remains a different explanation from a deliberate founder exit, so the signer address doesn't automatically identify the human responsible.
A liquidity threshold can demonstrate market failure without proving criminal intent. A manipulator can also leave liquidity visible while manufacturing volume.
Keep Uncertainty in the Conclusion
In our reporting, suspicious activity and potentially linked wallets are leads to examine, not evidence of wrongdoing. Missing data isn't a safety clearance. A plausible wallet connection should remain qualified until the underlying transfers or funding relationships support it.
Likewise, a token can pass our checks and still collapse because buyers disappear, large holders sell, liquidity changes, or new information appears. Screening isn't a promise of future demand.
A useful incident description is narrower than an accusation: name the instruction, signer, destination, and sequence, then state what's unresolved. Before calling the event an exit scam, answer what was withdrawn, by whom, and in what order.
What to Do After the Money Is Gone
Full recovery is uncommon. Recovery becomes more realistic when authorities identify operators, seize assets, or freeze funds at a regulated exchange, but the outcome depends on the case.
The Digital Asset Law analysis of crypto exit scams discusses the FBI's January 2025 Operation Level Up announcement, which reported 6,475 cryptocurrency investment-fraud victims notified, and a November 2025 Arizona securities-regulator warning about recovery scammers demanding upfront cryptocurrency payments. Notification demonstrates that tracing can produce action. It doesn't mean victims were routinely reimbursed.
Preserve Evidence Before Chasing Recovery
Stop interacting with the suspected scheme. Don't buy more to enable withdrawals, approve a recovery contract, or follow links sent by strangers. Avoid creating another exposure while trying to understand the original loss.
Save the transaction trail. Record the mint address, pool address, transaction signatures, sending wallet addresses, and suspected destination accounts. Preserve screenshots, social handles, promotional messages, and payment records. Keep an unedited copy and note timestamps with their time zone.
Report through official channels. Contact relevant exchanges or on-ramps, local law enforcement, and the appropriate cybercrime portal, such as FBI IC3 where applicable. Separate your observed transactions from your interpretation of them. Include signatures rather than relying on a chart screenshot.
Ask about a possible freeze. If a regulated platform may hold related funds, provide the transaction trail and your complaint reference. Ask what its fraud team needs to assess the report. Don't assume the platform can freeze funds or disclose another account holder's information.
Reject unsolicited recovery offers. Don't pay an agent who contacts you claiming they can retrieve the funds for an upfront crypto fee. Never provide a seed phrase or private key as proof of ownership.
Keep Expectations Realistic
No legitimate service can guarantee recovery. A person promising certainty before reviewing the transactions is selling reassurance, not demonstrating control over the missing assets.
Your remaining edge is speed and intact records. A clear report can help an investigator follow funds or help a platform assess a freeze request. It can't rewind a withdrawn pool, and paying another stranger doesn't restore that pool's reserves.
Check the Pool Before You Buy
Before placing an order, you should be able to identify the pool's valuable asset, who can withdraw it, which token authorities remain active, and whether concentrated holders could overwhelm the available depth. If those answers are unavailable, you're taking exposure you haven't characterized.
Turn those questions into a buy-or-skip decision rather than a collection of reassuring screenshots. A locked position doesn't settle holder concentration. Dispersed holders don't settle withdrawal rights. A revoked mint authority doesn't establish that the market can absorb your exit.
Make the Decision Auditable
Write down a short trade note before buying:
- Market: The exact mint, intended pool or route, and quote asset.
- Control: The accounts that retain withdrawal or token-control permissions.
- Execution: The quoted output and price impact for your intended size.
- Unresolved evidence: Any missing history, unexplained allocation, or unverified lock claim.
- Reason to skip: The condition that would make you refuse the trade rather than reduce scrutiny.
This creates a record of what you knew at entry. It also makes it harder to replace an unanswered question with enthusiasm after the price rises.
Use a Second Read Without Handing Over Permissions
For an explained second opinion, MemeAssist combines live on-chain and market data into a report with an Overall Health Score, Rug Risk Rating, plain-English AI Verdict, and Detailed Risk Breakdown. Our Solana liquidity checker supports inspection of trading conditions without asking you to connect a wallet, sign a transaction, or approve anything. The analysis is informational, not financial advice or a guarantee of safety.
Meme coins are extremely risky, and you can lose everything you invest even without a rug pull. Keep the decision tied to observable conditions: which extraction mechanism is possible, what evidence supports it, and whether the proposed position is executable.
Skip the trade when withdrawal rights remain unclear or available depth can't support your order. Not buying is a valid outcome of a completed check.
Visit MemeAssist with the Solana mint address you want to inspect for an explained report on liquidity, holders, creator behavior, and trading patterns. Use the underlying checks to investigate possible exit-scam traces, then decide whether the evidence supports taking any position at all.