Rug Pull Explained: Signs, Case Studies and How to Check

Learn what a rug pull is, the on-chain signs that reveal one, real case studies and a live-data checklist to verify a token before you buy.

Published 2026-10-26T07:07:22.690Z

Updated 2026-10-26T07:07:24.195Z

You're staring at a chart that just went vertical. A new Solana memecoin showed up in your feed twenty minutes ago, the candle is green, and the comments are already calling it early. Your finger is hovering over buy.

That rush is familiar, and it's also where a lot of money disappears. A steep climb can be real demand. It can also be the middle of a rug pull, the stretch where buyers arrive and the people who set the market up are getting ready to leave. The chart won't tell you which one you're in. The accounts behind the token will.

A rug pull isn't one trick. It's several ways a market can be built so that ordinary holders lose the exit. A pool can stay full and still leave you stuck. The pages below walk through those failure modes, three cases that show why the label gets used too loosely, and a check you can finish before the next buy.

Table of Contents

• What a Rug Pull Is and Why It Keeps Happening
• Rug Pull Mechanics and the Signals Each Type Leaves
  • What the chain actually shows
  • Rug pull types and the signals each leaves
  • Four pillars, checked in order
• Famous Rug Pulls and What Each One Teaches
  • Major rug pull cases and their failure modes
  • What the more recent counts do and don't say
• How to Check a Token With Live Data
• Telling a Rug Pull Apart From Ordinary Volatility
  • Rug pull signals versus ordinary volatility
  • Why you keep the evidence anyway
• Your Next Step Before Buying a Memecoin

What a Rug Pull Is and Why It Keeps Happening

Say a vendor sets up a bright stall at a weekend market. The sign is painted, the samples look good, and a queue forms. Every customer pays cash. Overnight the vendor packs the cash box and the stall is gone. Buyers are left holding goods nobody will take back. That's the picture behind the name. The floor everyone was standing on gets pulled away.

Most cases share three stages, and you can usually see all three if you look past the price.

Setup is the appearance of a real project. Someone creates a token, a name, a site, and a burst of posts. Sometimes there's an audit claim. None of that proves the market will stay open.

Lure is the climb. Buyers arrive, money enters the pool, and the rising chart becomes the advertisement. New buyers read the green candle as proof they are still early.

Exit is the part the chart hides until it's over. The creator takes the funds, or the ability to sell disappears. Holders still see a balance. They just can't turn it into anything useful.

Chainalysis defines rug pulls as schemes in which developers create projects that appear legitimate, attract investor funds, and then abandon the project or remove the funds. In 2021 those schemes accounted for approximately $2.8 billion in stolen cryptocurrency and 37% of total crypto-scam revenue, compared with just 1% in 2020. Overall cryptocurrency scam revenue reached nearly $7.7 billion that year. Deposits to fraudulent addresses fell from about 10.7 million in 2020 to 4.1 million in 2021, while the total value stolen increased. Fewer deposits, much larger losses each time.

Those figures cover both centralized and decentralized cases. They aren't a direct estimate of Solana meme-coin losses. What they do show is why a planned exit is different from an ordinary bad trade. A bad investment can still leave a market you can sell into. A rug is built so the useful exit belongs to someone else. Price is the last place that difference shows up. The accounts, the pool, and the permissions show it first.

Rug Pull Mechanics and the Signals Each Type Leaves

A liquidity pool pairs the new token with SOL or a stablecoin. Traders swap against that pair. Whoever holds the pool's LP tokens can withdraw the paired side. That's the classic liquidity drain. The meme token can still sit in your wallet while the SOL that gave it a price is gone.

Locking or burning those LP tokens narrows that one exit. A lock is only as strong as its release date and the party controlling the locker. A short lock, a lock on a thin slice of the pool, or a second pool whose liquidity is already free to withdraw leaves the same door open.

Owner permissions add more exits. A mint authority can create new supply and sell it into buyer demand. A freeze authority can block holder accounts from transferring, so the market looks active while you can't leave. An upgrade authority can change program logic after launch. Think of a house with a locked front door. The lock does little if the owner still holds a master key to every room.

Practical rule: Treat "liquidity locked" as one box ticked, not a safety verdict. It closes a single exit. It doesn't retire mint rights, freeze rights, wash volume, or creator-linked wallets.

What the chain actually shows

People lump very different failures under one name. A technical taxonomy of rug-pull causes identifies 34 root causes across six broad categories, including hidden ownership, ownership transfer, unverified contracts, external calls, token burns, and fake liquidity locks, as set out in a measurement study of rug-pull causes. On Solana, that work reports three representative on-chain patterns: freeze-authority abuse, liquidity withdrawal, and pump-and-dump behavior. Freeze authority can restrict transfers while the chart still looks alive. Pump-and-dump behavior concentrates supply in linked wallets, inflates price and volume, then sells into retail demand.

Scale isn't confirmation. A 2025 Solana dataset built from approximately 3.69 billion transactions identified 62,895 suspicious liquidity pools. A risky or manipulated market isn't the same thing as a confirmed rug. Later work curated 117 confirmed Solana rug-pull tokens and found the same three patterns recurring: freeze-authority abuse, liquidity withdrawal, and pump-and-dump activity. If the pool is locked or still full, the token can still be unsafe. Trading restrictions, privileged controls, coordinated exits, wash trading, and creator-linked wallets each hurt holders before any liquidity disappears.

Read every row below as a hypothesis to test, not a verdict. One red flag is common in a wild meme market. Several independent flags together are a different story.

Rug pull types and the signals each leaves

A high-risk read needs those signals to converge: authority still live, ownership concentrated, wallets moving together, turnover that doesn't match unique buyers, and weak sell liquidity. Any one of those can be a false positive. A fair launch can be volatile. A burn address can look like a whale until you label it.

Four pillars, checked in order

Work through four pillars, and don't skip ahead because one of them looks fine.

Liquidity. Pool size in SOL, who holds the LP tokens, and whether any lock has a date you can verify on chain.

Control. Mint, freeze, and upgrade authorities. Revoked is cleaner than "held by a multisig you can't identify."

Behaviour. Volume against unique buyers. Repeated transfers among a handful of wallets is a different market from many independent buyers.

Insiders. Creator and early-funder links, and how much of the tradable float those wallets still hold once the pool and burn addresses are removed. Top-holder concentration is the insider check beginners skip because the holder tab looks crowded.

A single pillar can scare you off a messy but tradeable token. Waiting for all four to point the same way is how you avoid treating every red candle as a crime.

Famous Rug Pulls and What Each One Teaches

Headline totals hide the typical case. One collapse can own a whole year's number, and the word "rug pull" gets applied to a frozen exchange and a drained pool as if they were the same event. They aren't. The buyer checks are different.

Major rug pull cases and their failure modes

Thodex, a Turkish cryptocurrency exchange, halted customer withdrawals in April 2021 after its chief executive disappeared. CoinDesk's account of the Chainalysis figures says Chainalysis attributed more than $2 billion of that year's rug-pull losses to the case, roughly 90% of the total value in its analysis, although other reports cite estimates as high as approximately $2.6 billion. Users couldn't read a contract and pull their coins. The platform held custody. That's the lesson: funds on a centralized venue sit outside any pool page you can inspect.

AnubisDAO, a dogecoin-inspired decentralized project, involved about $58 million. Uranium Finance involved approximately $50 million. Both sit far below the exchange case, and both show that a decentralized wrapper doesn't protect pooled funds if the people who deployed the contracts can still move them. For Uranium, the useful question isn't the label a tracker chose. It's whether the team, or anyone with a privileged key, could drain the pool. An outside exploit and an insider exit can look identical on a price chart. They don't look identical in the authority and signer history.

One giant failure can own the year's headline. The typical token loss is much smaller than that total implies, which is why a single scary number is a poor guide to the coin in front of you.

The same broad label still covers both worlds. Industry write-ups use "rug pull" for a centralized exit scam and for a DeFi team that withdraws liquidity or walks away. Checking liquidity, creator behavior, holder concentration, wallet activity, and withdrawal rules is how you separate those failure modes instead of treating the word as a diagnosis. A bundled-wallet case is a useful contrast: the damage comes from wallets that bought together, not from a CEO vanishing with an exchange's books.

What the more recent counts do and don't say

Trackers don't even agree on a single recent total, because they don't count the same way. Beosin's Alert platform monitored 68 major Web3 rug-pull incidents in 2024, involving approximately $148 million in losses. Cryptopolitan's reported figures put 2024 at 58 rug-pull cases and approximately $106 million. Different lists, different methods, same direction: the yearly dollar figure is no longer dominated by one multi-billion-dollar exchange.

DappRadar's early-2025 count, as reported by Cointelegraph, was seven rug-pull incidents, down 66% year over year from 21 incidents in the comparable early-2024 period. Fewer counted incidents don't lower the risk of the token that launched this afternoon. A thin new pool can still be drained, frozen, or sold into by a cluster of linked wallets. The historical total tells you the category is large. It doesn't tell you this mint is fine.

How to Check a Token With Live Data

Run the check from live accounts, not from the ticker in a Telegram pin. Each step exists because a specific lie survives the step before it. Copycat tokens share names. Permissions hide behind a green chart. A lock badge can cover one pool while another stays open.

The graphic lines up the sequence. The notes under it are the part you record.

1. Start from the mint address, not the name or ticker. Copycats reuse both, so a search by name can open the wrong coin while you think you're early. Paste the mint into a Solana explorer and confirm the supply matches the page you meant to buy.

2. Open the mint account and read the authority fields. Confirm that mint and freeze authorities are revoked, or name the account that still holds them. An active freeze authority is a stop sign, because that account can block sales while buys still land.

3. Check the liquidity pool on the DEX where it actually trades. Note the size in SOL, who holds the LP tokens, and whether any lock has an unlock date you can verify. A lock with no date, or a lock on a sliver of the pool, doesn't close the drain.

4. Review the top holders with the pool and burn addresses removed. Those two often dominate the list and make the float look wider than it is. Note the combined share of the largest remaining wallets, and whether they were buyers in the first minutes.

5. Trace the creator and the first buyers in the explorer's transaction history. Look for a shared funding source, wallets that bought in the same block, and any move of tokens toward an exchange or a fresh wallet. Same-block buys are a cluster, not a crowd.

6. Compare volume with unique buyers. Many transfers among a few wallets can print a busy chart without new demand. If the buyer count is tiny next to the transfer count, treat the volume as wash activity until the wallets prove otherwise.

7. Test the exit before you size up. Use a sell simulation, or a small real sell of an amount you can afford to lose, and write down any failed-transaction error exactly as shown. A failed sell, a surprise tax, or a freeze error is direct evidence. A chart cannot show it.

8. Write every result in one note and read them together. A finished check is a short list: each step's result, then the decision that list supports. One ugly line isn't a rug. Converging lines are. Our Solana rug-check workflow is the same order if you want the fields laid out as a checklist.

A video walk-through of the same idea, watching authorities and the pool instead of the candle, helps if the explorer layout is new to you.

Where each answer comes from matters as much as the answer. Steps 1 and 2 use the token's mint account and authority fields on a Solana explorer. Step 3 uses the pool page on the DEX. Steps 4 through 6 use the holder list and the transaction history for the creator and early buyers. Step 7 uses the simulation tool or the failed transaction itself. If a field is missing, leave it blank. A blank isn't proof the token is safe. It's a check you couldn't finish.

Telling a Rug Pull Apart From Ordinary Volatility

The mistake that costs people a second bag is simple. The price fell, so it must have been a rug. A price drop alone is not sufficient to establish that a rug pull occurred. Legitimate tokens crash hard inside a single afternoon. Memecoins do it without anyone pulling a pool.

What separates the two is what else moved in the same window. Liquidity leaving in a hurry, a creator wallet waking up, and sells that fail are a different event from a crowd of unrelated sellers hitting a pool that is still there.

Rug pull signals versus ordinary volatility

Use the right-hand column as the default until the left-hand column shows up in more than one row. A quiet creator plus a pool that shrinks as people sell is a bad trade, not a planned exit. Beginners misread that chart because the candle looks identical.

Why you keep the evidence anyway

The base rate on new Solana launches is ugly enough that "I'll remember the mint later" is a bad plan. Recent Solana research analyzed 100,063 newly issued tokens during the first half of 2025 and identified 76,469 as rug-pull tokens, with at least $151 million in direct losses across 7,322 profiting addresses. "The token is down" still doesn't prove a rug. A rapid liquidity withdrawal, freeze-authority abuse, or a coordinated insider exit is the stronger evidence, and you can only show those if you saved the transactions.

In the first hour, record:

• Token address: the mint, copied from the explorer, not typed from a screenshot of the name.
• Transaction hashes and timestamps: the pool withdrawal, the creator transfers, and your own failed sell.
• Pool and creator-wallet activity: balances before and after, plus any hop into a new wallet.
• Screenshots: the chart, the authority fields, and the exact error on a failed sell.
• The report: what you sent to the exchange or the relevant authority, and when.

Blockchain transfers are generally irreversible. Cross-chain hops can obscure the flow quickly, and these scams often run as repeatable groups of wallets rather than one developer who panicked. Reporting doesn't guarantee recovery. It does keep a record if an exchange freezes a deposit later.

Treat a token as a suspected rug only when a liquidity exit, authority abuse, or coordinated insider selling shows up with the price drop. One of those, on its own, is a lead. Together, they're a case.

Your Next Step Before Buying a Memecoin

A clean check lowers risk. It doesn't make a token safe. Decide that before you enter, using the note you already wrote, not a fresh scroll through the chart.

Three gates, and all three have to pass.

The mechanics agree. Authority fields, pool control, and the sell test point the same way. If the freeze authority is live, or the test sell failed, you stop. You don't average that against a pretty website.

The people agree. Creator-linked wallets and holder concentration don't show a coordinated insider sale waiting to happen. Suspicious or possibly connected wallets are items to examine, not proof of misconduct. Missing data isn't proof of safety either.

The loss is sized first. The amount is money you can lose entirely, set before the buy, not after the candle turns red. You can lose all of the money invested in a memecoin even without a rug pull.

A lower rug-pull risk rating doesn't mean a token is safe, and a higher health score doesn't mean its price will rise. Our free scanners are a reasonable first pass. A full Solana token analysis returns four outputs: an Overall Health Score, a Rug Risk Rating, a plain-English AI Verdict, and a Detailed Risk Breakdown. Those outputs organize the same evidence. They don't replace the decision.

Buy only when the checks converge and the loss is already an amount you can walk away from. Otherwise wait, or don't buy. Set the exit before you enter, while you can still stand to use it.

MemeAssist reads a Solana memecoin's live liquidity, holder concentration, creator wallets, and trading patterns into one explained risk report, so a rug pull check isn't five browser tabs and a guess. If you're about to buy from a mint address, run it through MemeAssist before the position is bigger than the evidence.