What Is a Rug Pull: A Plain-English Guide for 2026
Learn what is a rug pull in crypto, how liquidity drains and insider exits really work, the red flags to spot early, and practical steps to avoid getting hit.
Published
Updated
A rug pull is an insider-controlled exit where developers attract buyers, then remove liquidity, restrict selling, or disappear with the funds. Rug pulls generated more than $2.8 billion in stolen cryptocurrency during 2021, responsible for 37% of all cryptocurrency scam revenue that year.
You're probably reading this with a chart open in another tab. The token launched recently, the price ran fast, and now it's falling just as fast. You're trying to work out whether you caught a normal dip or whether the people behind the token just walked away with the exit money.
That distinction matters, because the answer changes what you do next. A bad trade can recover. A token with no liquidity left usually can't, no matter how patient you are.
Table of Contents
- A Rug Pull in Plain English
- How a Rug Pull Actually Works On-Chain
- Six Red Flags You Can Actually Check
- Real Rug Pulls and What They Teach Us
- Why Speed Matters More Than Audits
- Tools That Help Versus Tools That Don't
- A Pre-Buy Checklist for Your Next Trade
A Rug Pull in Plain English
You're staring at a freshly launched token. Minutes ago the chart looked strong. Now it's a near-vertical drop, sells are failing or returning almost nothing, and the social accounts have gone quiet. You want to know if you got rugged or bought a volatile token at the wrong moment.
Think of a house of cards built by someone who already knows which card to pull. From the outside it looks like a real structure. Other people add cards because it seems to be standing. Then the builder removes the supporting card, takes what's valuable, and leaves everyone else holding scattered pieces.
That's the plain answer to what is a rug pull. It's an exit scam. Developers create a project that looks legitimate, attract investor funds, then abruptly remove liquidity, withdraw project assets, or disappear without delivering what they promised.
What a Rug Pull Is Not
A price drop alone isn't proof. Tokens fall because early buyers take profit, because broader markets drop, or because a launch fails to find demand. Those losses hurt, but they don't automatically mean insiders stole anything.
An exchange hack is different too. In a hack, an outside attacker breaks in. In a rug pull, the threat sits inside the project, with the people who control the code, the treasury, or the liquidity pool.
A rug pull needs insider control plus a deceptive or abusive exit. Volatility alone doesn't meet that bar.
That control is the common thread. Insiders may hold the power to withdraw pooled assets, mint new supply, freeze wallets, or change transfer rules. When one small group holds those powers, ordinary holders depend on that group's honesty rather than on enforceable limits.
The scale grew quickly once this pattern moved into decentralized finance. The jump from only 1% in 2020 is documented in Chainalysis reporting on 2021 crypto scam revenues. Functional-looking tokens gave scammers a new route. They no longer needed a fake website alone. They could launch a tradable asset, build visible activity, and use technical privileges at the exit.
So keep one repeatable definition. A rug pull happens when project insiders use their control to take the value or block the exit, then leave holders behind. If you can't identify who holds that control, you don't yet understand the token you're buying.
How a Rug Pull Actually Works On-Chain
A typical rug starts with a launch that looks ordinary. Developers create a token and pair it with a valuable asset, often SOL on Solana, in a liquidity pool. That pool is the shared pot that lets people swap in and out without finding an individual buyer for every trade.
Next comes promotion. The team posts on social channels, pays for visibility, or seeds early trading that makes the chart look alive. As new buyers swap SOL into the pool, they receive the new token, and the pool's SOL side grows. That growing pot is exactly what makes the exit profitable.
Why Removing Liquidity Kills the Price
Most decentralized pools use an automated market maker, a formula that sets price from the ratio of the two assets in the pool. If the controlling wallet removes the SOL side, there's almost nothing left to pay sellers. Your wallet still shows the token balance, but a sell order now returns close to nothing because the reserves behind the quoted price are gone.
That pattern has a measurable on-chain fingerprint. Chainalysis classified possible Ethereum pump-and-dump tokens as assets traded at least five times before one address removed at least 70% of pool liquidity, leaving less than $300, with 90,408 such tokens identified in 2023 and an estimated aggregate profit of $241.6 million, as summarized in Blockworks coverage of the Chainalysis rug pull report.
The Second Exit Channel in the Code
Some rugs never need a dramatic pool withdrawal. The token contract itself can block your exit through transfer restrictions, extreme sell taxes, blacklists, or maximum transaction rules that apply to you but not to insiders. A honeypot is the clearest version. Buying works fine. Selling doesn't.
Other code powers create quieter exits. If insiders can mint unlimited new tokens, they can create supply from nothing and sell it into the pool. If they hold a large hidden allocation across related wallets, they can distribute it gradually while telling the community that development continues. That's often called a soft rug, and it has no single collapse moment.
Three shapes cover most cases you'll meet:
- Hard rug: Liquidity or treasury assets get removed and the token becomes effectively untradeable.
- Soft rug: Insiders sell down their holdings slowly or abandon the project while the price bleeds out.
- Failed launch: Demand disappears without clear evidence that insiders extracted funds through privileged control.
Keeping those categories separate protects you twice. You won't excuse a real theft as bad luck, and you won't label every failed speculation as fraud.
Six Red Flags You Can Actually Check
You don't need to read raw contract code to catch most warning signs. You need six observable checks, done before you buy, while walking away still costs nothing.
Liquidity and Who Controls It
- Liquidity depth against valuation: Compare the pool size with the token's fully diluted valuation. A huge valuation resting on a thin pool means small sells move the price violently and exits are fragile.
- LP authority: Find out who can withdraw the pool and whether LP tokens are locked or burned. One wallet with unrestricted control of the pool means one transaction can end the market.
A healthy reading shows liquidity that's meaningful relative to market cap and not removable by a single insider wallet on a whim. A dangerous reading shows the opposite. The pool is the exit door, so always ask who holds the key.
Supply, Creator, and Sellability
- Holder concentration: Check the largest wallets on a block explorer. A few wallets holding most of the supply can crash the price by selling, even without touching the pool.
- Creator history: Look at the deploying wallet's earlier tokens. A trail of short-lived launches from the same creator is a pattern, not a coincidence. A step-by-step method for spotting coordinated supply is covered in this guide to checking if a Solana token is bundled.
- Sell restrictions: Simulate or test a small sell before committing real size. Hidden taxes, blacklists, and transfer limits only reveal themselves when you try to leave.
- Trading patterns: Watch for bundled buys in the same block, wallets trading back and forth with each other, or volume that looks manufactured. Artificial activity exists to make you believe demand is real.
Sellability deserves special weight because displayed value means nothing without it. Researchers reported that by the tenth swap, 94% of observed new-token market value was trapped in honeypots, leaving only 6% represented by tokens that remained sellable, while owner-controlled liquidity made ordinary exits impossible, in a Springer study of newly issued tokens and honeypot traps.
Practical rule: Treat one flag as a question and several flags together as an answer. No single signal proves fraud, and no single clean signal proves safety.
That balance matters for new tokens especially. Thin liquidity and concentrated holders are common in the first minutes of any launch. You're looking for combinations, insider-linked wallets, plus locked liquidity, plus restricted sells, that point in one direction.
Real Rug Pulls and What They Teach Us
Names and dates help because the pattern repeats across very different setups. A centralized exchange, a DeFi launch, and a fast Solana meme coin can all fail the same way. Insiders control the assets, users supply the value, and the exit closes.
Thodex and the Centralized Version
Thodex was a Turkish cryptocurrency exchange that halted withdrawals in 2021 before its founders disappeared. Users had deposited funds with an apparently operating business. Then access stopped, because the people running the infrastructure also controlled the money.
The 2021 collapse of Thodex alone accounted for roughly 90% of the total value attributed to rug pulls that year, while AnubisDAO lost about $58 million and Uranium Finance lost approximately $50 million in the same period, according to the Chainalysis 2022 Crypto Crime Report introduction. Thodex isn't the classic token-pool scenario, but the lesson transfers directly. Custody plus opacity equals exit risk, whatever the wrapper.
AnubisDAO and the DeFi Version
AnubisDAO was a dog-themed project launched in October 2021. It attracted tens of millions quickly on the strength of a theme and social momentum. Then the pooled funds disappeared, and buyers were left with tokens backed by nothing.
Which red flags were visible beforehand? A brand new project, anonymous control, and large sums gathered before any track record existed. What wasn't visible was intent. You can't observe intent on-chain. You can only observe whether the structure makes a theft possible, and price your trust accordingly.
The Fast-Launch Version You'll Actually Meet
A representative Solana meme coin looks smaller but moves faster. A creator launches, related wallets buy early in a bundle, the chart spikes, and promotion follows the spike rather than preceding it. Then insider wallets sell into incoming demand, or the pool gets pulled, and late buyers discover the exit was never really open to them.
That sequence is dissected transaction by transaction in this untied bundler rug case study. Read cases that way, as a chain of checkable events. You're training pattern recognition, not memorizing names.
Why Speed Matters More Than Audits
Most beginner advice assumes you have time. Check the website, read the audit, review the socials, wait for a track record. That advice fits slow projects. It fits a Solana meme coin launch badly, because the decisive events often happen before any of that homework is possible.
A study covering 6.4 million tokens over seven months found that most exhibited rug-pull characteristics within the first hour, with machine-learning models identifying risk using only the first five minutes of trading data, as reported in research on early rug-pull detection across millions of tokens. The useful detection window isn't days. It's minutes.
What Five Minutes Can and Cannot Tell You
Early data can show real things. You can see initial liquidity size, whether the creator's linked wallets bought in a coordinated bundle, how concentrated the first holders are, and whether trading looks like genuine two-way activity or a closed loop of related wallets.
It can't prove intent, and it can't certify safety. Every legitimate new token also starts with thin liquidity, few holders, and unstable prices. Those overlaps create false positives, while careful insiders who behave neatly at launch can still exit later.
Early screening gives you a probability, not a verdict. Anyone selling certainty about a five-minute-old token is overselling.
That's why a static badge is the wrong mental model. An audit written before launch can't see liquidity removed after launch. A score cached an hour ago can't see a holder distribution that changed ten minutes ago. Ownership, liquidity, and sellability are moving targets on a fast chain.
The Better Standard to Demand
Ask for live, timestamped evidence. A useful risk signal shows when it was computed, which wallets and pools it examined, and what would change the reading. Then recheck. A token that looked acceptable at launch deserves a fresh look once trading develops, because the second reading often reveals what the first one couldn't.
This doesn't make audits worthless. Audits can catch dangerous contract permissions before trading starts. But an audit is a snapshot of code, while a rug pull is an event in time. You need the tool that matches the event.
Tools That Help Versus Tools That Don't
You have three broad options before a buy. Each one trades speed against depth, and none of them removes risk entirely.
Trusting the chart alone is the fastest option and the weakest. Price and volume are the easiest signals for insiders to fake, since coordinated wallets can manufacture both. The chart shows you what someone may want you to see.
Free public tools improve on that. Block explorers, DEX screeners, and holder pages show genuine on-chain data at no cost. The catch is fragmentation. You're stitching together liquidity in one tab, holders in another, and creator history in a third, while the token ages by the minute.
Structured analyzers exist to close that gap. MemeAssist, for example, generates on-demand Solana token reports from live data across liquidity, holder concentration, creator behaviour, wallet activity, and trading patterns, combining a Rug Risk Rating with a plain-English explanation and no wallet connection required.
Rug-Pull Screening Approaches Compared
| Approach | What it shows | What it misses | Best fit |
|---|---|---|---|
| Chart only | Price, volume, momentum | Liquidity control, holder links, sell restrictions | Nobody making a serious buy |
| Free public tools | Raw pool, holder, and transaction data | Combined interpretation and speed | Patient traders checking one signal at a time |
| Structured analyzer | Scored, combined evidence with explanation | Certainty about insider intent | Traders who need a full picture in minutes |
Pick based on your holding period. If you're buying something minutes old, a workflow that takes an hour will always arrive late. If you're researching established tokens, free tools and primary sources may be enough. Either way, treat every tool's output as evidence to weigh, not permission to buy.
A Pre-Buy Checklist for Your Next Trade
Run these checks in order, fastest first. Stop the moment one step fails badly, because later steps can't rescue a broken exit.
- Compare liquidity with market cap: Confirm the pool is deep enough that your own sell wouldn't collapse the price.
- Identify who can move the pool: Check whether LP tokens are locked, burned, or sitting in one insider wallet.
- Scan the top holders: Look for a small cluster controlling most supply, and check whether those wallets connect to the creator.
- Review the creator's other tokens: A history of dead launches is information, not bad luck.
- Test a small sell: Verify that selling works and that taxes or limits don't trap you. The full sequence is laid out in this free Solana rug check workflow.
- Read recent trading: Bundled buys and circular volume mean the demand may be staged.
The habit matters more than any single check. Stop asking whether you trust the project. Start asking whether you can verify these signals right now, while walking away is still free.
Before your next Solana meme coin buy, run the token through MemeAssist to get a live Rug Risk Rating, a plain-English verdict, and a detailed breakdown of liquidity, holder concentration, creator behaviour, and trading patterns. Your first full analysis is free and no wallet connection is required, so you can check the exit before you enter.