Yesterday in crypto, explained
FUELEDCRYPTO
Subscribe — free

Beginner Guide

How to Spot a Rug Pull (and Other Token Red Flags)

Deck: A rug pull is when the people behind a token pull the money out and leave buyers holding something they can't sell for much. Here's how it works, the warning signs that tend to show up first, and why "liquidity is locked" doesn't settle the question.

Last reviewed: October 24, 2026

I used to think a rug pull meant the website went dark one night. Sometimes it does. But more often, the token still exists afterward. You can still see it in your wallet. There's just nothing left to sell it into.

This guide explains the mechanics in plain English, with made-up tokens and people so nothing here reads as a pick or an accusation. It's a deeper version of the short rug pull section in our scam guide.

The short version

  • A rug pull is a fraud. The people behind a new token attract buyers, then drain the money or abandon the project.
  • The money usually sits in a trading pool. Whoever controls that pool's "LP tokens" can often withdraw it.
  • Some tokens can't be sold at all. These "honeypots" let you buy but block you from selling.
  • "Liquidity locked" isn't a guarantee. Locks expire, can cover only part of the pool, and the claim itself can be false.
  • Red flags cluster. Guaranteed returns, pressure to buy now, anonymous teams and owner powers in the code tend to show up together.
  • If it happens, report it. IC3 and the FTC take reports in the U.S.

What a rug pull is

Chainalysis, a blockchain analytics firm, defines it this way: "A rug pull is a fraud specific to decentralized finance (DeFi) and token launches. Developers create a new cryptocurrency or DeFi protocol, attract investors by promoting high yields or speculative token appreciation, and then abruptly drain the liquidity pool or abandon the project after accumulating significant funds."

To see how the draining works, you need one idea first: the trading pool.

How a liquidity pull works

Many new tokens trade on decentralized exchanges through a liquidity pool, a smart contract holding two things side by side, such as a dollar stablecoin on one side and the new token on the other. Buyers put money in and take tokens out.

Whoever deposits into the pool gets LP tokens (liquidity provider tokens), which work like a claim ticket on the pool. The SEC explains the risk in a 2025 enforcement release: "absent safeguards, the holders of LP tokens can, without warning, withdraw liquidity from a liquidity pool, sell significant amounts of crypto assets into the pool and cause losses to investors. Such trading behavior is commonly known in the crypto asset industry as a 'rug pull.'"

Here's a made-up example with a made-up token called PUFF:

The token still exists after a liquidity pull. What's gone is the money on the other side of the pool. Made-up example. Animation: Fueled Crypto.
  1. PUFF launches with a pool holding $20,000 and a pile of PUFF.
  2. Sam, Ana and Lee (all made up) buy in. Their $60,000 goes into the pool, and PUFF's price climbs.
  3. An insider who holds the pool's LP tokens withdraws the liquidity.
  4. Sam, Ana and Lee still hold PUFF, but there's almost nothing in the pool to sell it into.

Chainalysis lists the on-chain signs afterward as a "sudden liquidity drop" and "developer wallets empty." You can often see this on a block explorer, but by then the money has usually left.

Other ways a rug happens

A liquidity pull is the classic version, but not the only one:

  • Insider dump. Team or early wallets hold a big share of the supply and sell it all at once into buyers' demand. Our market cap and supply guide explains why supply concentration matters.
  • Honeypot. The token's code lets people buy but stops them from selling (more below).
  • Slow rug or abandonment. The team stops building, stops talking, and quietly moves funds out over time.

Red flags that tend to show up first

No single sign proves a token is a scam, and a token with none of them can still fail. But these show up again and again in regulator warnings and security research:

Grid of eight red flag cards: liquidity isn't locked or the lock ends soon; insiders hold a big share; the owner can block sellers, move balances or set sell limits; hardly anyone has sold; guaranteed returns like risk-free or 10x; pressure to buy now with countdowns and presales; no one accountable, with an anonymous team or copied site; and an unverified contract.
One flag isn't proof. Several together are a warning. Diagram: Fueled Crypto.
  • Promises of safe, high returns. The CFTC warns that claims like "'risk-free', 'zero risk', 'absolutely safe', and 'guaranteed profit' are hallmarks of a fraud."
  • Urgency. The CFTC also lists "Pressure to buy RIGHT NOW" as a warning sign. Presale countdowns and "last chance" posts are the token version.
  • Unsolicited tips. A DM or group post you didn't ask for, pushing a token, fits the CFTC's "Unsolicited offers" warning.
  • No one accountable. An anonymous team isn't automatically a scam, but it means there's no one with a reputation at stake. Chainalysis lists an "unverifiable team" as a fake token sale red flag.
  • Owner powers in the code. Some contracts let the owner block wallets from selling or move tokens between wallets, as security firm CertiK documents.
  • Concentrated supply. A few wallets holding most of the tokens could sell at once.
  • Code you can't check. If the contract isn't published and verified on a block explorer, there's no way for anyone to read what it does.

The honeypot: when you can buy but can't sell

CertiK describes honeypot contracts as "tokens which users are able to buy but are then unable to sell, making them worthless despite their appearance." The tricks vary: a hidden blocklist for sellers, a "minimum sell amount" set impossibly high, or an owner function that moves tokens out of wallets.

That creates a strange-looking chart.

A made-up chart for Token Q over 24 hours showing only rising green candles, next to counters showing 1,240 buys and 2 sells. A note explains that a honeypot token lets people buy but not sell, and CertiK flags an all-green chart with zero or a very small sell count as a warning sign.
Only green candles can look exciting. Here, it's the warning. Made-up chart and numbers. Diagram: Fueled Crypto.

In CertiK's words: "If you encounter an all green chart, with zero or a very small sell count then this is a good indication that you have encountered a honeypot contract." It adds that this calls for extreme caution, "especially if it is being promoted in a trading channel." Our chart reading guide covers candles if they're new to you.

Why "liquidity is locked" isn't a guarantee

Locking liquidity means the LP tokens are placed somewhere the team can't withdraw them, usually a time-lock contract, for a set period. It's a real safeguard when it's real. But it has limits.

Diagram titled Liquidity is locked isn't a guarantee. A box explains that locking is supposed to keep LP tokens out of the team's reach for a set time. Four cards list the gaps: the claim may be false, as in an SEC case; locks expire; only part of the pool may be locked; and insiders can still sell their tokens.
Check the lock yourself on a block explorer when you can. Diagram: Fueled Crypto.
  • The claim can be false. In one January 2025 case, the SEC alleged that a token's founders told investors in social media posts that "liquidity" was "locked," while an engineer hired to do coding work for the token kept certain LP tokens unlocked and used them for a rug pull, taking about $553,000. He settled without admitting or denying the allegations, subject to court approval.
  • Locks expire. A lock that ends next month protects buyers until next month.
  • Only part may be locked. A lock can cover a slice of the pool and still be advertised as "locked."
  • It doesn't stop selling. Locked liquidity doesn't prevent insiders from dumping the tokens they already hold.

If you think you've been rugged

  • Don't send more money to anyone who promises to "unlock" or "recover" your tokens for a fee. That's a common follow-up scam.
  • Save everything: transaction IDs, wallet addresses, screenshots of the site and chats.
  • Report it. In the U.S., Chainalysis points to the FBI's Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov.
  • Check your approvals. If you connected a wallet to the token's site, review and revoke the approvals you gave. Our token approvals guide walks through it.

Our What to Do If Your Crypto Is Stolen guide has the full checklist.

Common mix-ups

  • "The token still exists, so it wasn't a rug." A rug pull usually leaves the token behind. It's the money on the other side of the pool that's gone.
  • "Liquidity is locked, so it's safe." Locks can be partial, short or misrepresented, and they don't stop insiders from selling.
  • "An audit means no rug." An audit reviews code. It doesn't control what the team does with its tokens or LP tokens.
  • "A price that only goes up is a good sign." With no sells, it can mean no one is able to sell.
  • "Every failed token was a rug pull." Many projects fail without fraud. A rug pull involves deception or deliberately taking buyers' money.
  • "Anonymous always means scam." Not always. It does mean less accountability, so other checks matter more.

Words you'll keep hearing

  • Rug pull: a fraud where a token's creators drain its money or abandon it after attracting buyers.
  • Liquidity pool: a smart contract holding two assets so people can trade between them.
  • LP tokens: claim tokens given to whoever deposits into a liquidity pool.
  • Locked liquidity: LP tokens placed in a time-lock so they can't be withdrawn for a set period.
  • Honeypot: a token designed so buyers can't sell.
  • Dump: a large, sudden sale that pushes the price down.
  • Verified contract: smart contract code published on a block explorer so anyone can read it.
  • Presale: a sale of tokens before public trading starts.

Frequently asked questions

What is a rug pull in crypto? A fraud where the people behind a new token or DeFi project attract buyers, then drain the trading pool or abandon the project with the money.

How does a rug pull actually work? The money buyers pay often sits in a liquidity pool. Whoever holds that pool's LP tokens can withdraw it, leaving buyers with tokens they can't sell for much.

Does "liquidity locked" mean a token is safe? No. Locks can expire, cover only part of the pool, or be claimed falsely. They also don't stop insiders from selling the tokens they hold.

What is a honeypot token? A token whose code lets people buy but blocks or limits selling. An all-green chart with almost no sells is a common warning sign.

Can I get my money back after a rug pull? Often it's very difficult. Report it to IC3 and the FTC in the U.S., keep records, and ignore anyone offering paid "recovery."

Is an anonymous team always a red flag? Not always, but it removes accountability. Combined with other flags like guaranteed returns or unlocked liquidity, it's a stronger warning.

Is every crypto project that fails a rug pull? No. Many projects fail honestly. A rug pull involves deceiving buyers or deliberately taking their money.

Where to go next

Sources

All diagrams and animations are original Fueled Crypto graphics. PUFF, Token Q, "Dev" and everyone in the examples are made up.

Fueled Crypto publishes news and education, not investment, tax, or legal advice. Crypto assets are volatile and can lose value. Do your own research and consider a licensed professional before making financial decisions. See our full disclaimer.

Want plain-English crypto news once a week? Subscribe to Fueled Crypto.

Educational only. Not financial, investment, tax, or legal advice. Do your own research. Read the full disclaimer.