Rug pulls: the mechanics and the warning signs

A rug pull is a scam where the people behind a crypto project take investors’ money and abandon it, leaving holders with a token that is worthless or impossible to sell. The name captures the feeling: the ground is pulled out from under you. Rug pulls range from crude smart-contract traps to slow, elaborate cons, but they share a common shape once you know what to look for.

This is an awareness guide. The point is not how these scams are built, but how they behave from the outside — the warning signs a careful person can spot before putting money in.

The basic anatomy

Most rug pulls follow a familiar arc. A team launches a new token or project with heavy marketing and promises of fast returns. They attract buyers, which pushes the price up and pulls in more people through fear of missing out. At the peak, the insiders extract the value — by selling their large holdings, draining the pool of real assets, or disabling the ability to sell — and then vanish. Websites go dark, social accounts are deleted, and the token collapses.

What makes rug pulls distinct from ordinary project failures is intent. A legitimate project can fail honestly. A rug pull is engineered from the start to enrich insiders at the expense of everyone else.

It helps to see where the money actually comes from. In most of these schemes there is no real business generating returns; the “profits” early participants see are simply later participants’ money, plus the price rise that new buyers create. That structure has an obvious consequence: it depends on a constant flow of new entrants, and it collapses the moment that flow slows or the insiders decide to cash out. Recognising this makes the whole category easier to smell — if you cannot explain where a project’s returns genuinely originate, assume they originate from the next buyer.

The main mechanics, at an awareness level

Understanding the general categories helps you recognise the risk without needing to read code:

• Liquidity removal. For a token to be tradable, someone provides a pool pairing it with a real asset. If the team controls that liquidity, they can withdraw it all at once, leaving holders unable to sell at any meaningful price.
• Honeypot contracts. The token is coded so ordinary buyers can purchase but cannot sell — transfer or blacklist functions block exits while insiders remain free to cash out. Our guide to verifying a contract address covers how to spot these functions.
• Unlimited minting. The contract lets insiders create new tokens at will, diluting everyone else’s share toward zero.
• Slow rugs. Rather than one dramatic exit, insiders sell steadily into the buying pressure they manufacture, bleeding the project over weeks or months while insisting everything is fine.

Several of these overlap with the drainer and approval risks in our piece on token approvals, because a “claim” or “presale” page can also harvest signatures.

Hard rugs, soft rugs, and NFT rugs

It helps to distinguish the varieties, because the warning signs differ slightly:

• Hard rugs are the sudden, technical kind: liquidity yanked, selling disabled, or the treasury drained in a single move. These are often detectable in advance by reading the contract and liquidity terms, because the trap has to be built into the code.
• Soft rugs are behavioural rather than technical. The team quietly dumps its holdings, stops developing, and lets the project wither while still posting upbeat updates. There may be no single illegal action — just abandonment after cashing out — which makes them harder to spot early.
• NFT rugs apply the same playbook to collectibles: an art or “utility” project sells out on the promise of a roadmap, then the team disappears and the promised game, community, or benefits never arrive. Concentrated minting, anonymous teams, and roadmaps heavy on hype are the usual tells.

Across all three, the underlying signal is the same: are insiders positioned to profit at holders’ expense, and is there any real accountability if they choose to?

The warning signs

No single flag is conclusive, but rug pulls tend to broadcast several of these at once:

• Anonymous team with no accountability. Anonymity is common in crypto and not damning by itself, but combined with big promises it removes any recourse.
• Guaranteed or outsized returns. Promises of guaranteed profit, fixed high yields, or “risk-free” gains are a hallmark of fraud in every market.
• Extreme urgency. Countdown timers, “presale ending,” and pressure to buy now are designed to stop you from checking.
• Concentrated token ownership. A handful of wallets holding most of the supply can crush the price the moment they sell.
• Unlocked or team-controlled liquidity. If the team can pull the pool at any time, holders are exposed by design.
• Unverified contract with functions that block selling or mint freely.
• Hype far exceeding substance. Heavy influencer promotion and a vibrant chat, but a vague or plagiarised whitepaper and no working product.
• Manufactured social proof. Bought followers, bot-filled channels, and comment sections where any hard question is deleted.

How to check before you commit

A short due-diligence routine filters out most rug pulls:

• Read the contract on a block explorer. Look for verification, ownership concentration, mint ability, and sell-blocking functions.
• Check whether liquidity is locked and for how long. Team-controlled, unlocked liquidity is a major red flag.
• Investigate the team and track record. Do the named people exist and have a verifiable history, or is it all anonymous claims?
• Discount the marketing. Ask what actually works today versus what is merely promised. Urgency is a reason to slow down, not speed up.
• Assume you could lose it all. The oldest rule holds: if something guarantees high returns with no risk, that is the scam.
• Check how you would exit before you enter. Can the token actually be sold, by ordinary holders, on a liquid market? If the only way “out” is to recruit the next buyer, you are the exit liquidity.

It is worth being honest that no checklist is perfect. Determined scammers can fake locked liquidity, buy plausible-looking audits, and rent an audience. Due diligence does not give certainty; it removes the crude traps and forces the sophisticated ones to work much harder, which is often enough to make them move on to an easier target. The remaining risk is why the only money that belongs in a speculative token is money you can afford to lose entirely.

Regulators repeatedly warn that guaranteed-return crypto offers are a leading fraud pattern; consumer-protection guidance on crypto scams is worth reading before any speculative buy.

If you have already been caught

Rug pulls are usually final, because the transactions are legitimate on-chain movements by the people who controlled the project. Still, sensible steps:

• Stop sending more money — “recovery services” that promise to get funds back for a fee are frequently a second scam.
• Revoke any approvals you granted the project, in case the contract retains spending permission over other tokens.
• Report it to the relevant national fraud or financial-crime authority; reporting helps investigators map these networks even when your own funds are gone.

Bottom line

A rug pull is a con with a technical wrapper: insiders build hype, absorb other people’s money, and then extract the value through liquidity removal, sell-blocking code, or a slow drain. The defence is unglamorous but effective — distrust guaranteed returns, read the contract and liquidity terms, weigh substance against hype, and let urgency be your cue to walk away rather than rush in. In speculative crypto the safest assumption is that you could lose everything, and the projects worth your money are the ones that survive that scrutiny.