A rug pull is a planned exit scam. The team raises money through a token or NFT sale, waits for liquidity to peak, then removes the funds and disappears. The signals are visible before the pull if you know where to look. The most reliable early warning is unlocked liquidity combined with concentrated supply and anonymous, unaccountable founders.
What a rug pull looks like on-chain
There are two main execution methods:
Hard rug: The team calls removeLiquidity() in one or a few transactions. The token price collapses to zero in seconds. All liquidity is gone. Holders are left with tokens they cannot sell for anything.
Soft rug (slow rug): The team continuously sells their own supply over days or weeks while maintaining a positive social presence. Price bleeds out gradually. By the time community members notice, the insiders have already exited.
Both leave the same on-chain evidence if you look before the exit.
Pre-pull signal 1: Unlocked or unburned LP tokens
This is the most reliable structural signal. When a project adds liquidity to a DEX (Uniswap, PancakeSwap, Raydium), they receive LP tokens representing their share of the pool. If they hold those LP tokens, they can remove the liquidity at any time.
What to check:
- On Etherscan or BscScan, find the LP token contract for the trading pair.
- Look at the top holders of LP tokens.
- If the project wallet or deployer wallet holds a significant share, the liquidity is removable.
What legitimacy looks like:
- LP tokens sent to a dead address (0x000…dEaD or equivalent) - permanently burned, cannot be removed.
- LP tokens locked in a verifiable third-party contract (Unicrypt, Team.Finance, PinkLock) with a public unlock date at least six to twelve months out.
- A lock with a 48-hour unlock window is not protection - it gives the team time to remove before anyone acts.
Pre-pull signal 2: Concentrated supply in deployer-linked wallets
Pull up the token’s holder list on Etherscan. Sort by balance. Check:
- Does the deployer or a first-degree connected wallet hold more than 10-15% of the supply?
- Do multiple wallets in the top 10 all trace back to the same funding source (same wallet sent them their initial ETH)?
- Were large allocations distributed to wallets created on the same day the token launched?
These wallets are insider positions that will be sold. On a small token with thin liquidity, selling 15% of the supply guarantees a price crash.
Pre-pull signal 3: Owner can mint or pause
Find the token contract on Etherscan. Check whether it is verified (source code visible). Look for these functions:
mint()callable by owner - can print tokens to dilute holders and dump.pause()orblacklist()- can disable selling for non-team wallets while the team exits.setFee()- can raise the sell tax to 99% at any time, blocking economically viable sells.
If ownership has not been renounced and these functions exist, the team can execute a selective exit even after the token looks normal.
Pre-pull signal 4: Social signals of impending exit
Teams running toward an exit often behave differently from teams building:
- Roadmap deadlines pass without delivery or explanation.
- Team members’ Telegram and Twitter accounts go quiet or reduce posting frequency.
- The project pivots its narrative (“we are changing direction,” “v2 is coming”) without delivering v1.
- Community moderators who pressed for answers get banned or the chat goes into “slow mode.”
- The team asks for another fundraise (second presale, “strategic round”) before the first one’s stated use of funds is visible.
These are behavioral signals, not conclusive proof. But combined with on-chain risks, they form a pattern.
Pre-pull signal 5: Copycat contract
Many rug pull contracts are forks of other rug pull contracts with variable names changed. If the token’s code is verified on Etherscan:
- Look at the contract creation transaction. What contract did it fork from?
- Search for that parent contract. If the parent is associated with previous scams, the fork likely carries the same exit functions.
Etherscan’s “similar contracts” feature helps. DefiYield and Token Sniffer maintain databases of known exit-scam contracts and their derivatives.
Pre-pull signal 6: Paid promotions as the only marketing
A project spending heavily on influencer promotion but showing no organic community growth is optimizing for price at launch, not for product adoption. Watch for:
- Multiple paid influencer posts on the same day with identical or template-like wording.
- Call-to-action focused on price (“this is going 100x”) rather than product.
- Influencers who disclose paid promotion (legally required in many jurisdictions) but the disclosure is buried.
Marketing itself is not a red flag. Marketing as the only activity is.
How to combine signals into a risk judgment
No single signal is definitive. The risk compounds when multiple signals are present simultaneously:
| Signal | Alone | Combined with 2+ others |
|---|---|---|
| Unlocked LP | Medium risk | High risk |
| Concentrated supply | Medium risk | High risk |
| Mintable/pausable contract | Medium risk | High risk |
| Anonymous unaccountable team | Low-medium | High risk |
| Paid-only promotion | Low | High risk |
A project with all five has an extremely high probability of a planned exit. A project with one may simply be immature.
What to do with a position in a high-risk project
If you are already holding a token that shows multiple rug signals:
- Decide your exit price now, not when the event happens. Panic selling into a rug pull costs more in slippage than a planned exit.
- Set a trailing stop if your exchange supports it.
- Do not average down. More money into a structurally risky position increases loss, not return.
- Watch LP token movements on-chain. A large LP holder reducing their position is the closest thing to an early warning alarm.
The best time to check for rug signals is before you buy. The second best time is now.
FAQ
Can a project have unlocked liquidity and still be legitimate? Yes, especially very early in the launch when locking is still being set up, or if liquidity is held in a DAO treasury with on-chain governance. The key is whether there is a verifiable, public, enforceable reason the liquidity is held rather than locked. Founder’s word is not sufficient.
Does a token audit prevent rug pulls? Audits check code for security vulnerabilities and sometimes flag owner-privileged functions. They do not prevent the team from using those functions. An audit that says “owner can mint” is documenting a risk, not removing it. Read audit reports, not just whether an audit exists.
What is the difference between a rug pull and a failed project? Intent and conduct. A failed project runs out of money or capability but the team is transparent and no insider selling precedes the failure. A rug pull has insider selling ahead of the announcement, often combined with false statements about progress. The on-chain wallet activity during the final weeks usually makes the distinction clear in retrospect.