Most Solana tokens launched in the past week are scams. The answer to “is this token safe?” depends on four things: who controls the mint authority, how concentrated the supply is, whether the liquidity is locked, and what the transaction history actually shows. Check these before you move any money.

Why Solana is a high-scam environment

Solana’s low fees make it the cheapest chain to launch and promote a scam token. A new SPL token costs under a dollar to deploy. Automated market makers like Raydium accept any token immediately. A motivated team can launch, promote on Twitter and Telegram, pump the price, and drain the pool in under two hours.

The speed and low cost that make Solana useful also make it a playground for hit-and-run schemes.

Signal 1: Mint authority

The mint authority is the account that can print new tokens at will. If it has not been revoked, the deployer can dilute every holder at any moment.

How to check: paste the token address into Solscan or Solana Explorer and look at the “Mint Authority” field. If it shows an active wallet address instead of “None,” treat that as a hard stop until you understand who controls it and why they kept it.

Legitimate projects either burn the mint authority at launch or transfer it to a time-locked multisig with public signers. If neither of those is documented, the authority is a risk.

Signal 2: Freeze authority

The freeze authority can freeze any token account, preventing you from selling. It is the Solana equivalent of the EVM honeypot sell block.

Check the “Freeze Authority” field on Solscan. It should be “None.” If it is set to any wallet, every account holding this token can be frozen at will.

Signal 3: Supply concentration

Pull up the token’s holder list on Solscan. Sort by percentage. Healthy distribution shows the top ten wallets holding 20-30% collectively. Red flags:

  • One wallet holds more than 20% (not counting a known burn address or the token’s own treasury with transparent docs).
  • The top five holders are all newly created wallets from the same day.
  • A cluster of wallets holds 50%+ and they all transacted with the deployer within the first hour.

Concentrated supply means whoever holds it can dump on buyers the moment there is enough liquidity to exit.

Signal 4: Liquidity locked or burned

Solana liquidity pairs on Raydium or Orca generate LP tokens. If the project team holds all the LP tokens, they can remove all liquidity in one transaction - this is a rug pull.

Check whether LP tokens are sent to a burn address (So11111... or deadd...) or locked in a third-party lock contract (Streamflow, Wormhole-compatible lockers). If you cannot find a verifiable lock with an expiry date, assume the liquidity is removable at any time.

Signal 5: Transaction history

Do not just look at the price chart. Look at what actually happened on-chain.

Solscan’s transaction history for the token will show:

  • Initial transactions. Did the deployer buy a large amount immediately at launch? That is a pre-allocation that will be dumped.
  • Sell-to-buy ratio. If there are 2,000 buys and 12 sells, either the token launched 15 minutes ago or something is blocking sells.
  • Wallet age. New wallets funding themselves from a single source and all buying at launch is a coordinated shill operation.

Signal 6: Metadata and social presence

Legitimate tokens have verifiable metadata: a project site, a GitHub with actual code, a Telegram or Discord where the team answers questions. The metadata fields on Solscan show the name and symbol the deployer set.

Look for:

  • A project site with a real domain registered more than a week ago.
  • GitHub with actual smart contract code or SDK - not just a landing page repository.
  • A team with persistent identities. Anonymous is acceptable; uncontactable is not.

Scam tokens typically have metadata that mimics a well-known project (USDC, SOL, JUP) with a slight spelling variant or extra character, or they have a flashy website created the same day the token launched.

Signal 7: Verified vs. unverified on major aggregators

Jupiter, Birdeye, and DexScreener all have verification tiers. Tokens verified by these aggregators have passed basic checks. Unverified tokens can still be legitimate, but they have not passed any external review.

On Birdeye, look for the blue checkmark on the token page. On DexScreener, check whether the project linked its socials and had them reviewed. These are soft signals, not guarantees, but they filter out the lowest-effort scams.

How to run a structured check

  1. Get the token mint address - not the name, the address.
  2. Open Solscan. Check mint authority (must be None), freeze authority (must be None), holder concentration (no single wallet above 15-20% unless documented treasury).
  3. Check LP token custody - burned or locked with a verifiable expiry.
  4. Read the last 50 transactions. Count buys vs. sells. Check wallet ages.
  5. Search for the project name plus “rug” and “scam” on Twitter. Scam reports often appear within hours.
  6. For EVM-compatible wrapped versions of this token, run it through Web3defender’s token scanner.

If any of these steps raises a flag you cannot explain, do not buy.

What the scanner cannot tell you

An automated check catches structural scams: revocable mint, revocable freeze, honeypot sell block, concentrated supply. It cannot verify that the team will actually ship a product, that the tokenomics are sound, or that the project is not a slow rug where the team drains funds over months rather than minutes.

On-chain checks are necessary. They are not sufficient.

FAQ

Can a Solana token scam you even with a clean on-chain profile? Yes. A well-constructed slow rug can pass every structural check. The team raises money, builds nothing, then sells their locked tokens the moment the lock expires. Clean on-chain structure reduces risk; it does not eliminate it.

Does renouncing mint authority make a token safe? It removes one attack vector. Supply concentration, removable liquidity, and team behavior are independent risks that remain.

Why do scam tokens often copy the name of legitimate projects? SPL token names and symbols are metadata set by the deployer with no uniqueness constraint. Any wallet can deploy a token called “USD Coin” with symbol “USDC.” Always verify by mint address, never by name.