A rug pull is a crypto scam in which the creators of a token or project attract money from buyers and then abruptly withdraw liquidity, treasury funds or deposits, leaving holders with tokens that are worthless or impossible to sell. The name comes from the image of pulling a rug out from under someone standing on it.
In crypto & blockchain security, rug pulls are among the most common forms of fraud in decentralized markets because anyone can create a token and a trading pool without identity checks, audits or listing review. The scheme exploits trust in a project rather than a technical flaw in the underlying blockchain.
How a rug pull works
A typical rug pull follows a predictable sequence. The creators deploy a token, often in minutes, and pair it with a stablecoin or the chain’s native asset in a liquidity pool on a decentralized exchange. They then generate attention through social media, influencers, airdrops or claims of upcoming partnerships.
As buyers arrive, the token price rises and the pool fills with their stablecoins or native coins. At a chosen moment, the insiders remove the pool liquidity, sell a large hidden allocation or trigger a function that blocks other holders. The price collapses in minutes, and the extracted funds are often moved through mixers, bridges or many wallets to obscure their trail.
The stages below describe the common pattern and the signals that each stage leaves on-chain.
| Stage | What insiders do | Observable signal |
|---|---|---|
| Setup | Deploy token and seed a liquidity pool | New contract with concentrated holdings |
| Promotion | Create hype and urgency | Aggressive marketing, anonymous team |
| Accumulation | Let buyers push the price up | Rapid price rise on thin liquidity |
| Extraction | Remove liquidity or dump holdings | Large liquidity withdrawal or sell transaction |
| Exit | Move funds and abandon channels | Deleted website and social accounts |
Types of rug pulls
Rug pulls are usually classified as hard or soft. A hard rug pull relies on malicious code or an instant liquidity removal; a soft rug pull involves insiders selling down holdings or quietly abandoning a project after raising money.
| Form | Mechanism | Category |
|---|---|---|
| Liquidity pull | Creators withdraw pool liquidity in one transaction | Hard |
| Honeypot token | Contract allows buying but blocks selling | Hard |
| Hidden mint function | Creators mint unlimited tokens and sell them | Hard |
| Dumping allocation | Insiders sell large unlocked holdings | Soft |
| Treasury or vault drain | Admin key withdraws user deposits | Hard |
| Slow abandonment | Development stops after fundraising | Soft |
The legal assessment differs as well. Hard rug pulls involving deliberate code tricks are typically treated as fraud or theft. Soft rug pulls can be harder to prosecute because insiders may argue that a project simply failed, although misleading statements to buyers can still create liability in many jurisdictions.
Rug pull compared with related scams
A rug pull is one of several exit-oriented crypto scams. Distinguishing them helps victims, investigators and platforms respond correctly.
| Scam | Who holds the funds | Core deception |
|---|---|---|
| Rug pull | Token or protocol insiders | Fake project or hidden control |
| Exit scam | Operator of an exchange or service | Platform disappears with deposits |
| Pump and dump | Coordinated promoters | Artificial price rise, then selling |
| Wallet drainer | Attacker after victim signs | Malicious approval or signature |
| Pig butchering scam | Fraudster building a relationship | Long grooming toward fake platforms |
The boundaries overlap. A pump and dump becomes a rug pull when the promoters are also the token creators who hold most of the supply. An exit scam usually targets a centralized service, while a rug pull more often involves a token or DeFi protocol.
Warning signs and due diligence
No checklist eliminates the risk, but most rug pulls display several red flags at once. Blockchain data is public, so many of these signals can be checked before buying.
| Red flag | What it can indicate | How to check |
|---|---|---|
| Unlocked liquidity | Creators can remove the pool at any time | Inspect liquidity lock or LP token holder |
| Concentrated supply | A few wallets can crash the price | Review top holders on a block explorer |
| Owner privileges | Mint, pause or blacklist functions | Read verified contract code |
| Unverified contract | Code cannot be inspected | Check verification status on the explorer |
| Pressure to buy fast | Manufactured urgency | Treat countdowns and guaranteed returns as warnings |
Safeguards such as liquidity locks and audits reduce but do not remove risk. Locks can be short or controlled by insiders, and an audit covers only the code examined at a given time, not the honesty of the team.
Regulation and recovery after a rug pull
Recovery after a rug pull is rare but not impossible. Because transactions are public, analytics firms and investigators can trace funds, and centralized exchanges may freeze assets that arrive in accounts subject to KYC and AML controls.
Regulatory frameworks increasingly address the conditions that enable rug pulls. In the EU, MiCA requires white papers and disclosures for many token offerings and imposes market abuse rules on trading, while authorities in several countries have prosecuted rug pull organizers for fraud and money laundering. Permissionless tokens launched anonymously, however, often fall outside any practical enforcement reach.
Victims improve their limited chances by acting quickly: recording transaction hashes and wallet addresses, revoking any token approvals granted to the project, and reporting the incident to the police and the financial regulator. They should also be wary of so-called recovery services that demand upfront fees, because recovery scams frequently target rug pull victims.
In plain words
A rug pull is like a pop-up shop that collects deposits and vanishes overnight. The organizers make the shop look busy and exciting, take the money people pay in and then close the doors for good.
In crypto, anyone can open such a shop in minutes. The safest assumption is that a new, heavily promoted token is risky until its code, ownership and liquidity have been checked.
A real-world example
A new token linked to a popular streaming series appears on a decentralized exchange and is promoted heavily on social media. Its price climbs by thousands of percent in a few days. Some buyers report on forums that they cannot sell their tokens, but the warnings are drowned out by excitement.
Inspection of the contract later shows a honeypot design: selling required a special token that buyers could not obtain. Once the pool has accumulated a large amount of buyers’ funds, the creators withdraw the liquidity, and the token price drops to nearly zero within minutes.
The website and social accounts disappear the same day. Buyers recover nothing, while on-chain analysts trace the funds through a mixing service. This pattern matches several documented incidents, and it shows why the inability to sell is one of the clearest warning signs.