How to Spot a Rug Pull Before You Buy

Direct answer

A rug pull is when a project's operators extract value and abandon it, leaving holders unable to exit at any meaningful price. The three mechanisms are liquidity removal (withdrawing the funds that make selling possible), contract-level restriction (a honeypot that blocks selling), and supply dumping (releasing concentrated holdings into a thin book). Each requires something arranged in advance, and each is therefore checkable before you buy.

Prerequisites

• A block explorer for the chain.
• The contract address, obtained from a source the project controls.

Time required: ten to fifteen minutes.

Mechanism 1 — Liquidity removal

How it works. Trading depends on liquidity someone provided. If the operators control it, they can withdraw it, leaving no bids. Holders own a token nobody can buy.

The checks:

• Is liquidity locked, and verifiably? A claimed lock is not a lock. Find the lock contract address, confirm the tokens are actually held there, and check the unlock date.
• How long is the lock? A lock expiring in two weeks defers the risk, it does not remove it.
• Who provided the liquidity? If a single address supplied nearly all of it, that address decides whether a market continues to exist.
• On an order-book venue, the equivalent question is who is quoting and with what commitment. See liquidity for new coins.

Mechanism 2 — Contract restriction (honeypot)

How it works. The contract permits buying and blocks or penalises selling — via a blacklist, an asymmetric fee, or a transfer restriction that only triggers on sale. The market looks healthy because the restriction is at the contract level, and the price may even rise as buyers accumulate and nobody can exit.

The checks:

• Is source verified? If not, stop. You cannot assess what you cannot read.
• Asymmetric transfer fees — a higher sell fee than buy fee, or any fee the owner can change after launch. This is the defining pattern.
• Blacklist or transfer-restriction functions, and who controls them.
• Pause functions on a token being promoted to the public.

Full routine: how to verify a smart contract.

Mechanism 3 — Supply dumping

How it works. No trickery in the contract at all. Operators simply hold a large share of supply and sell it into a book too thin to absorb it. Legal, ordinary-looking, and devastating for anyone who bought the rising price.

The checks:

• Holder concentration. What share does the largest non-contract holder control? What sits in team and treasury wallets?
• Do top holders look like a distribution, or a handful of addresses funded from the same source at the same time?
• Vesting schedule — is one published, with dates and amounts, and is it enforced by a lock contract or merely asserted?
• Near-term unlocks. Anything releasing in the next 90 days is the most relevant fact about the token.
• Depth relative to the holding. If the largest holder's position dwarfs the resting bid depth, the exit is priced at whatever they decide.

The combined routine

• Contract address from a project-controlled source
• Source code verified on a public explorer
• No asymmetric or owner-mutable sell fee
• No blacklist controlled by a single key
• Ownership status understood, including roles beyond Ownable
• Liquidity lock confirmed on-chain, with a meaningful expiry
• Holder concentration acceptable
• Vesting published as dates and amounts
• Bid-side depth measured — could you actually sell?

The last item is the one people skip. Measure the bid side before buying and ask what average price a sale of your intended size would fill at. See how to read market depth.

Signals that are weaker than they look

Worth being precise, because several popular heuristics are unreliable:

• "The team is anonymous." Much of this industry is pseudonymous by design. Anonymity raises the cost of accountability; it is not evidence of intent.
• "It has an audit." An audit is evidence someone competent looked, and a record of what they found. It does not prevent liquidity removal or supply dumping, neither of which is a code defect.
• "Ownership is renounced." Renouncing Ownable may leave other privileged roles intact. Check the roles that exist.
• "It has a big community." Community size is marketing output, not a safety property.
• "The price is going up." During a honeypot, the price rising is the expected behaviour.

What no check can tell you

Be honest about the limits. This routine finds arranged mechanisms. It cannot detect a team that simply gives up, an upgradeable contract that becomes something else after you check, or off-chain risk — legal, operational, or personal.

The checks meaningfully shift the odds. They do not make an unfamiliar token safe, and position size remains the control that actually bounds a loss.

Related

• How to Verify a Smart Contract
• Common Crypto Scams
• How to Avoid Common Liquidity Traps