What Is a Rug Pull? Meaning, Types, Examples & How to Detect One

A rug pull is the moment a token's insiders convert everyone else's money into their own and leave. The mechanics differ, but the outcome is always the same: the market for the token stops functioning, and the people who bought it hold something they cannot sell at anything close to what they paid.

The words rugpull, rug pulls and rug pulling all describe the same event. In practice traders use "rug" as both a noun ("that token was a rug") and a verb ("the dev rugged"). A crypto rug pull differs from an ordinary bad investment in one important way: the loss is caused deliberately by someone with privileged control over the token or its liquidity.

Most rug pulls follow a recognisable sequence. It is cheap, fast and heavily automated:

1. Deploy the token. On a launchpad or directly from a contract template. This takes minutes and costs very little on Solana, Base or BNB Chain.
2. Capture supply quietly. The deployer funds several fresh wallets from one source and buys its own launch in the first blocks, so insiders hold a large share without a single obvious whale wallet.
3. Manufacture momentum. Wash trades and coordinated buys create a chart and a volume number that look like organic demand.
4. Distribute. Telegram, X and paid callers bring in retail buyers. Real money enters the pool.
5. Exit. Insider wallets sell into that demand, then the remaining liquidity is withdrawn — or selling is disabled entirely so only insiders can exit.

The whole cycle often completes inside an hour. That is why a pre-buy check has to be fast as well as thorough.

Three structural facts make rug pulling profitable. Token creation is permissionless, so there is no gatekeeper to stop a bad actor from deploying. Liquidity is usually supplied by the deployer, so whoever created the pool often keeps the keys to it. And identity is optional — a deployer wallet costs nothing and can be discarded after one launch.

None of that is fixable by trust or reputation alone. It is fixable by reading what the chain already records: who holds the supply, whether the liquidity can be withdrawn, and what the contract still permits its owner to do.

Hard rug

A hard rug uses a technical mechanism to extract value in a single action — pulling the liquidity pool, minting a huge new supply, or flipping a contract switch that blocks every non-insider sell. It is abrupt, it is usually visible in one transaction, and it is the version most people mean by "rug pull".

Soft rug

A soft rug is abandonment. The team sells its allocation gradually, stops shipping, deletes the socials and moves on. There is no single malicious transaction, so it is harder to categorise as fraud — but for holders the price outcome is often identical. Slow, steady insider selling against thin liquidity is the signature.

Rug University covers this in more depth in what a soft rug pull is and how a slow rug pull unfolds.

Liquidity rug pulls

The deployer holds the LP tokens that represent the pool. When they withdraw, the pool empties and there is nothing left to sell into. The defence is verifiable: LP tokens should be burned or held by a recognised locker contract with an unlock date in the future. "Liquidity exists" is not the same as "liquidity is protected". See what burned liquidity means.

Honeypots

The contract accepts buys but rejects sells for everyone except whitelisted addresses. The chart looks perfect precisely because nobody can take profit. Honeypot logic is typically implemented through transfer restrictions, a blacklist, or a sell tax set arbitrarily high. More in what a honeypot token is.

Malicious minting

If mint authority is still live, the owner can create new supply at will and sell it into the pool. On Solana this is the SPL mint authority; on EVM chains it is a mint function still callable by the owner or a proxy admin. Renouncing it is a one-way action and easy to verify.

Hidden taxes and sell restrictions

Some contracts apply an asymmetric tax — a small buy tax and a punitive sell tax — or allow the owner to change tax rates after launch. Others cap the maximum sell size or add a cooldown per wallet. Each of these converts an apparently liquid position into one you cannot exit at the displayed price.

Fake or unlocked liquidity

A large pool figure means little if the LP is unlocked and the owner is still active, or if most of the "liquidity" is the project's own token rather than a real quote asset. Depth on paper does not equal depth when everyone sells at once.

Concentrated holder supply

When the top ten wallets hold most of the float, a single decision moves the whole market. Concentration is not proof of intent, but it is the precondition for an insider dump. Related reading: holder concentration explained.

Suspicious creator wallets

A deployer that funded itself minutes before launch from a mixer or fresh exchange withdrawal, deployed several tokens in a week, or still holds a large share of supply is a different proposition from a wallet with a long, consistent history. Creator context is often the single most informative signal available.

Each of these is broken down side by side in the full guide to the types of crypto rug pulls.

• LP not verifiably locked or burned
  The pool can be withdrawn at any moment.
• Owner not renounced, no multisig
  One key still controls the contract.
• Mint or blacklist function live
  Supply or transfers can change after you buy.
• Top 10 wallets hold most of supply
  A handful of addresses can end the market.
• Creator still holds a large share
  The largest seller is the person who made it.
• Wallets funded from one source at launch
  Bundled insider accumulation.
• Volume far above liquidity
  Activity that cannot be exited is often wash trading.
• Deployer wallet is days old
  No history to judge, and nothing to lose.
• Sell tax high or owner-adjustable
  Your exit price is not the quoted price.
• Socials created the same day
  Manufactured credibility.

One signal on its own rarely settles the question. A token with unlocked LP but a renounced contract, deep liquidity and a wide holder base is a different risk from one where every signal points the same way. Weigh them together — that is what the step-by-step detection guide walks through.

• Check liquidity protection before price. Ask whether the LP can be withdrawn, not whether it is large.
• Read the supply distribution. If ten wallets can end the market, size your position accordingly.
• Look up the deployer. Wallet age, funding source and previous launches take seconds to review.
• Confirm what the contract still allows: mint, blacklist, pause, upgradeable proxy, adjustable tax.
• Test the exit. On EVM chains a simulated sell reveals honeypot behaviour a chart never will.
• Never invest on a chart alone. Price and volume are the two things an attacker can fabricate cheaply.
• Assume any position in a new token can go to zero, and size it so that outcome is survivable.

Paste a contract address and Rug.Tools pulls the public on-chain data for that token and turns it into a readable risk picture. Depending on the chain and what is available, the analysis covers:

• Liquidity protection — pool size, lock or burn status, owner activity, unlock date where one exists.
• Holder distribution — largest holder, top-10 share, holder count, burn and locker addresses labelled.
• Creator intelligence — deployer address, wallet age, funding, balance and deployment history.
• Contract signals — mint and freeze authority, ownership, proxy or upgradeable patterns, tax and transfer restrictions where the chain exposes them.
• Market context — price, market cap, volume, pair age and the depth behind the quote.
• Bundle and cluster detection — wallets that accumulated together or share a funding source.

Every module reports its own state. If a data source is not available on a given chain, the report says so rather than filling the gap with a guess, and the confidence level is calculated only from checks that actually completed. Rug.Tools reports risk signals; it cannot promise that a token is safe or predict that it will rug.

If you want the practical version of this page, use the crypto rug pull checker walkthrough or read how the Rug.Tools analysis pipeline works.