Three control paths
What a crypto rug pull can exploit
“Rug pull” is a broad label, not one technical signature. The useful task is to map the controls that could change what buyers can sell, what a wallet can lose, or whether the market still has usable reserves.
Liquidity can leave
A market can exist because someone deposited both assets into a pool. In Uniswap v2, the provider receives liquidity tokens and can burn them to retrieve its share of the reserves. Initial liquidity is not the same as permanent liquidity; identify who controls the redeemable position and what, if anything, limits withdrawal.
Token behavior can be privileged
Administrator roles may be able to mint supply, freeze transfers, change fees, pause trading, or alter other sensitive behavior. Those powers can be legitimate operational controls, but buyers need to know who holds them and how that authority is constrained.
Logic can be upgradeable
A proxy can keep the same address while forwarding calls to a replaceable implementation contract. Review the implementation as well as the proxy, then identify the upgrade administrator, any delay, and the governance or multisignature controls around it.
Free tool
Check a token in 30 seconds
Our rug pull risk checker reads an Ethereum token’s contract live: upgradeable proxy, active owner, mint, blacklist, pause and fee functions, Uniswap v2 liquidity and how much of it is burned. Then it scores 11 questions the chain cannot answer. Read-only, no wallet connection.
Open the rug pull checkerRed-flag checklist
13 rug pull red flags and how to check each one
One flag is not proof of a scam, and none of these being present is not proof of safety. The more flags stack up, especially around liquidity and selling, the more likely you are looking at an exit waiting to happen.
| # | Red flag | What to check | Basis |
|---|---|---|---|
| 1 | Liquidity is not burned or locked | Find the pool’s LP-token holders. LP sitting in the deployer’s wallet can be redeemed for the pool’s ETH at any moment. If a lock is claimed, open the lock contract and confirm amount and expiry. | Uniswap v2 docs; SEC v. Zhu |
| 2 | Owner can mint new tokens | A mint or issue function controlled by an active owner lets insiders print supply and sell it into the pool. | OpenZeppelin access control |
| 3 | Owner can blacklist or freeze wallets | Functions like blacklist, addBots or freeze can stop chosen wallets, often every buyer except insiders, from selling. | OpenZeppelin access control |
| 4 | Trading can be paused or switched off | pause(), enableTrading or setTrading switches can freeze sells while insiders exit. | OpenZeppelin access control |
| 5 | Nobody but insiders has sold (honeypot) | On the explorer, look for many unrelated wallets selling into the pool. “Anti-dump” rules that block sells are a stop sign; Squid Game buyers could not sell. | BBC; WIRED |
| 6 | Hidden, high or adjustable buy/sell tax | Fee-setter functions (setFee, setTaxes, updateSellFees) mean today’s 5% can become 99%. A sell tax far above the buy tax is a warning. | Contract code |
| 7 | Source code not verified | No green check on the explorer’s Contract tab means you cannot read what the token does. Not proof of fraud, but it removes the main evidence. | ethereum.org block explorers |
| 8 | Upgradeable proxy with a single-key admin | An EIP-1967 proxy can swap its logic at the same address. Check who the admin is and whether upgrades pass a timelock or multisig. | EIP-1967; OpenZeppelin proxies |
| 9 | A few wallets hold most of the supply | Label the top holders first: pool, burn, exchange, vesting. What is left in a few unknown wallets can be dumped on buyers. | Explorer holders tab |
| 10 | “Ownership renounced” but control remains | Renouncing owner() does not remove separate roles, a proxy admin, an external controller or rules already coded into transfers. | OpenZeppelin access control |
| 11 | Fake, old or mismatched audit | Find the report on the auditor’s own site and match chain, address and version. Audits do not catch every bug. | ethereum.org smart contract security |
| 12 | Anonymous team and no real product | Pseudonymity alone is not proof, but no accountable people plus no working product means the token’s only value is new buyers. | SEC Investor.gov |
| 13 | Guaranteed returns, countdowns, DMs and paid shills | Regulators list guaranteed profit, urgency and social-media tips as classic fraud and pump-and-dump signals. | FTC; CFTC; SEC |
Real cases, sourced
What real rug pulls looked like
Scale first: Chainalysis counted more than $2.8 billion taken in rug pulls in 2021, 37% of all crypto-scam revenue that year, up from 1% in 2020. Roughly 90% of that came from one centralized exchange, Thodex; the rest were DeFi projects. Three cases show the main patterns.
Squid Game token (SQUID), 2021
BNB Chain
Launched in late October 2021 on the back of the Netflix show (with no official tie-in). Buyers reported they could not sell because an “anti-dumping” rule required a second token earned in the project’s game. On November 1 the creators pulled about $3.36 million of liquidity and the price fell about 99.99% within minutes; the website and social accounts disappeared.
Lesson: Sell restrictions + unlocked liquidity + hype. The checker’s “blacklist / trading switch” flags and checklist question 2 (are ordinary wallets selling?) target exactly this.
Game Coin (GME): SEC v. Eric Zhu, filed January 16, 2025
Liquidity pool on a crypto trading platform
According to the SEC’s complaint, the token’s founders told investors on social media that liquidity was “locked”, yet LP tokens accrued to an address controlled by an engineer hired to code the project. The SEC alleges he kept them unlocked, withdrew liquidity, sold, and took crypto worth about $553,000, causing a roughly 12% price drop. These are allegations in a civil complaint.
Lesson: A “liquidity locked” post is a claim, not a check. Verify who actually holds the LP tokens, which the checker does for Uniswap v2 pools.
Source: SEC litigation release 26223
Frosties NFTs, 2022
NFT project
Federal prosecutors in Manhattan charged two men in March 2022, alleging they abandoned the Frosties NFT project within hours of selling out in January 2022 and moved about $1.1 million in proceeds to wallets they controlled, while preparing a second project.
Lesson: Rug pulls are not only token liquidity tricks. Promised roadmaps and “holder rewards” are worthless if the team can simply walk away with the mint proceeds.
Source: U.S. Attorney’s Office, SDNY
Before you buy or connect
Ten checks that produce real evidence
- 1
Confirm the exact chain and contract address
Start from a project channel you independently verified, then compare the complete address. A copied name, ticker, logo, or shortened address can point to a different token.
- 2
Read the verified source and the implementation
A block explorer can show the creator, creation transaction, source code, ABI, and contract events. If the address is a proxy, continue to the current implementation and review both layers. Unverified source is not proof of fraud, but it removes important evidence.
- 3
Map every privileged role
Look for powers to mint, freeze, blacklist, pause, change transfer fees, set trading rules, rescue assets, or move treasury funds. “Ownership renounced” only answers one question if separate roles or contracts still have authority.
- 4
Identify the upgrade path
For upgradeable contracts, find the administrator and ask whether upgrades require a multisignature, governance vote, or visible delay. The same public proxy address can execute new logic after an upgrade.
- 5
Trace who can withdraw liquidity
Find the pool and the position that represents its reserves. Check who controls that position, whether a lock exists, its exact expiry and contract, and whether more liquidity can be created elsewhere. A lock does not remove token-code or admin risk.
- 6
Review holders with context, not a magic percentage
Inspect concentration and connected wallets, but separate pool, burn, bridge, exchange, vesting, and treasury addresses before drawing conclusions. There is no universal top-holder percentage that makes every token safe.
- 7
Match any audit to the deployed code
Confirm the audit covers the same chain, address, implementation, version, and date. Ethereum.org cautions that audits are not a silver bullet and will not catch every bug; an old PDF or logo is not continuing assurance.
- 8
Verify the product and control claims
Check released code, working interfaces, governance records, named partners, and documentation from their original sources. A pseudonymous team is not automatically malicious, and a public profile is not automatically trustworthy.
- 9
Reject pressure and guaranteed returns
The FTC warns that guaranteed profit, big returns, zero-risk language, unsolicited social messages, and fake endorsements are scam signals. Slow down when promotion is doing more work than verifiable product evidence.
- 10
Limit the wallet blast radius
Use a separate wallet for unfamiliar applications, approve only what is needed, and reject unreadable spender or amount prompts. A successful connection or small trade only proves that one path worked at that moment; it does not prove future behavior.
Stop before signing
Five prompts that need no further debate
- The site, token, chain, or contract address does not match the source you verified.
- A page, “support” account, or wallet tool asks for your recovery phrase or private key.
- The spender, approval amount, transfer fee, or transaction effect is hidden or surprising.
- Someone guarantees profit, claims there is no risk, or pressures you to act before a timer expires.
- You cannot explain who controls upgrades, sensitive roles, or the redeemable liquidity position.
If you already connected or approved a token
Disconnecting a site does not cancel an on-chain allowance. Review the spender on the correct network, revoke permissions you no longer need, and wait for the revocation transaction to confirm. If you disclosed a recovery phrase or private key, treat the wallet itself as compromised and move unaffected assets using a fresh wallet created through trusted software or hardware.
Save the contract address and transaction hashes. Report fraud through official channels, and treat anyone promising guaranteed recovery for an upfront payment as another risk.
Crypto rug-pull FAQ
What is a crypto rug pull?
Rug pull is a broad label for a project exit in which insiders or privileged controls leave buyers with impaired value or no practical exit. It can involve withdrawn liquidity, restrictive token logic, an abusive upgrade, concentrated selling, or a promoted project that is abandoned. There is no single contract signature that identifies every case.
Does locked liquidity prove a token is safe?
No. A genuine lock can limit withdrawal of one identified liquidity position until a stated time, but it does not remove malicious token logic, privileged roles, upgrade authority, concentrated supply, a different pool, or risks after the lock expires.
Does renounced ownership prove there are no admin controls?
No. Renouncing one Ownable owner can disable functions protected by that owner, but separate roles, external controller contracts, proxy administrators, or logic already built into the token may remain. Inspect the complete control graph, not one owner field.
Are verified source code and an audit enough?
No. Verified source makes review possible, and a relevant audit adds evidence, but neither guarantees safety. Confirm the source and audit match the deployed chain, address, implementation, version, and date. Ethereum.org warns that audits do not catch every bug.
Will a small test buy prove I can sell later?
No. A small trade only shows that one route worked under the current state. Privileged rules, fees, allowlists, liquidity, or implementation logic can differ by wallet or change later. Do not risk funds solely to test a token you cannot otherwise verify.
What should I do after approving a suspicious token?
Disconnecting the site is not enough. Review the spender and allowance on the correct network, revoke permissions you do not need, and confirm the revocation transaction. If you exposed a recovery phrase or private key, treat the wallet itself as compromised and use a fresh trusted wallet.
What is a honeypot token?
A honeypot is a token anyone can buy but ordinary holders cannot sell, or can only sell at a punishing tax. It is usually built with a blacklist, a trading switch, a maximum-transaction rule or an owner-adjustable fee. The Squid Game token in 2021 trapped buyers with an “anti-dumping” rule before its creators pulled about $3.36 million of liquidity. The best evidence against a honeypot is many unrelated wallets successfully selling, not your own small test.
How can I check a token for rug pull risk for free?
Open the token on Etherscan (Contract, Holders and transfers tabs), then paste the contract address into the GrowYourEthereum rug pull checker. It reads the contract live for an upgradeable proxy, an active owner, mint, blacklist, pause and fee functions, and Uniswap v2 liquidity and LP burn, and scores 11 questions the chain cannot answer. It is read-only and needs no wallet connection, but it flags warning signs rather than proving safety.
Evidence reviewed October 16, 2026
Primary sources
Contract and explorer mechanics were checked against Ethereum.org, OpenZeppelin, EIP-1967 and Uniswap documentation. Promotion and guaranteed-return warnings were checked against the FTC, SEC and CFTC. Case details come from SEC and Justice Department releases, Chainalysis, WIRED and the BBC. Interfaces, roles, implementations, and pool positions can change, so verify the live chain state before signing.
- U.S. Federal Trade Commission — cryptocurrency scam and guaranteed-return warnings
- Ethereum.org — block explorer contract, token, holder, and event data
- Ethereum.org — smart contract access controls, testing, audits, and upgrade risks
- Ethereum.org — reviewing and revoking smart contract token access
- OpenZeppelin — ownership, roles, and access-control authority
- OpenZeppelin — how proxy upgrade patterns replace implementation logic
- Uniswap Developers — v2 liquidity pools, LP tokens, and reserve withdrawal
- U.S. SEC — litigation release 26223: “rug pull” fraud charges, Game Coin (January 16, 2025)
- SEC Investor.gov — exercise caution with crypto asset securities
- U.S. CFTC — customer advisory: beware virtual currency pump-and-dump schemes
- Chainalysis — 2021 rug pulls put crypto scam revenues near all-time high
- U.S. Attorney’s Office SDNY — Frosties NFT fraud charges (March 2022)
- WIRED — how the Squid Game crypto scam got away with millions
- BBC — Squid Game crypto token collapses in apparent scam
- EIP-1967 — standard proxy storage slots (how upgradeable tokens are detected)