Crypto rug pull: how it works and the warning signs

How does a crypto rug pull work step by step?

A team launches a token and pairs it with a pool of an established coin so people can trade it. Promotion draws buyers, the price rises, and the pool grows with their money. At the chosen moment, the team removes its side of the pool or sells a large holding, and the price falls close to zero within minutes. The whole cycle can last a few hours or several weeks.

The name comes from the image of pulling a rug from under a standing crowd. The scheme depends on speed and on information gaps: buyers see a rising price, and creators see the controls that let them exit. Understanding this asymmetry explains why the checks below focus on who holds the controls.

Which kinds of crypto rug pull exist?

A hard rug relies on code. The contract may hide a function that blocks selling for everyone except the creators, allows unlimited new tokens, or lets the owner change the rules after launch. Buyers see the price on screen yet cannot sell, a trap often called a honeypot.

A soft rug relies on behaviour. The team sells its holdings in stages, stops posting updates, and lets the project fade while the community waits for news. No single transaction looks illegal, which makes the pattern harder to prove. Both kinds end with investors holding tokens that carry little value. Investors who recognise the slow pattern early can exit with part of their funds.

Which contract signs point to a crypto rug pull?

Public block explorers show a contract’s code and its owner. Signs worth a closer look include source code that is unpublished, an owner who can mint new tokens, functions that pause trading or blacklist addresses, and an upgrade feature that lets the team replace the code later. Each one gives the creators power that can be used against buyers.

A published audit helps when the auditor is independent and the report lists fixed issues, yet an audit confirms the code at one date. Check that the deployed contract matches the audited version. Projects that give up owner controls, or place them behind a time delay, reduce the risk and show confidence in their own design.

Which liquidity and holder signs point to a rug pull?

Liquidity is the pool that lets buyers sell. A lock, which stops the creators from withdrawing the pool for a stated period, is a positive feature, and an unlocked pool means the team can remove it at any time. Check the length of the lock and who controls the key to it. Short locks of a few days give little comfort, while longer locks held by an independent service give more.

Holder data adds a second view. When a handful of wallets hold most of the supply, a single sale can collapse the price. Several new wallets funded from one source may belong to the same group. A spread of many independent holders, and a team allocation that vests over time, shows healthier distribution.

Which promotion signs point to a crypto rug pull?

Promotion tells a story too. Anonymous teams, guaranteed returns, countdown timers, paid influencer posts, and community channels that remove questions are patterns seen in many failed projects. The pitch focuses on how quickly the price will rise and says little about what the product does or who pays for it. Ask yourself who gains if you buy, and whether the answer is the product or the promoters.

Sound projects explain the product, name accountable people, publish documentation, and welcome questions in public. After a crash, the contrast matters more, since buyers look for fast recovery and accept bold claims. A promise of gains with no explained source of those gains is a signal to step back and run the checks.

How can you check a token for rug pull risk before buying?

Run 5 checks. Read the contract on a block explorer and confirm that the source is published. Look at who holds the owner controls. Confirm the liquidity lock and its end date. Review the holder spread. Then make a small test purchase and a small test sale, which proves that selling works. Stop if any check fails.

Write down the result and the date for each token you review, so that your decisions rest on a record instead of excitement. This page does not recommend any token. A passed check lowers one type of risk, and price risk and market risk remain, so size any position to what you can afford to lose.

What should you do after a crypto rug pull?

Save the contract address, your transaction identifiers, the promotional posts, and the dates. Report to the platform where you bought, to the police, and to the financial regulator in your country, and warn other holders in the project channels. Fast, factual reports help authorities and platforms trace the funds. Keeping a dated log from the first purchase onward strengthens every report.

Be cautious with anyone who contacts you offering to recover the money, since that approach is a second scam, covered in the guide on crypto recovery scams. EQOS Asia offers a 30-minute pre-diagnostic to map your exposure after an incident, and the crypto crash hub places the lesson inside the wider series.

Frequently asked questions

About the author

Stéphane Jambu

President, EQOS Forecast Asia

Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile