⚠️ safety guide
How to Spot a Rug Pull Before You Lose Your Money
Rug pulls are the biggest threat in the meme coin space. In 2024 alone, over $2 billion was lost to crypto rug pulls and scams. The good news is that most rug pulls follow predictable patterns — and if you know what to look for, you can avoid them. This guide teaches you exactly how.
What Is a Rug Pull?
A rug pull is a type of crypto scam where the creators of a token suddenly withdraw all liquidity from the trading pool, making it impossible for holders to sell their tokens. The name comes from the expression "pulling the rug out from under someone" — one moment you're standing on solid ground, the next you're falling.
In practice, here's what happens: a team creates a new token, adds liquidity to a decentralized exchange so people can buy it, promotes the token to drive the price up, and then removes all the liquidity, keeping everyone's money while leaving them with worthless tokens.
Rug pulls can happen in seconds. The entire process from launch to exit can take as little as a few hours. By the time victims realize what happened, the scammers have already converted the stolen funds and moved them through multiple wallets to obscure the trail.
Types of Rug Pulls
Hard Rug Pull
A hard rug pull involves malicious code built directly into the token's smart contract. The contract might include hidden functions that allow the creator to drain the liquidity pool, mint unlimited tokens, or prevent anyone except the creator from selling. Hard rug pulls are premeditated from the start — the token was always designed to steal money.
Soft Rug Pull
A soft rug pull is when the creators gradually sell their token holdings over time rather than draining liquidity all at once. They might promote the token, wait for the price to rise, and then slowly dump their bags while the community is still buying. This is harder to detect because the price decline looks like normal market movement rather than an obvious exit.
Honeypot
A honeypot is a specific type of hard rug pull where the token's contract allows people to buy but blocks them from selling. The chart shows the price going up (because people keep buying), but no one can actually take profits. The only wallet that can sell is the creator's. This is one of the most deceptive types of scams because everything looks great until you try to sell.
10 Warning Signs of a Rug Pull
No single warning sign guarantees a rug pull, but the more red flags you see, the more cautious you should be. Here are the ten most reliable indicators:
🚩 rug pull red flags
1. Anonymous team with no track record. If you can't find any information about who created the token, there's no accountability if something goes wrong. Legitimate projects have identifiable team members with verifiable histories.
2. Liquidity isn't locked. If the liquidity pool tokens aren't locked in a time-lock contract, the creator can remove all liquidity at any time. Always check if liquidity is locked and for how long.
3. Contract ownership not renounced. If the creator still owns the contract, they can modify it at any time — changing taxes, blocking sells, or minting new tokens. Renounced ownership means no one can change the contract rules.
4. Extremely high buy/sell taxes. Some scam tokens charge 50-99% tax on sells, effectively trapping your money. Any sell tax above 10% should raise concerns.
5. One wallet holds a massive percentage of supply. If a single wallet (not a contract or exchange) holds more than 10-15% of the total supply, that holder can crash the price by selling.
6. No audit from a reputable firm. While not having an audit doesn't guarantee a scam, audited contracts are significantly safer. Look for audits from firms like CertiK, Hacken, or Trail of Bits.
7. Unrealistic promises. "Guaranteed 100x," "Next Dogecoin," "Can't lose" — these phrases are almost always associated with scams. No legitimate project can guarantee returns.
8. Sudden influencer promotion. When multiple influencers start promoting the same obscure token at the same time, it's often a coordinated pump-and-dump. The influencers were paid to promote and will sell before their audience does.
9. Very low liquidity relative to market cap. If a token has a $10 million market cap but only $50,000 in liquidity, the price can be easily manipulated, and most holders won't be able to sell without massive slippage.
10. Copy-paste website and socials. Scam tokens often have templated websites that look identical to other projects, with stock images, vague roadmaps, and social media accounts that were just created. Check the age of the Twitter account and the quality of their community engagement.
How to Detect Honeypots
Honeypots are particularly dangerous because the chart can look extremely bullish — the price keeps going up because everyone can buy but no one can sell. Here's how to check before you buy:
- Use a honeypot scanner: Tools like CIPHER's CipherPot let you paste any contract address and instantly check if it's a honeypot. It also shows buy/sell taxes, holder count, and liquidity data.
- Check the sell history: Look at the token's transaction history on a blockchain explorer. If you see many buy transactions but very few (or zero) sell transactions, it's likely a honeypot.
- Try a small test transaction: If you're still unsure, buy a very small amount (like $1-5) and immediately try to sell it. If the transaction fails or you can't sell, it's a honeypot. This costs you very little but can save you from a much larger loss.
- Read the contract code: If you can read Solidity code, look for functions that restrict selling to specific addresses, hidden transfer restrictions, or modifiable tax functions. If the contract isn't verified on the blockchain explorer, that itself is a warning sign.
Scan any contract for honeypots — free
CipherPot checks for honeypots, buy/sell taxes, and rug signals across ETH, BSC, Base & Solana.
launch CipherPot 🍯 →
Reading Contract Red Flags
Even without deep technical knowledge, you can identify dangerous contract features by using scanning tools. Here's what the key indicators mean:
- Mint authority (active): The creator can create unlimited new tokens, diluting everyone's holdings to zero. This should be disabled for any trustworthy token.
- Freeze authority (active): On Solana, this means the creator can freeze any wallet, preventing them from selling. This is a critical red flag.
- Proxy/upgradeable contract: The contract code can be changed after deployment. While there are legitimate reasons for upgradeable contracts, in meme coins it usually means the creator can add malicious code later.
- Hidden owner functions: Some contracts have backdoor functions that aren't visible in the main code but can be called by the owner to drain funds or modify behavior.
How to Protect Yourself
Here are practical steps you can take to dramatically reduce your risk of falling victim to a rug pull:
- Always scan the contract first. Before buying any token, run the contract address through a honeypot and rug scanner. This takes 10 seconds and can save you everything.
- Never invest more than you can afford to lose. This is the golden rule of meme coins. Treat every purchase as money you're comfortable never seeing again.
- Check liquidity lock status. Verify that the liquidity pool tokens are locked in a time-lock contract for at least 6-12 months.
- Verify the contract is renounced. Once a contract's ownership is renounced, no one can modify it. This eliminates a major category of rug pull risk.
- Don't FOMO into pumps. If a token has already gone up 500% in a day, the risk/reward is terrible for new buyers. The early buyers are looking for exit liquidity — and that's you.
- Use multiple sources. Don't rely on a single tool or opinion. Cross-reference your research across multiple platforms, scanners, and community discussions.
- Take profits along the way. If you're fortunate enough to be early on a winning coin, take some profits on the way up. You can always buy back if it dips. Unrealized gains aren't real until you sell.
Remember: The best investors in meme coins aren't the ones who hit the biggest winners — they're the ones who avoid the most scams. Protecting your capital is more important than chasing the next 100x.
Here are the best free tools you can use to protect yourself:
- CipherPot by CIPHER: Honeypot detection, buy/sell tax analysis, liquidity data, holder concentration, mint authority, and freeze authority checks for ETH, BSC, Base, and Solana tokens.
- CIPHER Scanner: Live tracking of 250+ meme coins with hype levels, mood indicators, and risk ratings to help you spot suspicious activity.
- RugCheck.xyz: Specialized Solana token analysis with risk scoring and insider detection.
- Honeypot.is: EVM-based honeypot detection for Ethereum, BSC, and other EVM chains.
- CoinGecko: Verify contract addresses, check market data, and confirm a token is legitimately listed.
- Blockchain Explorers: Etherscan (Ethereum), BscScan (BSC), and Solscan (Solana) let you view transaction history, contract code, and holder distribution directly on-chain.
Start scanning meme coins now
250+ coins tracked with live risk ratings, AI analysis, and honeypot detection.
launch CIPHER →