Rug Pull Warning Signs: A 5–10 Minute First Check

A rug pull generally involves a project’s operators using their control to take value from buyers—for example, by withdrawing pool liquidity or selling a large token allocation. Before buying an unfamiliar token, check who controls its liquidity, supply and contract. Then look at the people and claims behind it. A quick check can reveal reasons to stop; it cannot certify that a token is safe.

Warning signs worth checking first

• Liquidity control: In a Uniswap V2-style pool, liquidity-provider (LP) tokens represent a claim on deposited liquidity. Find out who holds them. If they are locked, check who controls the lock and when it expires. A lock or burn restricts that particular withdrawal route; it does not prevent token sales, harmful contract behavior or a loss of value. Other pool designs need different checks.
• Holder concentration: A few wallets controlling much of the supply may be able to sell heavily. First identify whether large addresses belong to a pool, exchange, burn address, vesting contract or project-controlled wallet. No single percentage proves fraud.
• Contract permissions: Look for powers to mint, freeze or blacklist tokens, change trading rules, or upgrade a contract. Ordinary ERC-20 transferFrom uses a holder’s authorization; its presence alone is not a backdoor. Likewise, a renounced owner role does not rule out other privileged roles or harmful code.
• Claims and pressure: A team you cannot verify, unexplained token economics, guaranteed-return claims and pressure to buy immediately are reasons to slow down. An identifiable team is not, by itself, a safety guarantee.

Age is context, not a pass-or-fail rule. In one study of newly deployed Ethereum-mainnet tokens from October 2023 through August 2024, CertiK classified 48,265 of 100,260 tokens in its analyzed population as associated with rug pulls; it described that share as 48.14% of them were tied to rug pull scams. Its rules excluded certain token types and could classify some failed projects as rugs. The figure is not the probability that a token you encounter today—or a token on another chain—is a scam. Among the Telegram-promoted tokens CertiK flagged, 41,801 of 46,526 reached their last identified rug-pull execution within 72 hours of creation. That does not make an older token safe.

For the study’s definitions and scope, see Evil in the shadows: Unveiling the chaos in Ethereum’s token ecosystem — CertiK.

A 5–10 minute pre-buy first pass

Use the time as an initial screen, not a deadline for making a purchase. Complex contracts, controlling wallets and liquidity arrangements may take much longer to understand.

1. Confirm the token address and chain. Compare the address from the project’s official channels with the address shown by the pool and a block explorer. A familiar name or ticker can be copied.
2. Inspect the trading pool. Check its liquidity, recent additions and withdrawals, and the addresses controlling the relevant liquidity position. For a V2-style pool, examine LP-token ownership and any lock’s terms and expiry rather than relying on a “locked” badge.
3. Read the holder list. Identify the largest wallets and investigate what they are. Check whether connected project wallets could sell a substantial share of circulating tokens. Do not treat exchange or burn addresses as ordinary individual holders.
4. Check the contract and its permissions. See whether its code is verified on the explorer and whether minting, freezes, blacklists, upgrades or other administrative controls remain available. A verified contract makes code available to inspect; it is not an audit. If you cannot establish what the permissions mean, stop and seek a qualified review rather than guessing.
5. Check the claims off-chain. Compare the team’s stated identity and history with independent information. Look for a clear explanation of the product and where any proposed earnings would come from. Treat urgent promotion and guaranteed-return language as warnings.

If an essential check is inconclusive, leaving the purchase alone is a reasonable outcome. A small test purchase limits the amount spent on that test, but it cannot show that future sales will work or that liquidity and permissions will stay the same. A separate testing wallet may limit exposure to wallet approvals; it cannot make a bad token safe.

Pressure tactics and recovery-fee scams

Not every crypto investment scam is a contract-based rug pull. Someone may build trust through messages, show apparent gains, encourage more deposits and then demand a fee or supposed tax before allowing a withdrawal. These are warning signs even when you cannot identify a malicious token function.

Scam pitches may start on social media or dating apps. The linked FTC alert describes dating-site approaches and investments victims cannot withdraw; the FBI’s IC3 advisory also describes approaches through social media and dating apps. IC3 warns that apparent profits can be used to encourage larger and larger transfers, followed by demands for withdrawal fees or taxes. For the agencies’ guidance, see Spotting cryptocurrency investment scams | Consumer Advice — FTC and IC3 public service announcement — social engineering in crypto scams. For a broader discussion of crypto scams, see Chainalysis.

If you have already lost funds, do not pay someone who claims an upfront fee will recover them. Preserve wallet addresses, transaction identifiers and messages, and report what happened to the FBI’s IC3 or the FTC’s ReportFraud.ftc.gov. Reporting is worthwhile, but recovery is not assured.

Keep the risk in proportion

Existing crypto holders do not need to chase a newly promoted token to put their holdings to work. Understand the source of any proposed income, the fees and the ways capital could be lost before committing funds. If you borrow against crypto to fund another position, a fall in collateral value can raise your loan-to-value ratio and may make the loan eligible for liquidation if its threshold is crossed. Borrowing adds interest and collateral risk to the token’s own risks.

OverseasDeFi’s Daily Yield System frames holding, borrowing, deploying and earning as decisions to examine in sequence—not steps everyone must take. Portfolio tools, a portfolio-aware AI coach and human guidance can help holders ask better questions about their positions; none can establish that an unfamiliar token is safe.

FAQ

What are the main warning signs of a rug pull?

Look for liquidity controlled by insiders, substantial project-controlled token holdings, privileged contract functions, unverifiable claims and pressure to buy. Each calls for investigation. Several together may strengthen the case for walking away, but a checklist cannot prove intent.

Does locked liquidity mean a token is safe?

No. In a V2-style pool, a valid LP-token lock can prevent the holder from withdrawing that liquidity until the lock expires. It does not prevent concentrated holders from selling or rule out harmful contract code. Check the lock’s terms and the pool design.

Can a new token pass every quick check and still fail?

Yes. A short review can miss complex permissions, connected wallets or risks that appear later. Even a project without fraud can lose value. If you cannot understand a material risk, do not treat an incomplete review as clearance to buy.

Can someone face legal consequences for a rug pull?

Potentially. Fraudulent conduct can lead to criminal charges or other legal action, depending on the facts and jurisdiction. A failed project is not automatically a crime, and whether a particular scheme violates the law requires a case-specific assessment.