How to Check for a Rug Pull Before Buying a New Token
Quick Summary:
A rug pull is a crypto scam in which a token’s creators abandon the project after taking money from buyers. Knowing how to check for a rug pull comes down to three questions: who controls the liquidity, who holds the supply, and what the token’s code lets the creator do. This guide walks through seven checks, from liquidity locks to Solana’s mint and freeze authorities, and explains what each one can and cannot tell you.
Key Takeaways
- A rug pull happens when insiders drain liquidity, dump a large allocation, or use contract powers to trap holders.
- Seven checks cover most warning signs: liquidity, holders, contract permissions, Solana authorities, selling tests, project background, and hype.
- One red flag calls for a closer look. Several together are a good reason to skip the token.
- No scanner or audit can prove a token is safe, so only risk money you can afford to lose.
What is a Rug Pull?
A rug pull is an exit scam in decentralized markets: creators launch a token, attract buyers and liquidity, then pull that liquidity or dump their own holdings and disappear. Trust Wallet’s guide groups the tactic into three common forms.
| Type | What happens | Main tell |
|---|---|---|
| Hard rug | Creators remove the liquidity pool and the price falls close to zero | Liquidity was never locked |
| Soft rug | Insiders quietly sell a large allocation over time | A few wallets hold most of the supply |
| Honeypot | Contract code lets you buy but blocks you from selling | Sell transactions fail |
These scams can move fast. Chainalysis, as reported by The Register, described AnubisDAO in 2021: a project with no website, no white paper, and pseudonymous developers raised close to $60 million almost overnight, and the funds left its liquidity pool about 20 hours later.
How Common Are Rug Pulls?
Figures depend on how each study defines a rug pull. For 2021, Chainalysis attributed more than $2.8 billion to rug pulls, or 37% of that year’s crypto scam revenue, though most of it came from a single case: the Turkish exchange Thodex (The Register).
Newer data comes from Solana’s memecoin market. In a May 2025 report, Solidus Labs found that only about 97,000 of more than 7 million Pump.fun tokens with at least five trades kept liquidity above $1,000 between January 2024 and March 2025. It also found that roughly 93% of 388,000 Raydium pools showed signs of liquidity being pulled, with a median loss of about $2,832.
Treat those numbers carefully. Solidus measured collapsed liquidity and withdrawal patterns, not court-proven fraud, and the company sells token-scanning tools. They show how quickly most new tokens fail, not how many were crimes.
Legal protection is also thin. In a February 2025 staff statement, the US SEC’s Division of Corporation Finance said buyers and holders of typical meme coins are not protected by federal securities laws, while noting that fraud can still be pursued under other laws. It is a staff view, not a rule, and regulation differs by country.
How to Check for a Rug Pull: 7 Steps
Run these checks before you buy. Each one uses public explorers and scanners, so you can verify claims yourself.
Step 1: Check Whether Liquidity Is Locked
Liquidity is the pool of tokens and paired coins that lets people trade. If the creators can withdraw it at any time, the price can collapse instantly. Open the token on a DEX analytics site such as DEX Screener and check how much liquidity exists, who controls it, whether it is locked, and when any lock expires.
Also look at whether the lock covers a meaningful share of the pool and whether other pools remain under insider control (Trust Wallet). An unlocked or very short lock is a warning sign, but a lock alone does not make a token safe.
Step 2: See Who Holds the Supply
When a handful of wallets own most of a token, one sale can crash the price. Paste the contract address into a block explorer such as Etherscan, BscScan, or Solscan and open the holders list.
Exchanges, liquidity pools, bridges, and burn addresses often appear among the top holders, so ignore those and ask who controls the supply that can actually be sold. Investigate any large wallet that looks connected to the team.
Step 3: Review the Contract’s Permissions (EVM Chains)
Contract permissions show what the creator can still do after you buy. On Ethereum-style chains, scanners such as Token Sniffer, Honeypot.is, and GoPlus can flag risky settings. Check whether the contract allows:
- Minting new tokens
- Blacklisting or freezing specific wallets
- Unusual restrictions on buying or selling
- Changing the sell tax after launch
- Broad owner privileges held by one wallet
Also confirm the contract’s source code is published and verified on the explorer. A permission is not automatically malicious, but you should know who holds it and why it exists. Scanner results are a research aid, not proof of safety (Trust Wallet).
Step 4: Check Mint and Freeze Authority (Solana)
On Solana, two settings matter most. Mint authority lets its holder create new tokens, and freeze authority lets its holder freeze individual token accounts so they cannot transfer.
Helius documentation explains that a mint authority set to null is permanently revoked, and that a retained freeze authority can be used to build a honeypot because holders may be locked out of selling. For memecoins, revoking freeze authority at launch is the recommended practice. Open the token page in a Solana explorer and check the Authority tab. Stablecoin issuers keep these powers for legitimate reasons, so context matters.
Step 5: Test for Honeypots and Hidden Sell Taxes
A honeypot lets anyone buy but blocks or heavily taxes selling. Run the contract through a honeypot checker, compare the buy and sell tax, and confirm the fees cannot be changed after launch.
Some traders also make a very small test buy and sell. That can expose an obvious block, but it cannot reveal a rug that happens weeks later, so use it as an extra check only.
Step 6: Research the Team, Audit, and Project History
An anonymous team with no audit leaves nobody accountable if the project fails. Read the website and documentation, and search for the team’s public track record. If an audit is claimed, find the report on the auditor’s own site instead of relying on a badge.
Anonymity alone does not prove a scam, and an audit alone does not prove safety (Trust Wallet).
Step 7: Watch for Hype and Pressure Tactics
Pressure to buy immediately, promises of large returns, and loud promotion with no working product are manipulation tactics, not evidence of quality.
Never share your recovery phrase or private keys with anyone, including people who offer to “verify” your wallet.
Quick Checklist
| Check | Red flag | Where to look |
|---|---|---|
| Liquidity | Unlocked or short-term lock | DEX Screener, the token’s LP lock page |
| Holders | A few wallets own most of the supply | Etherscan, BscScan, Solscan holders tab |
| Contract | Open minting, blacklist, changeable tax | Token Sniffer, GoPlus, Honeypot.is |
| Solana authorities | Mint or freeze authority still active | Solana explorer Authority tab |
| Selling | Sells fail or sell tax is high | Honeypot checker |
| Team | Anonymous, no audit, no track record | Project site, auditor’s website |
| Promotion | Pressure to buy, guaranteed returns | Social media, Telegram |
What These Checks Cannot Tell You
These steps reduce avoidable risk, but they cannot guarantee a token is legitimate. A soft rug can unfold over months, a scanner can miss a new trick or flag a harmless feature, and a token can pass every check and still lose value in an ordinary market drop. Compare more than one tool, and treat disagreements between them as a warning.
Final Thoughts:
Learning how to check for a rug pull will not remove the risk, but it removes the easiest traps: unlocked liquidity, concentrated supply, and contract powers that let creators trap holders. If a token fails a check and you cannot explain why, skipping it is the safer choice. If several red flags appear together, walk away, and never put in more than you can afford to lose.
FAQs
How do I check for a rug pull on a new token?
Check whether liquidity is locked, who holds the supply, what the contract lets the owner do, whether selling works, who is behind the project, and whether promotion relies on pressure. On Solana, also confirm the mint and freeze authorities are revoked. These checks reduce risk but never guarantee safety.
Is locked liquidity enough to prove a token is safe?
No. A lock only restricts withdrawing the liquidity pool for a set time or under set conditions. Creators can still dump large holdings, use contract permissions, or leave other pools unlocked. Check the lock’s size and expiry, then combine it with holder and contract checks.
What is the difference between a rug pull and a honeypot?
A rug pull is the broad scam in which creators extract value and abandon a project. A honeypot is one form of it: contract code lets you buy but stops you from selling. Hard rugs remove liquidity, while soft rugs involve slow dumping by insiders.
Do Solana tokens need different rug pull checks?
The logic is the same, but the settings differ. Solana tokens use mint and freeze authorities instead of EVM-style owner functions. A retained mint authority lets the creator issue more tokens, and a retained freeze authority can lock holders out of selling. Check both in a Solana explorer.
Can rug pull checker tools be wrong?
Yes. Scanners flag known risky patterns, but they can miss new tricks or flag legitimate features, such as a stablecoin’s freeze function. Treat results as a research aid, compare more than one tool, and read the underlying permissions yourself before you decide.
Disclaimer
Disclaimer: This article is for educational and informational purposes only and is not financial, investment, or legal advice. Crypto assets are volatile, and you can lose some or all of your money. Always do your own research.
