The Anatomy of a Rug Pull: How Crypto Rug Pulls Work

Key Takeaways

The overview page on common crypto scams covers rug pulls as one category among several, distinguishing a "hard" rug built into the contract from a "soft" rug where a team simply stops delivering. This page goes deeper into the hard-rug mechanics specifically: the exact contract and liquidity-pool functions creators exploit, how each variant plays out step by step on-chain, and the concrete due-diligence checks that catch each one before capital is at risk.

Direct answer: A rug pull happens when a token or project's creators withdraw liquidity or otherwise drain value from the project, leaving investors holding an asset that is worthless or illiquid. It's possible because a small team typically retains disproportionate control over the token contract, the liquidity pool, or both — control that, in a genuinely decentralized or safely structured project, would be locked, time-delayed, or distributed across many independent parties instead of sitting in one team's hands.

• Rug pulls take four main technical forms: liquidity pulls, malicious minting, honeypot sell restrictions, and slow rugs.
• A liquidity pull can crash a token's value to near zero within a single confirmed transaction.
• An "audit" badge does not rule out a rug pull; many audits are low-quality or don't evaluate this specific risk.
• Liquidity-lock status, holder concentration, and contract verification are checkable before investing, not after.
• A slow rug can look like ordinary market activity for weeks before the underlying pattern becomes obvious.

The Core Mechanism: Why Rug Pulls Are Possible at All

Every rug pull traces back to the same underlying condition: someone other than the broader set of token holders retains the power to unilaterally destroy the token's value, and nothing on-chain prevents them from using it. That power can live in two places, often both at once.

The first is the token contract itself. Most tokens on Ethereum and similar chains follow a standard interface (ERC-20 and its equivalents on other chains) that defines a baseline set of functions — transfer, balance checks, approvals — but nothing stops a developer from adding extra functions on top of that standard. An owner-only mint function, a blacklist function that can freeze specific addresses, or a switch that disables all transfers except from an approved list are not violations of any technical rule; they're just additional code the deploying team chose to include, and unless the contract's ownership has been formally renounced or handed to a decentralized governance process, that team retains the ability to call those functions whenever they choose.

The second is the liquidity pool. Most new tokens gain a tradable market price by being paired with a more liquid asset — typically the chain's native coin, like ETH, or a stablecoin — inside a decentralized exchange's liquidity pool. Whoever supplied that pool's liquidity receives "LP tokens" representing their claim on it, and holding those LP tokens is what gives someone the right to withdraw the underlying assets at any time. When a project's own team supplies most or all of the initial liquidity and keeps the resulting LP tokens in a wallet they control, they hold a standing, permissionless option to withdraw that liquidity whenever they want — an option that has nothing to do with the token contract's code and everything to do with who controls the pool.

Both forms of control are entirely normal at the moment a token launches; someone has to deploy the contract and someone has to seed the initial liquidity. The distinction between a legitimate early-stage project and a rug pull waiting to happen is whether that control gets relinquished, locked, or distributed as the project matures — through ownership renunciation, a time-locked liquidity contract, or a broadening of who holds meaningful influence over the contract and pool — or whether it stays concentrated in the hands of a small, often anonymous team indefinitely.

The Four Main Technical Variants

"Rug pull" gets used as a catch-all term, but the mechanics underneath it split into four distinct patterns. They aren't mutually exclusive — a single project can combine more than one — but each exploits a different point of control, and each leaves a different kind of evidence to look for beforehand.

1. Liquidity pull

This is the variant most people picture when they hear "rug pull." The team behind a token holds the LP tokens for the pool pairing their token with a real asset like ETH or a stablecoin. At a moment of their choosing — usually once trading volume and the token's price have built up — they call the liquidity pool's withdrawal function, removing the paired asset (and their share of the token side) from the pool in a single transaction. Because the token's price on a decentralized exchange is derived directly from the ratio of assets sitting in that pool, removing the paired asset doesn't just reduce the price; it collapses the pool's ability to price the token at all. Anyone still holding the token is left with a balance that shows a number in their wallet but has no meaningful market to sell into, since the liquidity that made selling possible is gone.

2. Malicious minting

Rather than touching liquidity directly, this variant attacks the token's supply. The contract includes a mint function that's supposed to be either nonexistent post-launch or restricted by a transparent, capped schedule, but is instead callable at will by the owner address. When the creators call it, they generate a large quantity of new tokens — often orders of magnitude more than the original circulating supply — and typically sell that new supply directly into the existing liquidity pool. Because the pool's pricing math treats every unit of the token as fungible with every other unit, flooding it with newly minted tokens and selling them extracts the paired asset (again, ETH or a stablecoin) from the pool while diluting every existing holder's percentage ownership toward zero, without necessarily triggering the sudden, all-at-once liquidity withdrawal that a liquidity pull produces. It can look, briefly, like heavy sell pressure from an ordinary large holder rather than an obviously malicious event.

3. Sell restrictions (the honeypot pattern)

This variant doesn't require withdrawing anything at all — it works by breaking the token's sell path for everyone except the creators. The contract's transfer logic (the function that actually moves tokens between addresses, called every time someone sells) contains conditional code that behaves differently depending on who's calling it: addresses on an allowlist, typically the creator's own wallets, can sell normally, while every other address either has the transaction revert outright or gets hit with a tax so extreme — sometimes 90% or more — that selling is functionally blocked. From the outside, and to any buyer who hasn't tried to sell yet, the token looks completely normal: it can be bought, its price chart shows movement, and its liquidity pool appears healthy. The trap only becomes visible the moment a non-creator wallet attempts to sell and the transaction fails or returns almost nothing. Because buying continues to work throughout, and because a rising number of unaware buyers keeps adding real paired assets to the pool, the price can only go up for as long as the creators choose to let it — right up until they sell their own allowlisted holdings into that inflated pool and walk away with the accumulated liquidity.

4. Slow rug

The slow rug trades speed for deniability. Instead of a single dramatic withdrawal, the project's tokenomics allocate a large share of total supply to the team or an associated treasury wallet at launch — sometimes disclosed openly as a "team allocation," sometimes obscured across multiple wallets that don't obviously connect back to the team. Rather than dumping that allocation all at once, which would be immediately visible as a crash, the team sells gradually: a portion each day or week, sized to stay under the threshold that would panic the community or show up as an obvious anomaly on a price chart. Development activity, social media posts, and community engagement typically continue for a while, providing cover and a reason for remaining holders to explain away the gradually declining price as normal volatility. Over weeks or months, the cumulative effect is the same as a liquidity pull — most of the real value has been extracted from the pool through selling pressure — but there's no single transaction or moment that makes the exit obvious in real time, and by the time it's unambiguous, the team's exit is largely complete.

Worked Example: A Liquidity-Pull Rug Pull, Step by Step

Hypothetical, generic example — for education only. Not based on any specific real project.

A new token launches on a decentralized exchange with a modest amount of initial liquidity supplied entirely by its two anonymous founders — say, an amount of ETH paired against the full initial token supply, with the resulting LP tokens sitting in a wallet the founders control. The project has a simple website, a logo, and a name that riffs on a currently popular market narrative. No contract audit is published; the team's social accounts are a few weeks old.

Within the first hours after launch, the token gets picked up by crypto-focused social media accounts and small trading communities. Screenshots of an early, sharp price increase circulate, framed as evidence of an emerging opportunity. That price movement is real, in the narrow sense that it reflects actual buy transactions hitting a small liquidity pool — a pool that size can move a lot on comparatively little buying pressure — and each new buyer's ETH goes into the pool, mechanically pushing the token's price further up and making the chart look increasingly compelling to the next wave of buyers.

Over the following day, buying volume accelerates as more accounts share the token, some through genuine excitement and some through paid promotion the team arranged specifically to drive this exact reaction. The pool now holds a meaningfully larger amount of ETH than it started with, contributed entirely by buyers over the preceding hours. The token's on-chain price chart shows a steep, sustained climb with no clear top.

At a point the founders choose — often timed to a local peak in buying activity — one of the founder wallets calls the liquidity pool's withdrawal function using the LP tokens it has held since launch. That single transaction removes essentially all of the ETH from the pool, along with the founders' share of the remaining token supply. The transaction confirms within seconds to a couple of minutes depending on network conditions. The moment it does, the pool that gave the token a tradable price effectively no longer exists in any meaningful sense; the token's quoted price on tracking sites either shows a near-total, instantaneous collapse or simply stops updating in any way that reflects a real, executable trade.

Anyone who bought in the preceding hours still holds a token balance in their wallet — the number doesn't disappear — but there is no longer a functioning market to sell it into. Attempting to sell through the same decentralized exchange either fails outright or executes at a price near zero, because the liquidity that made a real trade possible is gone. The founders' social accounts typically go silent or delete their posts shortly after, and the ETH that was withdrawn moves on to other wallets, often through a mixing service or a series of intermediate transfers designed to make it harder to trace. The entire cycle, from initial hype to an untradeable token, frequently completes in under 24 hours.

Warning Signs Before Investing

None of these signs alone is proof of an eventual rug pull, and plenty of legitimate early-stage projects will show at least one of them temporarily. Taken together, though, they describe exactly the conditions that make each of the four variants above possible.

Practical checklist

• Unverified or unaudited contract code. If a block explorer shows the contract's source code as unverified, its actual logic — including any hidden mint function or sell restriction — can't be independently reviewed at all; verification is a prerequisite for any other technical check, not a substitute for one.
• Liquidity not locked, or locked for only a short period. If the team's LP tokens sit in an ordinary wallet rather than a verified time-locked contract, or a lock exists but expires in days rather than months or years, the liquidity-pull variant remains fully available to them at any time.
• A small number of wallets holding a large percentage of total supply. Heavy concentration, whether in the team's own wallets or a handful of early insider addresses, means a small number of coordinated sells (or a mint event, if minting is possible) can move the market disproportionately.
• An anonymous team with no verifiable track record. Anonymity alone isn't disqualifying in crypto, but paired with the other signs here it removes any reputational cost to the team from executing an exit, since there's no established identity to hold accountable afterward.
• Unrealistic promised returns. Marketing that promises guaranteed or outsized gains with no real product, use case, or revenue behind the token is a sign the project's actual plan may be to generate buying pressure to exit into, rather than to build something durable.

Common mistake

The common mistake is treating any single reassuring signal — a locked liquidity claim, an audit badge, a doxxed-looking team photo — as sufficient on its own, without checking whether that signal actually holds up (a lock that's real but short, an audit that's real but shallow, a "doxxed" identity that's unverifiable). Each of the checks in the next section exists specifically to verify these claims rather than take them at face value.

Practical Due-Diligence Steps

These three checks take a few minutes each and directly target the mechanisms described above, rather than relying on the project's own marketing claims about itself.

Practical checklist

• Check whether liquidity is locked, and for how long, using a liquidity-lock verification tool. These tools look up the pool's LP token address on a block explorer and confirm whether those tokens are actually held by a recognized, verified time-locked contract — not just check whether the project claims a lock exists. Note the lock's expiration date and what percentage of total liquidity it covers; a lock on only part of the pool still leaves the unlocked portion withdrawable.
• Check token holder distribution for concentration. A block explorer's "holders" tab shows the top wallet addresses by balance and their percentage of total supply. Heavy concentration in a handful of addresses — especially ones that can be linked to each other or to the deploying wallet — signals that malicious minting, a coordinated slow rug, or simple dump risk is more available to those holders than the top-line market cap suggests.
• Check whether the contract is verified and whether a reputable firm has audited it. Source verification on a block explorer is the baseline requirement for any of this analysis to be possible at all. Beyond that, look up whether an audit exists from a firm with an established, checkable reputation, read what scope the audit actually covered (some audits explicitly exclude checking for rug-pull-enabling design choices, since those aren't technically "bugs"), and treat an audit badge with no findable, verifiable report behind it as equivalent to no audit at all.

Common mistake

The common mistake is stopping at the first reassuring result instead of running all three checks together. A token can pass a contract-verification check and still be a slow-rug risk through concentrated holdings, or have decent holder distribution while still carrying an unlocked liquidity pool; the three checks cover different failure modes and none of them substitutes for the others.

Misconceptions Versus Reality

Common Mistakes

• Buying purely on social media hype without checking liquidity-lock status. A fast-moving price chart and a wave of social posts create urgency that discourages the few minutes it takes to check whether the liquidity behind that price is actually locked, which is exactly the gap the liquidity-pull variant depends on.
• Not checking token holder concentration before investing. Skipping the holders tab on a block explorer means missing the clearest available signal that a small number of wallets could move the market unilaterally, whether through coordinated selling, a mint event, or a slow rug.
• Treating a successful small buy-and-sell test as a full clearance. A single small round-trip test can help catch an obvious honeypot, but it doesn't rule out malicious minting, an unlocked liquidity position, or a slow rug that hasn't started yet — all of which are invisible to a one-time transaction test.
• Assuming a project with real-looking marketing, a roadmap, and active social accounts is automatically legitimate. All of those are cheap to produce and are routinely built specifically to support the run-up before an exit, rather than being evidence against one.

Risks, Limitations, and Exceptions

• Liquidity-lock verification tools and block explorers cover the chains and locking services they specifically support; a project on a newer or less common chain may fall outside available tooling.
• Contract patterns evolve, and creators actively design around known detection methods, including tools built to flag honeypots and malicious mint functions automatically.
• Holder-concentration data can understate real concentration when a team spreads holdings across many wallets that aren't obviously linked to each other.
• A liquidity lock's legitimacy still depends on the reputation and security of the locking service itself; a compromised or fraudulent locking service undermines the protection a lock is supposed to provide.
• None of the checks in this guide can fully rule out a slow rug in progress before enough selling has occurred to make the pattern visible in holder or transaction data.
• This guide describes common patterns as of publication; new technical variants continue to appear as detection tools and investor awareness improve.

Sources

• Chainalysis, Chainalysis Blog and annual Crypto Crime Report, chainalysis.com — ongoing on-chain research quantifying rug pulls and related exit-scam activity across blockchain networks.
• CertiK, CertiK Skynet research and blog, certik.com — a blockchain security firm publishing analysis of honeypot contracts, malicious mint functions, and rug-pull mechanics identified through contract audits and on-chain monitoring.
• Federal Trade Commission, "What To Know About Cryptocurrency Scams," consumer.ftc.gov — a consumer-facing overview of common crypto scam patterns, including project failures and exit-scam warning signs.

Frequently Asked Questions

Conclusion

A rug pull isn't one thing technically — it's four related failure modes that all trace back to the same root cause: a small team retaining unchecked control over a token contract, a liquidity pool, or both. Understanding the mechanics behind a liquidity pull, malicious minting, a honeypot, and a slow rug turns the usual advice ("do your own research") into a specific, checkable process: verify the contract, check the liquidity lock independently, and look at holder concentration before capital goes in, not after the price starts moving.

Related Reading

• Common crypto scams — the parent overview covering rug pulls alongside phishing, impersonation, investment fraud, and other scam categories.
• Honeypot tokens explained — a closer look at the sell-restriction pattern introduced in this guide.
• Exit scams explained — how the broader category of project-level exit scams relates to and differs from a technical rug pull.
• Token distribution and concentration — a deeper walkthrough of how to evaluate holder concentration and insider allocation risk.
• How to analyze tokenomics — the broader framework for evaluating a token's supply, allocation, and incentive design before investing.