How to Spot a Rug Pull Before You Buy: 15 Red Flags
Rug pulls drain billions from crypto traders. Learn the 15 red flags — from mint authority to unlocked liquidity and insider wallets — and how to check them fast.
TRENCHSCORE RESEARCH··6 MIN READ
A rug pull is when the people behind a token take investors' money and leave them holding something that can't be sold for anything close to what they paid. It is the most common way traders lose money on new tokens, and it almost always leaves fingerprints before it happens — in the contract, in the liquidity pool and in the wallets holding supply.
This guide walks through the red flags we check on every token, grouped by where you'll find them. You don't need to read code, and if a term is unfamiliar, the trading glossary has it. Most of these checks take seconds on a token page.
//How common are rug pulls?
Very. In its 2025 report on market manipulation, Chainalysis flagged 74,037 tokens launched in 2024 — about 3.59% of all new tokens — as suspected pump-and-dumps, and found that roughly 94% of the DEX pools involved were drained by the same address that created them. On Solana, a Solidus Labs study of more than seven million Pump.fun tokens found that only about 1.4% ever held more than $1,000 of liquidity; the rest collapsed or showed suspicious trading. Not every failed token is a deliberate scam, but the base rate tells you to assume risk until a token proves otherwise.
//The three types of rug pull
Hard rug (liquidity pull). The creator removes the liquidity from the pool in one transaction. The chart goes vertical-down and there's nothing left to sell into. This is only possible when the creator still controls the LP tokens.
Soft rug (slow dump). Insiders who quietly hold a large share of supply sell into every pump, or liquidity is withdrawn a little at a time so it doesn't trip alarms. Solidus Labs found that about 93% of Raydium pools it examined showed soft-rug characteristics like slow liquidity withdrawals.
Contract rug. The code itself is the trap: buyers can't sell (a honeypot), the owner mints new supply and dumps it, raises the sell tax to 99%, or freezes holders' accounts.
//Contract red flags
1. Mint authority is still active
If someone can create new tokens, they can print supply and sell it into your bid. On Solana this is the mint authority; on EVM chains it's a mint function the owner can call. A fixed supply is the baseline for any memecoin. Read more in Mint and freeze authority explained.
2. Freeze authority or blacklist functions
A freeze authority (Solana) or blacklist (EVM) lets the owner stop specific wallets from moving tokens — buyers can get in but not out. This is the mechanism behind most honeypot tokens.
3. The sell simulation fails
Security scanners simulate a buy and a sell. If the sell reverts or loses most of its value, stop there. No upside is worth a token you can't exit.
4. Adjustable or extreme taxes
A 3–5% tax can be legitimate. A tax the owner can change at any time, or a sell tax far higher than the buy tax, is a classic trap. See how high is too high.
5. Hidden owner, proxy or "fake renounce"
"Ownership renounced" means nothing if an upgradeable proxy lets an admin swap the code, or if a second privileged role still exists. Details in renounced ownership and proxy contracts.
//Liquidity red flags
6. Liquidity isn't locked or burned
If the deployer still holds the LP tokens, they can withdraw the pool whenever they like. Burned LP (sent to an unrecoverable address) is the strongest protection; a time lock protects you only until its unlock date. See liquidity locks vs LP burns.
7. Thin liquidity compared to market cap
A $5M market cap sitting on $40K of liquidity means the price can't absorb real selling. Even without a scam, you'll lose a big chunk to price impact on the way out. Our guide on why liquidity matters shows the maths.
8. Liquidity that keeps shrinking
Watch the liquidity number over hours, not just at a glance. A pool that steadily loses depth while the price holds up is a soft rug in progress.
//Holder red flags
9. A few wallets hold most of the supply
If the top 10 wallets (excluding the pool, burn address and known lockers) hold a large share, they decide the price. Learn how to read top holders.
10. Connected wallet clusters
Insiders spread supply across dozens of fresh wallets so no single holder looks big. Wallets funded from the same source, or that bought in the same block at launch, are one entity. A bubblemap makes these clusters visible.
11. Bundled or sniped launch
When a big chunk of supply is bought in the first block, it usually wasn't the public. Bubblemaps has documented launches where around 90 freshly funded wallets bought roughly 90% of supply simultaneously. Read bundles, snipers and insider wallets.
12. The developer wallet is selling
Track the creator's wallet. A dev who sells steadily into every green candle is telling you their plan.
//Market and community red flags
13. Volume that doesn't match the holders
Huge volume with very few unique traders, or round-number trades bouncing between the same wallets, points to wash trading designed to get the token onto trending lists. See real volume vs wash trading.
14. Hype without a community
A Telegram with thousands of members but no real conversation, an X account full of bot replies, or promotion that's all paid placements is rented attention — and rented attention leaves. More in is a crypto community real?
15. Pressure and urgency
"Last chance", countdowns, guaranteed returns and admins DMing you first are social-engineering, not marketing. Real projects don't need you to decide in the next five minutes.
//What to do when you find red flags
- 01Don't buy "just a little to see". Small buys into a honeypot are still lost.
- 02If you already hold, check whether you can sell with a small amount first.
- 03Never approve unknown contracts or sign messages to "verify" or "claim" — that's how wallet drainers work.
- 04Write down what you saw. Patterns repeat, and the same deployers launch again.
//How TrenchScore helps
Every token page on TrenchScore runs these checks automatically: contract audit (mint, freeze, honeypot simulation, taxes, ownership), liquidity, holder concentration, wallet clusters and community signals, rolled into a single TrenchScore. Tokens with confirmed scam signals never make the Trench 100. Paste any contract address into the search bar to check it — and use the 10-minute due diligence checklist for everything a score can't see.
//Frequently asked questions
Can a token rug pull if liquidity is locked?+
Yes. A lock only stops the LP tokens from being withdrawn until the unlock date. The creator can still dump a large token supply into the pool, mint new tokens if mint authority is active, or trap buyers with a honeypot contract. Locked liquidity is one check, not a guarantee.
What is the difference between a hard rug and a soft rug?+
A hard rug removes the liquidity in one transaction, so the price collapses instantly. A soft rug drains value slowly — insiders sell into every pump or withdraw liquidity a little at a time — so it can look like a normal decline until there is nothing left.
Is a renounced contract safe?+
Not on its own. Renouncing the owner role removes some powers, but an upgradeable proxy admin, a hidden secondary role, or a large insider holding can still hurt holders. Treat renounced ownership as one positive signal among several.
How can I check if a token is a rug pull for free?+
Paste the contract address into TrenchScore. The token page shows the contract audit, liquidity, holder concentration, wallet clusters and community signals in one place, plus a TrenchScore that summarises them.
// Sources
Educational content, not financial advice. Crypto assets are highly risky and most new tokens lose most of their value — always do your own research.