A rug pull is a type of exit scam where the creators of a crypto project drain the liquidity or treasury and disappear with the funds. They're the most common form of DeFi fraud and have cost retail investors billions since 2020.
How Rug Pulls Work
The classic rug pull follows a pattern:
- Launch — Developers create a new token and pair it with SOL or USDC in a liquidity pool on a DEX
- Hype — Marketing via Telegram, Twitter/X, influencer promotion drives retail buyers
- Pump — Price increases attract more buyers, creating FOMO
- Pull — Developers either withdraw the liquidity pool (hard rug) or dump their pre-mined tokens on buyers (soft rug)
- Exit — Price collapses to near zero; buyers can't sell because liquidity is gone or price impact is extreme
Hard Rug vs. Soft Rug
Hard rug — The liquidity pool is fully removed by the developers. Buyers try to sell and find there's no liquidity to sell into. This is the most aggressive form and usually happens within hours to days of launch.
Slow rug (soft rug) — Developers hold a large portion of the supply and sell gradually over weeks, suppressing price. They may continue "development" while exiting. Less dramatic but more common.
Admin key rug — For projects with admin functions in the contract, developers use upgrade keys or mint functions to either create new tokens (diluting holders) or drain the contract directly.
Warning Signs
Liquidity is not locked — Legitimate projects lock liquidity in contracts like Unicrypt or Team Finance for 6–12+ months. If liquidity isn't locked, it can be removed instantly. Check on DexScreener — it shows liquidity lock status.
Anonymous team with no track record — Not every anonymous team rugs, but it's a risk factor. Look for doxxed team members, prior projects, or at least a verifiable social presence.
No audit or trivial audit — A real audit checks for admin functions that could be exploited. "Audit" PDFs from unknown firms are sometimes fake.
Mint authority not revoked (Solana) — If the token's mint authority hasn't been revoked, the developer can print unlimited new tokens. Check on Solscan: look at the token's mint account. If "Mint Authority" shows an active address, new tokens can be created.
Freeze authority not revoked (Solana) — If freeze authority is active, the developer can freeze your token balance. You keep your tokens but can never sell them. This is a common Solana-specific rug mechanism.
Concentrated holder distribution — If 10 wallets hold 80% of supply (excluding locked liquidity), the project is highly concentrated. Any coordinated sell will collapse the price.
Unrealistic APY promises — 10,000% APY is marketing for "we'll print tokens to pay you and dump the token on you."
How to Check a Solana Token
Before buying any new Solana token:
- Solscan token page — Check mint authority (should be null/revoked), freeze authority (should be null), top holders
- DexScreener — Check liquidity amount and lock status, trading history, age of the pool
- Birdeye — Holder distribution, insider wallet behavior
- RugCheck.xyz — Solana-specific rug risk scanner. Checks mint authority, freeze authority, LP lock, concentration
Red Flags That Are Absolute Disqualifiers
- Freeze authority is active and held by the team
- Mint authority is active and held by the team
- Liquidity is unlocked and owned by team wallets
- Contract has an upgrade proxy controlled by a single EOA
- No source code published or verified
Any one of these is a reason to avoid. All of them together means certain rug.
After a Rug Pull
Recovery is rare. If liquidity is drained to an on-chain address, sometimes investigators (or the project team itself) can be identified via chain analysis. Occasionally projects are caught and funds returned — but the base rate is very low.
Your best protection is front-loading due diligence before buying, not trying to recover after.