What Is a Rug Pull in Crypto? How It Works and How to Check a Token

A rug pull is a crypto scam in which the people behind a token or NFT project collect buyers' money and then abandon the project. Usually they drain its trading liquidity, sell their own large holdings, or block other holders from selling. The U.S. Department of Justice gave this definition in March 2022: "a scenario where the creator of an NFT and/or gaming project solicits investments and then abruptly abandons a project." Holders end up with tokens they cannot sell, or that sell for close to nothing.

How the money gets taken

Sardine, a fraud-prevention company, says that in a rug pull "insiders retain control over something critical and use it to extract value." It describes four methods:

• Draining liquidity. A new token usually trades against a pool that pairs it with an established asset, such as ETH or a stablecoin. Whoever controls the pool's liquidity can withdraw it, which leaves no counterparty for anyone who wants to sell.
• Minting and dumping. Insiders create or hold a large share of the supply and sell it into the market. The sales push the price down.
• Blocking sales. The token contract is written so that only insiders can sell. Solidus Labs, a blockchain-surveillance company, calls these tokens honeypots: they "prevent buyers from re-selling their tokens."
• Hidden functions. Malicious code in the contract lets insiders drain funds or change the rules after people have bought in.

Kaspersky, a security company, groups the mechanics into three categories: liquidity theft, limiting or blocking sell orders or withdrawals, and token dumping.

Hard and soft rug pulls: the terms vary

Sources use "hard" and "soft" in different ways.

• DataVisor (fraud prevention) uses the terms for speed. In a hard rug pull, a project's developers or administrators "completely and suddenly disappear." A soft rug pull "involves a more gradual or subtle exit strategy," in which funds may be drained over time.
• Kaspersky uses the terms for method. It describes hard rug pulls as developers coding "malicious backdoors into their tokens," and soft rug pulls as developers dumping their crypto assets quickly. It says the first is illegal and the second is "unethical but not always illegal."

When you see either term, check which definition the writer is using.

Prosecuted cases

Frosties NFTs (charged March 24, 2022)

According to the DOJ and IRS Criminal Investigation release, Ethan Nguyen and Andre Llacuna sold the "Frosties" NFT collection. After it sold out, they shut down the project and moved about $1.1 million in cryptocurrency proceeds to wallets they controlled. Prosecutors in the Southern District of New York charged each man with conspiracy to commit wire fraud and conspiracy to commit money laundering. Each charge carries a maximum of 20 years in prison. The release says they were preparing a second NFT sale, called "Embers," when they were charged.

Baller Ape Club (charged June 30, 2022)

The DOJ charged Le Anh Tuan, a Vietnamese national, in the Central District of California. Prosecutors allege that soon after the project's first public sale, he and his co-conspirators shut down Baller Ape Club, deleted its website and kept about $2.6 million from investors. According to the release, they laundered the money through "chain-hopping," which means converting funds between coins and moving them across blockchains, and through decentralized swap services. He was charged with conspiracy to commit wire fraud and conspiracy to commit international money laundering, with up to 40 years in prison if convicted on all counts. These are allegations.

Both cases follow the same pattern: a fast sale, then the project shuts down, then the money moves on-chain.

How common rug pulls are

• Chainalysis, January 29, 2025 (updated February 13, 2025): Of 2,063,519 tokens launched in 2024, 3.59% (74,037) showed "patterns that may be linked to pump-and-dump schemes." The test was this: an address added liquidity to a token's pool, later removed at least 65% of it (worth $1,000 or more), the pool had more than 100 transactions, and it then went inactive. Chainalysis says about 94% of these pools "appear to be rugged by the address that created the DEX pool." This is a heuristic match, not a count of confirmed fraud.
• Solidus Labs, October 27, 2022: Solidus says the creators of the SQUID token netted "over $3 million" within days of its release. It also says "eight percent of all Ethereum-based ERC-20 tokens are designed to pull the rug." Both figures are the company's own estimates.

Checks to run before buying a new token

No check proves a token is safe. These checks look for the warning signs described above.

1. Test whether you can sell. Buy and then sell a very small amount. If the sale fails or is blocked, that is the honeypot pattern Solidus Labs describes.
2. Check the liquidity. Sardine warns that "pool liquidity that is unlocked or can be withdrawn by insiders is a setup for a classic pull." Find out whether the pool's liquidity is locked, and until when.
3. Look at the holder list. ZenLedger, a crypto tax software company, says "most rug pulls involve the top ten wallets holding more than 20% of the token supply or a single wallet holding more than 5%." It gives no data source for these thresholds, so treat them as a rough guide. A block explorer such as Etherscan shows holder distribution.
4. Read the contract. Sardine lists unaudited contracts, disabled sells and hidden functions as warning signs. ZenLedger describes Token Sniffer, a tool that keeps a list of recent malicious contracts and scans contracts for known scams. A clean scan only means the contract does not match known patterns.
5. Research the team and the pitch. Sardine lists anonymous teams and promises of guaranteed returns as warning signs.

If it has already happened

Sardine says: "Recovery is hard, so prevention and fast tracing matter most." Save the transaction IDs, wallet addresses, the contract address and screenshots of the project's pages and channels before they disappear. In the United States, the FBI's Internet Crime Complaint Center (ic3.gov) takes complaints about cyber-enabled fraud and scams. As the cases above show, U.S. prosecutors have charged rug pulls as wire fraud and money laundering. Whether a specific rug pull is a crime depends on the jurisdiction and the facts.

The definitions and warning signs here come from commercial security and fraud vendors, and the prevalence figures are those companies' own estimates.