What is a rug pull?
A rug pull is a form of financial fraud in which a team abruptly abandons a project and disappears with investors’ funds. This type of scam is rife in the digital-asset market.
Every year users lose millions of dollars in cryptocurrencies to wrongdoers. Scammers often execute their schemes in the DeFi ecosystem, especially on decentralised exchanges (DEX), where it is easy to promote a token for a “pump”.
Rug pulls thrive on DEXs because the platforms allow coins to be listed for free and without the mandatory audits typically required for listings on CEX. The process of creating coins via smart contracts on Ethereum or Solana requires little technical know-how—something scammers readily exploit.
Fraudsters derive particular benefit from the popularity of meme tokens, since a deliberately jokey project spares them from concocting a fake business plan or roadmap.
How does a rug pull work?
Typically, developers heavily market their coin through influencers or other promotional ploys. The chief aim is to spark FOMO and induce impulsive buying without due diligence.
Bad actors may promise 100x returns, dangle cheap allocations of a not-yet-launched coin, tout imaginary technologies, and so on.
Once the project gains traction, the organisers list the token and create a liquidity pool (LP) on decentralised exchanges such as Uniswap or PancakeSwap. Where possible, the developers may “pump” the asset themselves with their own funds.
Buyers then swap ETH or another cryptocurrency for the scam token, after which the team drains the liquidity pools and vanishes—leaving investors holding a worthless coin.
What types of rug pull are there?
Though the goal is always the same—steal money—the methods vary. Broadly, rug pulls fall into two varieties: hard and soft.
In a hard rug pull the “carpet” is yanked suddenly, with no obvious warning. The token’s price plunges towards zero, and investors cannot sell because liquidity has vanished.
A soft rug pull takes longer. Here, developers delay their exit to lure in more victims.
Regardless of timing, rug pulls typically fit into three categories:
- Liquidity theft. The most common and straightforward scheme: developers withdraw all assets invested in the project from the LP. Because the team controls the token’s smart contract, it can grant itself unfettered access to the pools on DEXs.
- Sale restrictions. A stealthier tactic that tweaks the token at the smart-contract level to limit holders’ rights. For instance, once sufficient liquidity is amassed, scammers may block sell orders. They then dump their holdings at a time of their choosing, leaving investors with a useless token.
- Dumping. A type akin to a traditional Pump & Dump. Developers hype the token to attract investors and stoke trading activity—via marketing such as contests, giveaways and social-media ads. Scammers sometimes form communities and run other activities, but eventually they sell a chunk of their coins and abandon the project.
What notable rug pulls are known?
AnubisDAO was a DeFi project launched in 2021 and pitched as a fork of OlympusDAO. Hours before the token sale ended, developers withdrew all liquidity from the ANKH/ETH pool. Losses were estimated at $60m.
SQUID was a coin inspired by Netflix’s “Squid Game”. After launch, its price shot up to $2,856, but investors complained they could not sell on PancakeSwap. The price later crashed to $0.005.
The PEPE incident — in August 2023 the memecoin’s multisig wallet reduced the number of required confirmations from five to two and transferred more than 15.7trn coins to exchanges, triggering a 20% drop. The sole remaining PEPE developer said that three former team members were behind the $15m theft.
Bot scheme — in early 2024 Blockfence analysts identified scammers who created more than 1,300 scam tokens and, via rug pulls, stole over $32m from roughly 42,000 users. According to the researchers, the coin-creation process was almost fully automated. The algorithm selected and issued a token resembling that of an existing company or project.
URF presale — a scam on the Solana network. The memecoin’s team raised about 2,400 SOL (~$450,000 at the time) in a presale and disappeared with users’ assets without ever launching the coin.
How to identify a rug pull
Spotting such schemes requires vigilance and care. Start by researching the team, the project’s goals and its community. Watch for red flags such as anonymous developers or a lack of transparency.
Reputable projects often undergo third-party audits by security firms. Some independent researchers also scrutinise popular tokens. You can find detailed reports on token vulnerabilities online; if no such information exists, be wary.
Digital assets with liquidity locked for a defined period are relatively safer.
Engaging with the project’s community on social networks or forums can be revealing. A large number of active participants is a positive sign, though retail investors may still be unaware of developers’ true intentions.
Fraudsters often give themselves away with unrealistic promises and manufactured FOMO. Aggressive marketing and claims of triple-digit monthly returns are clear red flags.
Sometimes projects are not designed as scams at the outset, but as conditions worsen developers may decide to “slowly dump” the token.