How to Spot Crypto Scams and Rug Pulls Before You Lose Money

Meme coin trading offers outsized returns, but the same low barriers that create opportunity also attract predators. Chainalysis reports that crypto scam revenue exceeded $12.4 billion in 2023 alone. This guide gives you the full taxonomy of scam types, the free tools that detect them, and a repeatable checklist you can run in under two minutes. Our analysis follows the TrogMeme research methodology, cross-referencing on-chain data with published security audits.

What Is a Rug Pull in Crypto?

The mechanics are simple. A developer launches a token, seeds a liquidity pool on a decentralized exchange like Raydium or Uniswap, and promotes the token on social media. Once enough buyers swap SOL or ETH into the pool, the developer removes the paired liquidity and disappears.

Rug pulls differ from legitimate project failures. A failed project loses value because demand evaporates. A rug pull loses value because the creator engineered the loss from the start. The distinction matters legally and practically.

On Solana, where Pump.fun launched over 4 million tokens between January and December 2024, the speed of deployment makes rug pulls trivially easy. Solidus Labs reported that 98.6% of tokens created on Pump.fun showed characteristics consistent with pump-and-dump schemes.

What Are the Main Types of Crypto Scams Targeting Meme Coin Buyers?

A hard rug pull happens in one transaction. The developer removes 100% of liquidity from the DEX pool, crashing the token price to zero. Holders cannot sell because there is no paired asset left in the pool. The Squid Game token collapse in October 2021 drained over $3.3 million this way, according to reporting by the BBC and CoinDesk.

A slow rug is harder to detect. Insiders sell tokens gradually over days or weeks while maintaining the appearance of an active project. They post updates, engage in Telegram chats, and add minor features. The price declines steadily as insider wallets offload into retail buy pressure.

A honeypot contract uses modified smart contract code that allows buying but blocks selling. The buy function works normally, so victims see their tokens in their wallet. When they attempt to sell on Jupiter or Uniswap, the transaction reverts. GoPlus Security detected over 300,000 honeypot contracts across EVM chains in 2023.

Bundled launches occur when a developer uses multiple wallets to buy a large supply of their own token at launch, often through tools that bundle the deploy transaction and initial buys into a single block. This creates artificial price momentum and concentrates supply in wallets that appear unrelated. For a deeper breakdown of supply-concentration red flags, read our tokenomics red flags guide.

Fake influencer promotions use impersonation accounts on X (Twitter) and Telegram to fabricate endorsements. The FTC reported that social media was the contact method for 50% of crypto fraud losses in the U.S. during 2023, totaling over $1.4 billion.

How Do You Detect a Rug Pull Before It Happens?

Unlocked liquidity is the single most important red flag. If the developer can withdraw the SOL or ETH paired with their token at any time, a hard rug is one transaction away. Legitimate projects lock liquidity for a minimum of 6-12 months through services like Team Finance or built-in Raydium lock mechanisms.

Contract ownership tells you who controls the token. If the deployer has not renounced ownership, they retain the ability to mint new tokens, pause trading, or modify tax rates. On EVM chains, check whether the contract owner address matches the deployer on Etherscan or Basescan.

Wallet concentration above 20% in a single non-exchange wallet signals insider control. Bubblemaps visualizes this instantly. If the top 10 wallets hold over 50% of supply excluding exchange addresses and the token launched within 48 hours, the risk of coordinated selling is extreme.

Our full detection framework with 15 additional red flags is available in the meme coin red flags checklist.

Which Tools Scan Tokens for Scam Indicators?

RugCheck.xyz dominates Solana token screening. Paste any Solana token mint address and RugCheck returns a risk score covering liquidity lock status, top holder concentration, mint authority, and freeze authority. It processes over 100,000 token checks daily. The tool is free, requires no account, and returns results in under five seconds.

GoPlus Security operates across Ethereum, BNB Chain, Base, Arbitrum, and 20 additional EVM networks. Its Token Security API checks for honeypot code, hidden owner functions, trading cooldowns, anti-whale mechanisms, and blacklist functions. DeFi aggregators including DEXScreener integrate GoPlus data directly into their token pages.

TokenSniffer scores ERC-20 contracts on a 0-100 scale. It detects copied contract code, identifies known scam patterns, and flags contracts that match previously rugged tokens. TokenSniffer has catalogued over 200,000 confirmed scam contracts since its 2021 launch.

Bubblemaps provides visual cluster analysis of wallet holdings. It groups connected wallets, revealing when a single entity controls multiple addresses. This is the primary tool for detecting bundled launches and wash trading. Bubblemaps supports Ethereum, BNB Chain, Base, Solana, and Polygon.

How Do You Read a Bubblemaps Wallet Distribution Chart?

Start by entering the token contract address on Bubblemaps. The visualization loads within 15 seconds. Each bubble represents one wallet address. Bubble size corresponds to the percentage of total supply held.

Look for connected clusters first. Lines between bubbles mean those wallets have sent tokens or ETH/SOL to each other. A single developer operating 20 wallets will show as a tight cluster of connected bubbles. This pattern is the signature of a bundled launch.

Compare the largest cluster’s combined holdings against total supply. If the connected cluster holds more than 25% of circulating supply and the token is under 48 hours old, the probability of a coordinated dump is high. Cross-reference this with DEXScreener’s holder count. A token showing 500 “holders” on paper but 40% supply in one cluster on Bubblemaps has 500 addresses but one real whale.

Here is my definitive assessment after analyzing thousands of Solana token launches: the majority of tokens deployed through bonding curve platforms are explicitly designed to extract money from retail buyers, not to build lasting projects. The connected-cluster pattern on Bubblemaps appears in well over half of tokens that reach a $100,000 market cap on Pump.fun. Treat every new launch as a scam until the data proves otherwise.

What Do Real Rug Pull Case Studies Reveal?

Squid Game Token (SQUID), October 2021. Launched on BNB Chain during peak Squid Game TV show popularity. The contract contained an anti-sell mechanism, making it a honeypot. CoinMarketCap listed it, driving visibility. The price rose from $0.01 to $2,861 before the developer drained $3.3 million in BNB from the liquidity pool. The sell-blocking code was visible in the contract source on BscScan.

HAWK Token, December 2024. Promoted by influencer Hailey Welch on Solana. The token launched at a $490 million fully diluted valuation and crashed 95% within two hours. Bubblemaps analysis revealed that a cluster of insider wallets sniped over 80% of the supply at launch. Blockchain data from Solscan confirmed coordinated buying in the first block. The SEC and DOJ reportedly opened inquiries, according to reporting by The Block.

Luna Yield, August 2021. A DeFi yield aggregator on Solana that vanished with approximately $6.7 million in deposited funds. The team was pseudonymous, the smart contracts were unaudited, and liquidity was never locked. The Solana blockchain explorer confirmed the funds were bridged to Ethereum and mixed through Tornado Cash within hours of the exit.

Every one of these cases would have failed a basic pre-buy checklist. The tools existed. The on-chain data was public. The losses were preventable. If you are buying meme coins, learn the evaluation framework in our beginner buying guide before risking capital.

What Pre-Buy Safety Checklist Should Every Meme Coin Trader Follow?

Step 1: Check liquidity status. On Solana, paste the token address into RugCheck.xyz. Look for “LP Burned” or “LP Locked.” On Ethereum or Base, check the liquidity pool on DEXScreener and verify the lock through Team Finance or Unicrypt. If liquidity is unlocked, do not buy.

Step 2: Verify contract ownership. On EVM chains, check the contract on Etherscan or Basescan. Look for a “renounceOwnership” transaction. On Solana, RugCheck flags active mint authority and freeze authority. If the deployer retains either authority, the risk of supply manipulation is real.

Step 3: Analyze wallet distribution. Open Bubblemaps and enter the contract address. If the top 10 non-exchange wallets hold more than 40% of supply, or if you see a connected cluster above 20%, the token is vulnerable to a coordinated dump. Our whale manipulation guide explains how to track these wallets in real time.

Step 4: Run a contract scan. Use GoPlus for EVM tokens or RugCheck for Solana. Check specifically for: honeypot code, hidden mint functions, transfer tax above 5%, blacklist capability, and trading pauses. TokenSniffer provides a second opinion for EVM contracts.

Step 5: Verify holder count and age. On DEXScreener, check that the token has at least 300 unique holders and is more than 24 hours old. Tokens with fewer holders are easier to manipulate. Tokens younger than 24 hours have not faced their first major sell cycle. For a complete trading strategy framework, including position sizing and exit signals, see our trading guide.

No checklist eliminates all risk. Meme coins are speculative instruments with no fundamental value floor. But systematic screening separates calculated bets from blind gambling. Use the DEXScreener guide to integrate these checks into your daily workflow.