ArticlePropose editHistory

How to Spot a Rug Pull

From memecoin.wiki, the free memecoin encyclopedia
How to Spot a Rug Pull
How to Spot a Rug Pull
Image: original illustration, memecoin.wiki
updatedAugust 2026
reading time9 minutes

A rug pull can usually be caught before it happens by running five checks on a new token, whether its liquidity can be pulled, how much supply was bought in a coordinated bundle at launch, how concentrated the dev and insider wallets are, whether the contract actually lets buyers sell, and what the deployer's wallet did on previous launches.

Contents
  1. 1 What a rug pull actually is
  2. 2 Checking whether liquidity can be pulled
  3. 3 Checking the bundle before you buy
  4. 4 Checking dev wallet concentration
  5. 5 Running a honeypot check
  6. 6 Reading Bubblemaps and RugCheck together
  7. 7 Checking deployer history with a wallet tracker
  8. 8 What documented rug pulls looked like: LIBRA, HAWK and QUANT
  9. 9 The red flags checklist
  10. 10 References

A rug pull can usually be caught before it happens, not after. The checklist traders in the trenches run before buying a fresh Solana token comes down to five checks: whether the liquidity can be pulled out from under the pool, how much of the supply was bought in a coordinated bundle at the moment of launch, how concentrated the dev wallet and other insider wallets are, whether the contract actually lets buyers sell once they own the token, and what the deployer's wallet did on its previous launches. None of these checks is proof a token is safe. Together they catch the large majority of the pattern before money is committed.

What a rug pull actually is

A rug pull is an exit scam in which a token's creators abandon the project and extract its value, leaving buyers holding a worthless asset. Analysts split the pattern into two broad forms. A hard rug is engineered into the contract before launch, a hidden mint function, a blocked sell path as in a honeypot, or code that lets the deployer withdraw pooled liquidity on command. A soft rug needs no special code at all: the dev or a cluster of insider wallets simply dumps a large allocation into the market once buyers arrive, collapsing the chart. On launchpads like pump.fun, where liquidity sits inside an automated bonding curve and cannot be withdrawn by the creator before graduation to PumpSwap, the soft rug, usually paired with a bundle, is by far the dominant pattern in the trenches. A token abandoned by its creator but kept alive by holders undergoes a cto instead of dying outright.

Checking whether liquidity can be pulled

On a pump.fun style launch the bonding curve itself holds the liquidity and the creator has no withdrawal path, which is one reason hard rugs are rarer inside launchpads than on manually deployed pools. Off the launchpad, on a self deployed Raydium pair or an EVM pool, the question is whether the liquidity provider position is locked or burned. An unlocked LP position means the deployer can remove both sides of the pool at any time and walk away with the funds, the classic hard rug mechanism. RugCheck and similar scanners read this state directly from the chain and flag it automatically, which is why a scan is usually the first move rather than a manual liquidity provider token search, covered further down.

Checking the bundle before you buy

A bundle is a coordinated purchase of a large share of a token's supply across many wallets, typically executed atomically in the same block as the token's creation, so that no outside sniper can buy in before the bundled wallets do. Bundling has a defensive marketing pitch, stopping snipers from capturing the cheap end of the curve, but traders treat a heavily bundled launch as a warning sign because the hidden concentrated supply lets insiders dump on later buyers, turning them into exit liquidity. Checking bundle percentage is standard due diligence, and Bubblemaps and RugCheck both surface it, since a bundle is functionally an insider cluster wearing many wallet addresses instead of one.

Checking dev wallet concentration

In trenches shorthand, the dev is the creator of a coin, treated as its central and most watched actor. A wallet tracker or a block explorer such as Solscan shows exactly how much supply the dev wallet still holds and whether it has started moving toward an exchange, a transfer that often precedes a dump. A large dev holding is not automatically disqualifying on a fair launch platform where anyone could have bought that position, but a dev wallet that grew through the bundle rather than an open market buy is a materially worse signal, and a dev wallet actively trending toward zero mid chart is close to a confirmed rug in progress.

Running a honeypot check

A honeypot is a token whose contract allows buying but blocks or penalizes selling, letting the price rise on buy only volume before the scammer harvests the incoming funds and drains liquidity, completing the rug. Honeypots are chiefly a feature of EVM chains, where arbitrary contract code is normal; standard SPL tokens on Solana cannot hide that kind of logic, though Token 2022 extensions and modified programs can produce honeypot like behavior. Detection tools simulate a sell before a real buy is placed, and terminals such as Axiom and BullX surface a can sell flag directly on the token page, though a delayed activation honeypot can still slip past a one time check taken too early.

Reading Bubblemaps and RugCheck together

RugCheck, at rugcheck.xyz, is a free Solana token safety scanner: paste a contract address and it returns a risk report within moments, running more than twenty rule based checks across five categories, authority controls, liquidity, holder concentration, creator holdings, and sniper or bundler detection, classifying the token Good, Warning, or Danger (Solana Compass, profile dated 2026). It has been running since May 2023 and its bundler detection and Insider Networks graph analysis address bundling directly. "Did you rugcheck it" is a literal question in the trenches, and terminals including Photon and BullX embed its output on the trading screen itself. Bubblemaps does the visual half of the same job, rendering a token's holder distribution as a map of bubbles sized by supply share, with lines connecting wallets that share transfer history, so a launch where dozens of fresh wallets received supply from one funder appears as a visibly connected cluster (The Block, March 2025). A clean map is a buying argument; a tightly clustered one is a warning alongside a bad RugCheck score or an ugly Solscan holder page. Neither tool guarantees safety by itself: RugCheck and Bubblemaps both read on chain state, so an off chain rug, an insider dump timed around news, a promise never kept, a presidential post deleted after the fact, will not show up as a contract flag no matter how clean the scan looks.

Checking deployer history with a wallet tracker

A wallet tracker monitors chosen addresses and reports their activity in real time, and it is the tool for the question a scan cannot answer: has this specific deployer done this before. Pasting the token creator's wallet into Solscan, Kolscan, or KOL Explorer shows every previous token that wallet has launched and how each one ended, whether abandoned within minutes, slowly sold off, or actually developed. A wallet with a graveyard of same day rugs behind it is a far stronger signal than any single token's contract state, and it is the check most often skipped because it requires looking past the coin currently on screen. The same trackers double as an early warning system after a buy: an alert that the dev is moving tokens toward an exchange is frequently the last signal before a dump lands.

What documented rug pulls looked like: LIBRA, HAWK and QUANT

The wiki's own scandal record supplies the clearest worked examples of the pattern above turning real.

LIBRA, launched on Solana on February 14, 2025 and promoted within minutes by Argentine President Javier Milei, spiked to roughly 4.5 billion dollars in market capitalization on the strength of that post, then collapsed within hours. Court filings and reporting state that insider wallets withdrew between 80 and 100 million dollars from the token's liquidity in under an hour (DL News, February 2025), with researchers estimating total investor losses around 251 million dollars and an Argentine parliamentary commission later counting 114,410 wallets that recorded losses (Mercopress, February 2026). It is the trenches' canonical insider supply horror story, a bundle and a dev cluster with a presidential megaphone attached, and the token behind it is tied to Hayden Davis and Kelsier Ventures, with a US class action led by Burwick Law still active into 2026.

HAWK, launched December 4, 2024 as the token of viral personality Haliey Welch, debuted around 16.6 million dollars in market capitalization, spiked to approximately 491 million dollars within hours, then crashed more than 90 percent the same evening (Blockworks, December 2024). Onchain analysts reported a small cluster of wallets, including alleged snipers and insider allocations, controlled the bulk of supply and sold into the launch. Investors represented by Burwick Law and Wolf Popper sued in the Eastern District of New York on December 19, 2024 (Decrypt, December 2024), and a crypto investigator's on camera confrontation of Welch's team, later widely known through Coffeezilla's coverage, became one of the most replayed clips of the cycle.

QUANT, the coin at the center of the Quant kid incident, shows the pattern from the deployer's side rather than a promoter's. Its 13 year old creator bought roughly 51 million tokens, about 5 percent of supply, for around 350 dollars, then sold the entire position minutes later for 128 SOL, roughly 30,000 dollars at the time, as buyers piled in on his own livestream (CCN, November 2024). It is a textbook soft rug: no hidden contract mechanism, just a dev wallet with a large early position that sold into the exact buyers who trusted the launch, the same behavior a wallet tracker or a dev concentration check exists to flag before the fact rather than after.

The red flags checklist

  • Liquidity provider position is unlocked, unburned, or otherwise pullable by the deployer.
  • RugCheck or a comparable scanner returns a Warning or Danger score.
  • A Bubblemaps view shows a tight cluster of fresh wallets funded from one source.
  • A large share of supply moved as a same block bundle at launch.
  • The dev wallet holds a concentrated position it did not buy on the open market.
  • A sell simulation fails or is heavily taxed, the honeypot pattern.
  • The deployer's wallet has a history of abandoned tokens on Solscan, Kolscan, or KOL Explorer.
  • The dev wallet begins moving tokens toward an exchange after launch.

None of these alone is disqualifying, and a token can pass every check and still fail through an off chain promise broken later, as LIBRA's presidential post and HAWK's celebrity backing both show. Running the full list before buying, rather than any single item, is what actually catches most rugs before the chart does.

References

See also
Category: Guides
Last updated 2026-08-19