Someone in a Telegram group swears a new token will do a hundred times. The chart is vertical, the holders count climbs every minute, and you wonder whether it is a real project or a trap. That question has a name. What is a rug pull? It is a launch in which the people who control a token, its liquidity or its blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract take the buyers’ money out of the market, and the buyers are left holding something nobody can buy back from them.
The Squid Game token is the textbook case. Released at one cent in late October 2021, SQUID reached $2,861.80 on 1 November and fell to zero within hours, Threatpost reported the next day. Buyers had found out too late that the contract only let the developers sell. Five years on, the pattern keeps returning in new clothes, from NFT collections to Solana memecoins, and US prosecutors filed charges in October 2026 over a token launched in April 2021.
Our overview of crypto scams maps the whole family. This page stays on rug pulls: the mechanics behind them, the cases that reached a courtroom, the checks a buyer can run in a few minutes, and the laws that apply in the US, the UK and the EU.
What is a rug pull in crypto, and what it is not
The expression comes from “pulling the rug out from under someone”. In crypto it describes a specific kind of exit: insiders have a way to take the value that buyers put in, and they use it. The way can be technical (a liquidity pool they can empty, a function only they can call) or simply a pile of tokens they kept quietly and sell into the demand they created.
Security firm CertiK splits rug pulls into two families in its explainer on hard and soft rug pulls. A hard rug pull is abrupt: the team withdraws the funds at once, often through a back door written into the project from day one. A soft rug pull is slow: the founders sell their own tokens while acting as if the project were alive, then walk away.
Three things are not rug pulls, even if the chart looks the same. A project that fails honestly, with a team that spent the money on development and simply did not find users, is a bad investment, not a theft. A hack, where an outsider steals from a protocol through a bug, is a different crime with a different culprit (our lesson on whether a blockchain can be hacked explains that side). And a pump and dump, where a group inflates the price of an existing asset to sell it to latecomers, overlaps with the soft rug pull but is the subject of a later lesson in this path.
Most rug pulls happen with tokens rather than coins: anyone can create a token on top of an existing blockchain in minutes, without building a network of their own. If that distinction is new to you, read our guide to coins and tokens first.
How a hard rug pull drains the liquidity pool
To understand the most common rug pull you need to understand where a new token’s price comes from. A token that is not listed on any exchange trades on a decentralized exchange, through a liquidity pool: a smart contract that holds two assets and lets anyone swap one for the other.
Liquidity removal, step by step
The Uniswap V2 documentation describes how such a pool works. It starts empty. The first person to deposit both assets sets the starting price through the ratio of what they put in. In return they receive liquidity tokens, often called LP tokens, which represent their share of the pool. Whoever burns those LP tokens later takes back their share of both assets, plus the fees earned.
Nothing about this is dishonest. It is how Uniswap, PancakeSwap and many other exchanges operate, and it is why anyone can list a token without asking permission. The rug pull uses that same mechanism against buyers.
Here is the sequence. A team creates a token and pairs it with ether or a stablecoin in a new pool, keeping the LP tokens. Marketing starts: a website, a roadmap, influencers, a countdown. Buyers send real ether into the pool to get the new token, so the pool fills with ether while its stock of the new token shrinks. Then the team burns its LP tokens and withdraws the pool’s ether in a single transaction. What is left is a token with almost nothing to trade against. Its price drops close to zero, not because the market changed its mind but because there is no money left to sell into.
AnubisDAO showed how fast it can go. Announced on 28 October 2021, its ANKH token sale drew about $60 million in ether overnight. At 11:58 UTC, roughly 20 hours into a 24-hour sale, the liquidity was moved to another address, The Block reported on 29 October. Online sleuths linked the receiving wallet to a Twitter account whose owner later said they may have been phished. Whether it was an insider exit or a theft has never been settled in public, so the case is best described as a suspected rug pull.
Code that will not let you sell
The second family of hard rug pulls needs no pool withdrawal at all. The contract itself decides who can sell. Analysts call such a token a honeypot: money goes in, it does not come out.
SQUID worked this way. Holders found they were blocked from selling by what the project called an “anti-dumping mechanism”. A security researcher told Threatpost that such a block takes a single extra line in the token’s transfer function, one that refuses the swap in the sell direction. Buyers watched the price climb without being able to sell, then watched it hit zero. Gizmodo put the potential losses at about $3.4 million, an estimate cited by Threatpost; no charge against anyone has been reported in the sources we checked, as of October 2026.
A honeypot can be subtler than an outright ban. A contract can let the owner add addresses to a blacklist that cannot transfer, or charge a “tax” on each sale that the owner can raise at will, from 5% to 99%. On paper you can still sell. In practice you receive nothing.
Hidden mint functions and other owner powers
An ERC-20 token, the standard format on Ethereum, can include a mint function that creates new units. That is normal for many honest projects: stablecoin issuers mint when customers deposit dollars. The danger is a mint function that only the owner can call, with no limit and no oversight. Once buyers have filled the pool, the owner mints millions of fresh tokens and sells them into it, which drains the pool just as surely as removing liquidity, only with more steps.
So the question is never “does this token have a mint function?” but “who controls it, and what stops them?”. The same reasoning applies to functions that let an owner pause transfers, change balances or move tokens out of holders’ wallets. On Solana, where tokens follow a different standard, the equivalent powers are the mint authority (who can create more supply) and the freeze authority (who can freeze a holder’s token account). Checkers built for Solana look at both first.
Upgradeable contracts: the code you checked can change
A last trap catches careful buyers. Many contracts are upgradeable: users talk to a proxy contract that forwards every call to a separate implementation contract holding the logic. OpenZeppelin’s documentation explains that the proxy’s address never changes, while whoever controls the upgrade (a single address, a multisig or a DAO) can point it to a new implementation.
Upgradeability has good reasons, such as fixing bugs. But it means that a contract you read and found clean on Monday can behave differently on Tuesday. When a token sits behind a proxy, the useful questions are who holds the admin rights, whether changes must wait behind a timelock that gives holders time to leave, and whether a group of independent signers must approve them.
Soft rug pulls: the slow exit through team wallets
A soft rug pull leaves no smoking gun in the code. The contract is ordinary, the liquidity may even be locked. What the team has is a large allocation of tokens, sometimes disclosed, sometimes hidden across many wallets. As long as buyers keep arriving, the team sells a little at a time, keeps posting updates and promises, and slowly stops building. One day the social accounts go quiet.
CertiK cites Polywhale Finance, whose team withdrew more than $1 million in tokens before abandoning the project. The firm also notes that a soft rug pull is not illegal in the clear-cut way a hard one is, because the project is technically still running and selling your own tokens is not a crime in itself. What turns it into fraud is usually a lie: telling buyers the team holds nothing, or that its tokens are locked, while selling them.
That is exactly what US prosecutors allege in the Kishu Inu case described below. It is also why holder maps matter. Tools that cluster wallets which received tokens from the same source, or traded with each other, can reveal that “hundreds of holders” are in fact a handful of people. In the LIBRA affair of February 2025, the analytics firm Bubblemaps used this method to follow about $87 million withdrawn from the liquidity pool by wallets it linked to the team, as reported by Decrypt.
Real rug pull cases and what happened to the people behind them
Court outcomes are the best test of what a rug pull is in law. Some founders were charged and pleaded guilty; many were never identified. The list below sticks to what courts and prosecutors have said, and keeps allegations as allegations.
Frosties and Mutant Ape Planet: NFT exits in US courts
Rug pulls are not limited to tokens. Around 9 January 2022 the Frosties NFT collection sold out, and within hours its creators abandoned it: the website went dark and about $1.1 million in crypto moved to wallets they controlled, according to the IRS Criminal Investigation release of 24 March 2022. Federal prosecutors in Manhattan charged Ethan Nguyen and Andre Llacuna, arrested in Los Angeles, with conspiracy to commit wire fraud and conspiracy to commit money laundering, each count carrying a maximum of 20 years. Prosecutors said the pair were preparing a second collection, Embers, expected to raise about $1.5 million. We found no report of a plea or a sentence as of October 2026.
Mutant Ape Planet ended with a guilty plea. Aurelien Michel, a French citizen arrested at New York’s JFK airport, pleaded guilty in federal court in Brooklyn to conspiracy to commit wire fraud, Decrypt reported on 14 November 2023. Holders lost almost $3 million after promised giveaways and staking rewards never came. He faced up to five years and agreed to forfeit $1.4 million. We found no report of his sentence. According to prosecutors, he told buyers: “We never intended to rug, but the community went way too toxic.”
Kishu Inu: charges five years after the launch
The most recent case shows that a rug pull can catch up with its authors years later. On 6 October 2026, a federal grand jury in Chicago returned an indictment charging Alexander Sisemore, 28, of Fayetteville, Arkansas, with three counts of wire fraud, each punishable by up to 20 years in prison. The US Attorney’s Office for the Northern District of Illinois announced the case the next day and itself called the alleged scheme a “rug pull”. Kishu Inu launched in 2021 and later passed $1.6 billion in market capitalisation, the office said.
According to the release, the indictment alleges that Sisemore and others secretly allocated themselves a large quantity of tokens when the asset was created, then sold them while making false statements to investors on Telegram, Twitter, Facebook and Reddit, for personal profits of about $9 million. The details, as summarised by Bitcoin.com News, go further: 6% of the supply allegedly went to four wallets controlled by Sisemore and another 6% to a co-founder before public sales, while the May 2021 white paper spoke of no team tokens and developers claimed to hold 1.7%, bought on the market; the sales ran from April 2021 to at least October 2023, through multiple wallets and mixers. These are accusations, not findings. As the prosecutors’ release itself reminds readers, an indictment is not evidence of guilt and Sisemore is presumed innocent. The FBI’s Chicago field office has asked Kishu Inu investors to come forward.
Memecoin launches since 2024: HAWK and LIBRA
The memecoin boom on Solana produced collapses whose status remains disputed. HAWK, the token promoted by internet personality Haliey Welch, imploded at its launch in early December 2024. On 19 December 2024, twelve buyers sued the platform and people behind it in the US, alleging violations of securities laws, Decrypt reported. Welch was not named as a defendant at that stage, and her spokesperson said she had been “totally siloed” from the project and received a fixed fee. No court has found that HAWK was a rug pull.
LIBRA went further, because a head of state was involved. On 14 February 2025, Argentine President Javier Milei promoted the Solana token on X. Its market value reached about $4.5 billion before falling by nearly 90% within hours, according to Decrypt figures cited in our coverage. Milei deleted the post and said he acted in good faith; Hayden Davis, who described himself as the launch adviser, acknowledged holding close to $100 million after the crash and denies wrongdoing, Al Jazeera reported.
Neither court has ruled on whether buyers were defrauded. In New York, Judge Jennifer Rochon dismissed the investors’ class action with prejudice on 29 September 2026, on grounds of racketeering law, intent and jurisdiction rather than the facts. In Buenos Aires, federal judge Marcelo Martínez De Giorgi closed the criminal case against Milei, his sister Karina and nine others, including Davis, on 23 October 2026, at the prosecutor’s request, finding that the facts fit no criminal offence. Investors’ appeals to Argentina’s Cámara de Casación were still pending, our report on the dismissal notes. LIBRA is therefore an insider-heavy launch with large insider profits, not a rug pull proven in court.
The dates and figures in one table
| Case | Date | Figure | Outcome as of October 2026 |
|---|---|---|---|
| SQUID token | 1 Nov 2021 | Peak $2,861.80, then zero | No charge reported in the sources we checked |
| AnubisDAO | 28-29 Oct 2021 | About $60 million in ether | Suspected rug pull or phishing; no one charged that we found |
| Frosties NFTs | Jan 2022 | About $1.1 million | Two men charged in March 2022; no plea or sentence found |
| Mutant Ape Planet | Plea Nov 2023 | Almost $3 million | Guilty plea to wire fraud; $1.4 million forfeiture agreed |
| HAWK | Dec 2024 | Collapse at launch | Civil suit by 12 buyers; allegations only |
| LIBRA | 14 Feb 2025 | About $4.5 billion peak value | US class action dismissed 29 Sep 2026; Argentine case closed 23 Oct 2026, appeals pending |
| Kishu Inu | Indicted 6 Oct 2026 | About $9 million alleged | Charged with wire fraud; presumed innocent |
Mango Markets: an exploit, not a rug pull
Mango Markets is often listed among rug pulls, and it does not belong there. In October 2022, Avraham Eisenberg manipulated the price of the collateral on the Solana lending protocol and borrowed against it, draining the treasury. There was no team exit and no hidden withdrawal: an outside trader used the protocol’s own rules. A jury convicted him in 2024, but on 23 May 2025 Judge Arun Subramanian overturned the verdict: he acquitted Eisenberg of wire fraud, finding no proof of a misrepresentation on a platform with no rules against that kind of borrowing, and vacated the two other counts because New York was the wrong venue, The Block reported. We found no report of a government appeal as of October 2026. The case is about market manipulation and the limits of fraud law, not about founders running away.
How common are rug pulls on memecoin launchpads?
Nobody counts rug pulls with a single agreed method, so every figure depends on its author’s definition. Solidus Labs, a market surveillance company, published a “2025 Rug Pull Report”, summarised on 8 May 2025 by ForkLog. Its numbers are indicators of fraud patterns, not court findings, but they show what a newcomer faces on launchpads such as Pump.fun.
| Indicator (Solidus Labs, reported 8 May 2025) | Figure |
|---|---|
| Pump.fun tokens launched by January 2025 | More than 7 million |
| Of those, tokens that kept at least $1,000 of liquidity | About 97,000 |
| Pump.fun memecoins associated with fraudulent schemes | About 98% |
| Raydium liquidity pools showing rug pull characteristics | 93% of 388,000 |
| Average loss per victim on Raydium | $2,832 |
| Largest single loss recorded | $1.9 million |
On a launchpad where creating a token costs a few dollars, the base rate of abandoned or manipulated tokens is overwhelming, and a token surviving its first week is the exception. That does not make every memecoin a rug pull. It means the burden of proof sits with the token, not with your suspicion.
Warning signs of a rug pull before you buy
No single sign proves a scam, and several have innocent explanations. Bitcoin itself was launched by an anonymous creator. What matters is how many signs stack up and whether the team gives you a way to check its claims. These are the ones that recur in the cases above.
- The team is anonymous and unreachable, and nobody with a public reputation stands behind the project, so there is nobody to hold to account if the money vanishes.
- The liquidity is not locked, or is locked for a few days only, or the pool is tiny compared with the market value displayed on the token page.
- The contract source code is not verified on the block explorer, so nobody outside the team can read what it does.
- A few wallets hold most of the supply, or many “different” holders were funded from the same address minutes apart.
- The contract has an owner who can mint, blacklist, pause transfers, change the sell tax or upgrade the code, with no timelock or multisig.
- The marketing promises guaranteed returns, uses a celebrity or a politician as the main argument, or pushes you to buy “before the listing”.
- The website and white paper are copied from another project, or the roadmap is a list of buzzwords without dates.
- You cannot find a test sell by anyone outside the team, or small holders complain that their sells fail.
The allocation table deserves a slow read: who gets what share of the supply, when team tokens can be sold, and whether any of it is locked in a contract you can check. Our guide to how DeFi works covers the exchanges and pools these launches rely on.
Rug pull checkers and what each tool cannot see
A family of free tools reads a token’s contract and on-chain data for you. They catch a lot of crude traps in seconds. None of them can tell you that a token is safe. Honeypot.is, one of the best known, says so on its home page: “This is not a foolproof method. Just because it’s not a honeypot now, does not mean it won’t change!”
The table sums up what each type of check covers. Feature lists change often, so treat it as a description of the kind of check, not a promise about any one product.
| Tool or check | What it looks at | What it cannot tell you |
|---|---|---|
| Block explorer (Etherscan, BscScan) | Whether the published source code matches the deployed contract; holders; transactions | Whether that code is honest or safe to use |
| Honeypot.is | Simulates a buy and a sell on Ethereum, BNB Smart Chain and Base | Whether the owner will change the rules after the test |
| Token Sniffer, GoPlus, De.Fi Scanner | Automated scans for risky contract functions (minting, ownership, proxies, taxes) | Hidden team allocations, off-chain lies, new tricks the scan does not know |
| RugCheck (Solana) | Risk scan of Solana tokens: mint and freeze authorities, liquidity, top holders | Whether an insider will dump tokens already in their wallets |
| Bubblemaps | Visual map of the largest holders and the links between their wallets | Who the people behind the wallets are, or what they intend |
| Liquidity lockers (UNCX, Team Finance) | Whether LP tokens are locked, and until when | Anything after the unlock date, or the safety of the locker itself |
Lockers need a word of caution. The UNCX documentation states: “Once the LP tokens are locked, they can’t be withdrawn/moved until the unlock date passes” (UNCX docs). That protects the pool until a date, nothing more, and it does nothing against a mint function or a team dumping its own tokens. The locker can also fail: on 27 October 2022 an attacker used about $2,700 of ether to drain $15.8 million from Team Finance through a flaw in its audited migration function, The Block reported.
Verification has its own limit. Etherscan’s page on contract verification describes it as a way for developers to publish source code that matches what runs on chain, so anyone can read it. It says nothing about whether that code is fair. A verified honeypot is still a honeypot.
A routine that takes ten minutes catches most crude traps. It is a safety check, not a recommendation to buy anything.
- Copy the contract address from the project’s official channel, never from a reply or a direct message, and open it on the chain’s block explorer.
- Check that the source code is verified, then look for an owner address and functions such as mint, blacklist, setFee, pause or upgradeTo.
- Run the address through a honeypot simulator and one contract scanner, and read every warning rather than the overall score.
- Open the liquidity pool: how much is in it, who holds the LP tokens, whether they are locked and until which date.
- Look at the holder list and a holder map, and note any cluster of wallets funded from the same source.
- Search the team’s names and the project’s history, and ask who is promoting the token and whether they are paid.
- If you still go ahead, buy a small amount and try a small sell before adding more, knowing the rules can change afterwards.
The wallet side matters too. Connecting to a fake token site can expose your funds to a malicious approval; keep your recovery words offline as explained in our seed phrase security guide.
Is rug pulling illegal? US, UK and EU rules
There is no offence called “rug pull” in US, British, French or Italian law. Prosecutors reach for general offences, mostly fraud and money laundering, and the fraud nearly always rests on something the insiders said. That is why the line between a crime and a failed project usually runs through what the team told buyers.
United States: wire fraud does the work
Every US case above was charged as wire fraud, sometimes with money laundering conspiracy, whatever the asset: NFTs for Frosties and Mutant Ape Planet, a memecoin for Kishu Inu. Securities law is not needed. On 27 February 2025 the SEC’s Division of Corporation Finance published a staff statement on meme coins concluding that typical meme coins are not securities, so their buyers lack securities-law protection. The same statement warns that “fraudulent conduct related to the offer and sale of meme coins may be subject to enforcement action” by other federal or state agencies. It is a staff view, not a rule with legal force.
Victims in the US can report to the FBI’s Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov. When the FBI opens a case, it sometimes publishes a victim form, as it did for Kishu Inu investors.
United Kingdom: promotion rules and Report Fraud
Since 8 October 2023, any firm marketing cryptoassets to UK consumers, including firms based abroad, must use one of the routes allowed by the FCA’s financial promotion rules; promoting outside them breaches section 21 of the Financial Services and Markets Act, a criminal offence punishable by up to two years in prison. The rules target promoters rather than rug pulls as such, but they reach paid influencers who push a token. Fraud itself falls under the Fraud Act 2006. Reports go to Report Fraud, the City of London Police service that replaced Action Fraud for England, Wales and Northern Ireland on 4 December 2025 (phone 0300 123 2040); in Scotland, Police Scotland on 101.
European Union: MiCA, France and Italy
The EU’s Markets in Crypto-Assets regulation (MiCA) has applied in full since 30 December 2024. Anyone offering a new crypto-asset to the public in the EU must draw up a white paper and notify it to the national authority, and MiCA also bans insider dealing and market manipulation in crypto-assets. ESMA keeps a register of white papers and of non-compliant entities, and stresses that the listed white papers have not been reviewed or approved by any authority. A white paper is a disclosure duty, not a quality label; a rug pull can come with one. Our guide to MiCA explains the whole framework.
National regulators have started to use those powers on memecoins. On 6 March 2025 Italy’s Consob ordered an end to the offer of the memecoin $Corona, promoted through a site linked to the entrepreneur Fabrizio Corona, because no white paper had been notified, LaPresse reported. That was a ruling on a missing document, not a finding of a rug pull. In criminal law, a rug pull resting on lies would fall under escroquerie in France (articles 313-1 and following of the Penal Code: up to five years in prison and a €375,000 fine for the basic offence, according to Service-Public.fr) and under truffa in Italy (article 640 of the Penal Code: six months to three years and a fine in the basic case, more with aggravating circumstances).
One limit applies everywhere. A launch run by anonymous people from unknown places, through a permissionless pool, may have no identifiable offeror for a regulator to supervise. Rules bite after the fact, when investigators manage to put names on wallets, which can take years, as Kishu Inu shows.
What to do if you have been rugged
The money is usually gone, and the honest answer is that victims rarely get it back. A few steps still help, for an investigation and for your taxes.
- Save everything now: the contract address, your transaction hashes, screenshots of the website, the social accounts and the promises made, before they are deleted.
- Report to the police service of your country (IC3 in the US, Report Fraud in the UK) and to the platform where you bought, if it was a centralised exchange.
- Revoke any token approvals you gave to the project’s contracts, using your wallet or the block explorer’s approval checker.
- Ignore every “recovery service” that contacts you or advertises it can trace and return your funds for a fee: that is the second scam aimed at rug pull victims.
Losses can also matter for your tax return, depending on where you live; our guide to crypto tax basics explains the general rules. The next lesson in this path turns to pump and dump schemes, the market manipulation that often runs alongside a soft rug pull.
