A rug pull is a crypto scam where project insiders abandon a token and cash out its value, usually by yanking liquidity, minting and dumping their own holdings, or disabling sells. Everyone else is left with worthless or unsellable coins, which makes it one of the most common DeFi frauds and a close cousin of the exit scam.
What is a rug pull, in plain English?
A rug pull is when the people who created a crypto project pull the value out and walk away, leaving investors holding tokens they cannot sell or that are suddenly worthless. The name captures the feeling: the rug is yanked out from under everyone who bought in. It is especially common in DeFi, where anyone can launch a token and set up a trading pool with little friction and no gatekeeper.
The mechanics vary but share a theme: insiders retain control over something critical and use it to extract value. They might remove the liquidity that lets people trade the token for real money, mint and dump a huge pile of their own holdings onto the market, or write the contract so that only they can sell while disabling sells for everyone else. In each case the project's apparent value collapses into the founders' pockets.
Rug pulls overlap heavily with exit scams. The distinction is loose: exit scam is the broader idea of operators taking the money and vanishing, while rug pull is the DeFi-flavored version centered on a token and its liquidity or contract. The real story is always in the token distribution and the code, not the marketing.
Common rug pull methods
The same outcome is reached through a few recurring techniques:
Method | How it works |
Liquidity removal | Insiders pull the funds backing the trading pool, so holders can no longer sell for real value. |
Mint and dump | Founders mint or hold a large share of supply, then sell it all at once, crashing the price. |
Disabled sells | The contract is coded so ordinary holders cannot sell, while insiders can, trapping everyone else. |
Hidden functions | Malicious contract code lets insiders drain funds or change rules after people have bought in. |
Who is involved?
Who | Their role |
The insiders | Founders or team who control the supply, liquidity, or contract and extract the value. |
The promoters | Hype-drivers, sometimes paid, who build demand before the pull, occasionally unaware of the plan. |
The investors | Buyers left holding worthless or unsellable tokens once the value is drained. |
Investigators | Trace the extracted funds from the liquidity pool or dump toward cash-out venues. |
What it looks like in practice
In practice
A new token launches with heavy social-media hype, an anonymous team, and promises of huge returns. Buyers pour in, the price climbs, and a trading pool fills with real funds. On the surface it looks like a hot new project.
Under the surface, the insiders hold most of the supply and the pool's liquidity is not locked. One day, without warning, they withdraw the liquidity and dump their holdings in the same window. The price collapses to near zero and holders find they cannot sell. An analyst traces the extracted funds from the drained pool through a bridge and a mixer toward an exchange, flags the attacker addresses, and alerts the off-ramp so the cash-out can be caught.
Why it matters to operators
Rug pulls are a high-volume DeFi fraud precisely because launching a token is cheap and permissionless. For a compliance team at an exchange or on-ramp, the risk shows up when victims' losses and the insiders' proceeds both try to move through your platform. Recognizing the pattern lets you flag the attacker addresses, support victims, and avoid unknowingly helping the operators cash out.
The core lesson is that trust should follow the code and the token distribution, not the hype. The warning signs, insiders holding a big share, unlocked or removable liquidity, unaudited or malicious contract functions, and anonymous teams, are all visible before the pull if you look. Response then focuses on tracing the extracted funds to their cash-out venues, since the on-chain trail is where the case gets built.
What to watch for
- Concentrated supply. Insiders holding a large share of the tokens can crash the price the moment they sell.
- Removable liquidity. Pool liquidity that is unlocked or can be withdrawn by insiders is a setup for a classic pull.
- Suspicious contract code. Unaudited contracts, disabled sells, or hidden functions that let insiders drain or change the rules.
- Anonymous teams and hype. Heavy marketing with an unknown team and guaranteed-return promises should raise suspicion, not comfort.
- Trace the extraction. After a pull, follow the drained funds from the pool or dump toward exchanges and off-ramps to flag and interdict.
Quick questions
How is a rug pull different from an exit scam?
They overlap. An exit scam is the broad idea of operators taking the money and disappearing. A rug pull is the DeFi version centered on a token and its liquidity or contract. Most rug pulls are a kind of exit scam.
What does pulling liquidity mean?
Trading a token relies on a pool of funds backing it. When insiders withdraw that liquidity, holders can no longer sell the token for real value, so it effectively becomes worthless even if it still shows a price.
Can you spot a rug pull before it happens?
Often the warning signs are visible: concentrated insider holdings, unlocked liquidity, unaudited or malicious contract code, and anonymous teams. The code and token distribution tell the real story behind the marketing.
What is a hard rug versus a soft rug?
A hard rug uses code or actions to steal funds outright, like draining liquidity or disabling sells. A soft rug is a slower abandonment where insiders dump holdings and walk away. Both leave holders with losses.
What can be done after a rug pull?
Response focuses on tracing the extracted funds toward cash-out venues, flagging the attacker addresses, and alerting exchanges so the proceeds can be caught. Recovery is hard, so prevention and fast tracing matter most.
Why is DeFi especially exposed?
Anyone can launch a token and a trading pool with little friction and no gatekeeper, so bad actors can spin up convincing projects cheaply and repeatedly, which is why rug pulls are so common there.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.