Home › Knowledge Hub › Rug pulls and exit scams
Rug pulls and DeFi exit scams, explained
A rug pull is an exit scam built into a crypto token: the people who created it drain its value and vanish, leaving holders with something that cannot be sold. It is not a hack and not bad luck. It is the plan. The money is almost never recoverable once it happens, so the real defence is spotting the warning signs before you buy. This guide explains how the common types work and what actually signals danger.
A rug pull is an exit scam wearing the costume of a real project. The team builds hype, collects money, and then removes the value and disappears. The word comes from pulling the rug out from under the people holding the token.
The main types
Liquidity rug. New tokens trade against a pool of real cryptocurrency that lets people buy and sell. In a liquidity rug, the team removes that pool. The moment it is gone, the token still exists in your wallet but there is nothing to sell it against, so its price collapses to near zero and you cannot exit.
Honeypot or sell-block. Here the token is written so that buying works but selling does not, for everyone except the creators. The chart looks like it only ever goes up, because no ordinary holder can sell. People keep buying, the team cashes out, and holders are trapped.
Slow rug. Instead of one dramatic exit, the team bleeds the project over weeks: quietly selling their own large holding, abandoning the promised product, and letting the price drift down while posting just enough updates to keep hope alive. It is less obvious than a liquidity pull and often argued about afterwards, but the result is the same.
Why the money rarely comes back
A rug pull usually is not illegal access to someone else's system; it is the people in control using that control. The funds move to wallets the team holds, often get mixed, and cross exchanges quickly. There is no central company to claw it back and no transaction to reverse. This is why prevention matters so much more than response here: once the pool is pulled or the sells are blocked, the loss is almost always permanent.
Warning signs before you buy
- Anonymous team with no real track record. Not disqualifying on its own, but it removes accountability, and it stacks with every other flag.
- Concentrated holdings. A small number of wallets, often the team's, holding most of the supply. They can crash the price by selling, or they are the only ones who can.
- Liquidity that is not locked. If the trading pool can be withdrawn at any time by the team, a liquidity rug is one click away.
- Guaranteed or absurd returns. Promises of fixed high yield, "guaranteed" gains, or doubling in days. No real asset guarantees returns.
- Manufactured urgency. A countdown, a "presale ending", a fear of missing out engineered to stop you checking.
- Hype far ahead of product. Heavy marketing, paid influencers, and a vague or copied whitepaper, with nothing actually built.
- You cannot test a sale. On a token that blocks selling, even a tiny test sale fails. If something feels off, that test is worth doing before you commit more.
Our guide on how to verify a crypto project turns these into a checklist you can run before putting money in.
The influencer and celebrity version
Many of the largest rug pulls ride on a famous name or a paid promoter who posts a token, draws a crowd, and goes quiet when it collapses. The endorsement is the marketing, not evidence the token is sound. We cover this pattern in celebrity and memecoin rug pulls.
If you have already been rugged
Stop adding. Do not buy the dip on a token whose team has pulled it, and do not pay anyone who promises to "unfreeze" or "relaunch" it.
Preserve the evidence. The token's contract address, the trading pair, your purchase transactions, the wallet you used, screenshots of the project's site and social accounts, and the names of any promoters. Our evidence checklist covers what matters.
Report it. In the US, file at ic3.gov; regulators including the SEC and CFTC also take reports on investment fraud. Reporting rarely returns funds but builds the record that investigations use.
Expect a recovery scam. Holders of a collapsed token are a prime target for fake recovery and "relaunch" offers. Any upfront fee is the tell.
Red flags
- The team's trading pool (liquidity) is unlocked or already removed
- Most of the token supply sits in a few wallets you cannot identify
- Selling fails or is blocked while buying works
- Guaranteed returns, countdowns, and heavy influencer promotion
- A whitepaper that is vague, copied, or promises with nothing built
- Anonymous founders and no verifiable track record
What this guide cannot do
It cannot recover money lost in a rug pull, which is almost always gone for good, and it cannot tell you a specific token is safe. What it can do is show you the structural warning signs that appear before the price does, so the decision you still control, whether to buy at all, is an informed one.
This is general information, not financial advice. Do your own research and never invest more than you can afford to lose.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
U.S. Securities and Exchange Commission, Investor Alerts and Bulletins. https://www.sec.gov/investor/alerts, guidance on fraud warning signs in crypto and digital-asset investments, including guaranteed returns and pressure tactics.
Commodity Futures Trading Commission, Customer Advisories. https://www.cftc.gov/LearnAndProtect/AdvisoriesAndArticles, advisories on digital-asset and commodity fraud.
Federal Trade Commission, What To Know About Cryptocurrency and Scams. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams, on guaranteed-return promises and crypto investment fraud.
The categories here (liquidity rug, honeypot, slow rug) describe commonly reported patterns; the warning signs are structural and drawn from the official guidance above. Reviewed quarterly.
Frequently asked questions
What exactly is a rug pull?
It is an exit scam built into a crypto token. The team behind it drains the token's value, by removing the trading liquidity, blocking sales, or quietly selling their own large holding, and disappears, leaving holders unable to sell. It is planned, not accidental.
Is a rug pull a hack?
Usually no. A hack is someone breaking in from outside. A rug pull is the people in control using that control to take the money. That difference is why there is no company to reverse it and why the funds rarely come back.
How can I spot a rug pull before buying?
Look at structure, not price. Unlocked liquidity, most of the supply held by a few anonymous wallets, selling that does not work, guaranteed returns, and heavy hype with no product are the main tells. Our verification guide turns these into a checklist.
The token only goes up and never down. Isn't that good?
It can be a honeypot, a token written so only the creators can sell. A chart that only rises can mean ordinary holders are blocked from selling, not that the project is strong. A tiny test sale that fails is a serious warning.
Can I get my money back after a rug pull?
Almost never. The funds move to the team's wallets, are often mixed, and cross exchanges quickly, with no central party to claw them back. Prevention is the real defence; after the fact, focus on evidence and reporting.
Someone offered to help me recover or relaunch the token for a fee. Is that legitimate?
No. Holders of collapsed tokens are heavily targeted by recovery and relaunch scams. An upfront fee is the signature of a second scam. Do not pay, and report the original loss through official channels.
Where do I report a rug pull?
In the US, file at ic3.gov, and you can also report investment fraud to the SEC and CFTC. Keep the contract address, your transactions, and screenshots of the project. Reporting rarely recovers funds but supports investigations.
Lost money to a token that collapsed?
Eleven questions that show which documentation and reporting steps still apply.
Check my case