The phrase comes from an old expression: pulling the rug out from under someone. One moment you're standing on solid ground. The next, the floor is gone. In crypto, the floor is liquidity — and when a team pulls it, your investment doesn't fall slowly. It crashes to near zero in seconds, often before you can see what's happening.
In 2025, approximately 37% of all new token launches were rug pulls. Understanding exactly how they work — and how to detect them before they happen — is the most important defensive skill for any crypto presale investor.
What Is a Rug Pull?
A rug pull is a deliberate exit fraud where a crypto project's own team drains investor funds — typically by removing DEX liquidity, triggering a malicious smart contract function, or systematically dumping their token allocation — then abandons the project. Unlike a random hack, a rug pull is an inside job.
Rug pulls can happen at multiple stages: during the presale (team takes raised funds before the token even launches), at listing (team removes DEX liquidity on day one), or gradually post-launch (team sells their allocation while maintaining the illusion of an active project).
The 3 Types of Rug Pulls
Type 1: Liquidity Rug Pull (Hard Rug)
The most dramatic form. After token launch, the team creates a DEX liquidity pool by depositing equal values of their token and ETH/BNB/USDC. This makes the token tradeable. The team holds LP tokens representing ownership of the pool. If these LP tokens are not locked in a time-lock contract, one transaction removes all liquidity instantly.
What investors see: the token price drops from $1.00 to $0.000001 in the same block. There is nothing left in the pool to trade against. It is instantaneous, irreversible, and total. No warning before it happens.
Prevention: Before buying any new DEX-listed token, verify that LP tokens are locked on Team.Finance (team.finance) or UNCX (uncx.network). Check the lock duration — a 3-month lock provides minimal protection; 1–2 years is meaningful. Check the lock percentage — 50% locked still means 50% can be removed.
Type 2: Malicious Smart Contract (Code Rug)
The contract contains hidden functions enabling the team to steal funds without removing liquidity. Common variants:
- Unlimited mint function: Team creates billions of new tokens at any time, floods supply, sells into the market, crashes price to zero.
- Honeypot function: Contract allows buying but blocks all selling for regular wallets. Only the deployer address can sell. Investors can buy endlessly but can never exit.
- Blacklist/whitelist restriction: Contract can freeze specific wallets from transacting. Team blacklists all investor wallets while selling their own holdings unimpeded.
- Hidden admin upgrade: Contract has an undisclosed upgradeability feature allowing the team to swap the contract logic to a malicious version after attracting investment.
Prevention: Scan every new token contract on Token Sniffer (tokensniffer.com) and test on Honeypot.is before buying any amount. Verify the contract was audited by a reputable firm — check that the audit was done on the exact contract address being used for the presale. See our complete smart contract audit verification guide.
Type 3: Soft Rug Pull (Slow Drain)
The most insidious form. The team builds something real-looking, launches the token, attracts a genuine community, and then systematically sells their own allocation over weeks or months. They maintain an active Discord and Twitter, continue making roadmap announcements, and keep the project appearing alive — while consistently moving large quantities of tokens from team wallets to CEX deposit addresses.
Eventually activity quietly stops. The Discord goes inactive. The roadmap updates become sparse. Token price has bled from $1.00 to $0.04 over six months. The team is long gone with their profits. No single event to point to, no obvious crime — just a slow-motion exit.
Prevention: Monitor known team wallet addresses on Etherscan/BSCScan. Set price alerts. Check GitHub commit frequency as a development activity proxy. Scrutinise vesting schedules — if team tokens unlock monthly with no lock-up at all, soft rug is trivially easy from day one.
Two Famous Rug Pull Examples
Squid Game Token — October 2021 ($3.4M in Minutes)
SQUID launched capitalising on the Netflix series' viral cultural moment. Price rose from $0.01 to $2,856 in five days — a 28,600,000% increase fuelled entirely by FOMO and narrative momentum, not any fundamental value. Then on November 1, 2021, the team removed DEX liquidity. SQUID fell to $0.0007 within minutes. The critical warning sign that was universally ignored: buyers could purchase SQUID but could not sell it. The token was a honeypot from the beginning. Anyone who had scanned the contract on any basic tool would have seen this immediately.
AnubisDAO — October 2021 ($60M in 20 Hours)
AnubisDAO presented as a "community-owned reserve currency" riding the OlympusDAO (OHM) fork wave. In a single day it raised $60 million in ETH from thousands of DeFi investors. Less than 20 hours after the raise, all $60 million was transferred to a single unknown wallet and every social media account went dark simultaneously. No refund. No explanation. The team was never identified. The speed — 20 hours from raise to exit — makes AnubisDAO one of the most brazen rug pulls in crypto history.
Complete Rug Pull Prevention Checklist
- LP tokens locked for 12+ months on Team.Finance or UNCX — verified independently
- Contract scanned clean on Token Sniffer — no mint, blacklist, or honeypot functions
- Honeypot.is confirms the token can actually be sold
- Smart contract audit from a named reputable firm — verified on auditor's official website
- Team members are named and have verifiable prior work history (doxxed)
- Team token vesting schedule locks at least 12 months post-listing
- Bought a tiny test amount and successfully sold before committing significant capital
For how to identify phishing sites impersonating legitimate presales (fake Telegram links, cloned websites), see our presale phishing and scam guide. If you have been victimised, our crypto presale legal guide covers reporting options and recovery steps by country.
Glossary
- Rug Pull
- A deliberate inside exit fraud where crypto project founders drain investor funds via LP removal, malicious contract functions, or systematic token dumping, then abandon the project.
- LP Token
- A token received by liquidity providers representing their share of a DEX liquidity pool. Locking LP tokens in a time-lock contract prevents the team from removing pool liquidity.
- Honeypot Token
- A scam token contract allowing everyone to buy but blocking regular investors from selling. Only the deployer or whitelisted addresses can exit.
- Mint Function
- A smart contract function that creates new tokens. An unlimited or unguarded mint function allows the team to infinitely dilute supply, crashing the price.
- Token Sniffer
- A free tool at tokensniffer.com that automatically scans smart contract code for common malicious patterns including honeypots, unlimited minting functions, and blacklist mechanisms.
Disclaimer
Important: If you believe you are a victim of a rug pull, report immediately to FBI IC3 (US), Action Fraud (UK), or your national cybercrime authority. Document all transaction hashes. Never pay a recovery service — they are virtually always secondary scams. This article is educational only. CryptoPresaleNews.com is not a licensed financial advisor.
