To get into DeFi, you first need to fund an account on a centralized exchange. You can complete account setup and KYC through the Binance Official Site or the Official Binance App, and if you're on an Apple device that can't install directly, check the iOS Install Guide. There are 4 core warning signs of a DeFi rug pull: first, contract ownership hasn't been renounced, and admins can mint unlimited tokens or withdraw funds at will; second, token holdings are extremely concentrated in a handful of addresses; third, the liquidity pool isn't locked, or is locked for only a short period; fourth, the team is completely anonymous with no verifiable track record of work. Per Chainalysis's 2025 report, rug pulls caused roughly $1.1 billion in losses across all of 2024, up 35% from 2023, concentrated mainly in memecoins on Solana and Base.
"Rug pull" is a catch-all term for a project team running off with funds and leaving holders with nothing. Broken down by method, there are a few variants:
Hard rug: the team uses a backdoor in the contract to drain the liquidity pool directly, or mints unlimited tokens and dumps them. Victims' tokens go to zero instantly, with no way to recover anything.
Soft rug: the team gradually sells off the tokens they hold, causing the price to slowly grind down toward zero. On the surface there's no obvious "running off with funds," but the effect is the same.
Exit scam: the team suddenly shuts down operations citing reasons like "the team is disbanding" or "compliance issues," takes down the website and community channels, and never returns the funds.
Slow-motion rug: the team keeps pushing back on its promises ("the roadmap item is coming next quarter"), keeping the price propped up with vague future plans, and then quietly exits.
Per Solidus Labs's 2025 data, roughly 22% of token contracts deployed across all EVM chains in 2024 were flagged as "containing rug pull characteristics," but only about 3% actually carried out a rug pull (the rest either never gained liquidity, or were caught early and never launched).
The smart contract is the soul of a DeFi project, but hidden "admin functions" in the code are a common rug pull weapon.
An unlimited mint() function: the contract admin can mint unlimited tokens. If a project's mint function has no access control, or lets the owner call it freely, the team can mint billions of tokens and dump them during a rug pull.
// Dangerous pattern
function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount); // No supply cap
}
A setTax() function with a high tax rate: a tax function that lets the owner change the buy/sell tax up to 99%, effectively closing the sell window during a rug pull. Early BSC memecoins widely used this kind of "honeypot" contract.
emergencyWithdraw(): lets the admin "emergency" withdraw all the funds in a pool. This kind of function is extremely dangerous in an LP protocol.
pause() with no unpause(): the contract can pause all trading but can never resume it, which effectively locks users' funds forever.
Upgradeable proxy contracts: an upgradeable contract (the proxy pattern) lets the admin swap out the logic contract. Even if the original contract passed an audit, it can turn into an entirely malicious new contract after an upgrade.
Step one: look up the contract on Etherscan/Solscan. Click the "Read Contract" and "Write Contract" tabs to see every public function it exposes.
Step two: search for key terms. In the contract source code, search for "owner," "admin," "mint," "pause," "emergencyWithdraw," "setFee," and "upgrade."
Step three: check the owner address. Is the owner address an ordinary wallet, or a multisig? Is it 0x000...dEaD (ownership renounced), or an active EOA? A multisig combined with partially renounced ownership is relatively safer.
Step four: use automated scanning tools. Tools like Token Sniffer, Honeypot.is, and GoPlus Security can automatically scan a contract for dangerous functions.
How a token's supply is distributed is the most direct indicator of "whether it's at risk of being dumped."
Check the Holders tab on a block explorer like Etherscan:
| Metric | Safe | Moderate | Dangerous |
|---|---|---|---|
| Top 1 holder share | < 5% | 5%-15% | > 15% |
| Top 10 holder share | < 30% | 30%-60% | > 60% |
| Top 100 holder share | < 60% | 60%-85% | > 85% |
| Number of holder addresses | > 5,000 | 1,000-5,000 | < 1,000 |
If the top 10 addresses hold more than 80% of the token supply, the team or early investors can dump on the market at any time.
Exclude LP pool addresses: DEX pool contracts on Uniswap, PancakeSwap, and similar platforms hold large amounts of tokens, but that's not "individual holding" and should be excluded from the analysis.
Exclude multisigs and treasuries: project treasuries and DAO multisig addresses show up in the top holders list, but they're collectively managed and carry lower rug pull risk.
Identify staking contracts: staking contracts hold tokens users have staked, and should also be excluded.
In practice, tools like Bubblemaps and Arkham can help identify the real entities behind addresses, so you can see the true concentration of "genuine individual holdings."
A DEX liquidity pool (LP) is the foundation for trading a new token. Whether the LP is locked is a key indicator of rug pull risk.
Unlocked: the team can withdraw liquidity at any time. Extremely high rug pull risk — most rug pulls start here.
Partially locked: 50-90% of the LP is locked, with the rest withdrawable. Moderate risk.
Fully locked: 100% of the LP locked for 6 months or more. Relatively safe, but it can still be withdrawn once the lock expires.
Permanently burned: the LP token is sent to the 0x000...dEaD address, making it unrecoverable forever. The safest option.
Team Finance / Unicrypt: mainstream LP-locking services that provide a link as proof of the lock. A project should make this link public.
On-chain lookup: once you find the LP token's contract address on a DEX, check its "Holders" tab. If the top holder is the contract address of a locking service like Unicrypt, TrustSwap, or PinkSale, and the lock period is long, that's relatively safe.
On Solana: LP-locking services on Solana include Streamflow and Mercurial. A Pump.fun token that "graduates" automatically migrates to Raydium and burns its LP — this is Solana memecoins' built-in safety mechanism.
There are historically a few ways teams have found to work around an LP lock:
Information about the team is central to judging "whether the people behind a project actually feel accountable for it."
Fully public plus KYC: team members' real names, LinkedIn profiles, and work history are all verifiable, and they've gone through KYC (like Certik's KYC badge). The highest level of trust. Representative projects: Aave, Curve, MakerDAO.
Public but pseudonymous: the team operates under consistent online handles, with a long, stable identity the community recognizes. Moderate trust. Representative projects: Pendle, GMX, Yearn (in the Andre Cronje era).
Fully anonymous: the team is completely hidden, with no verifiable identity information at all. A high-risk signal.
Fabricated identities: using AI-generated fake avatars, fabricated LinkedIn profiles, or stolen work histories. The most dangerous signal of all.
Open source on GitHub: code published openly on GitHub, with an active commit history and multiple independent contributors. This is the most direct evidence of real work being done.
Audit reports: reports from top-tier auditing firms like Trail of Bits, ChainSecurity, OpenZeppelin, or Quantstamp. These firms won't take on a project without real code or with a fully anonymous team. Be sure to distinguish top-tier auditors from small "audit-for-hire" firms.
Community engagement: does the team post regular updates on Discord, Telegram, and Twitter? Do they respond to technical questions competently? Rug-pull projects often mass-delete community messages or shut down their channels in the final week.
Third-party coverage: coverage from outlets like The Block, CoinDesk, or Bankless reflects a project's real visibility. Backing from well-known VCs (a16z, Paradigm, Polychain) is also a positive signal.
22-year-old internet personality Haliey Welch launched the $HAWK memecoin, which spiked to a $490 million market cap within 30 minutes of launch, then crashed 95%. On-chain data showed over 80% of the supply concentrated in a handful of addresses, and the team sold off quickly. This is a textbook case of "celebrity/KOL-driven hype plus concentrated supply plus team dumping."
Iron Finance was an algorithmic stablecoin and LP protocol on Polygon, even backed at one point by Mark Cuban. Due to flaws in its algorithmic design combined with speculative selling, its TITAN token collapsed from $60 to near zero, and $2 billion in TVL evaporated within 24 hours. This was a collapse driven by a flawed economic model rather than an intentional rug pull by the team, but the outcome was the same.
Launched riding on the name of a popular show, this token used a buy-only contract that blocked selling (a honeypot). After pumping from $0.01 to $2,860, the team withdrew $3.3 million in LP from the pool and disappeared. A textbook case of "a honeypot contract plus an LP drain."
The hottest early memecoin on Base. The team claimed to be anonymous, but on-chain sleuths traced a connection to Alameda Research. The token hit an $85 million market cap within 24 hours of launch, and the team withdrew roughly $7 million in LP and disappeared.
A Solana memecoin launched on the Pump.fun platform, which doesn't carry the traditional rug pull risk since its LP is auto-burned. But within 6 hours of launch, a single whale address (suspected to be tied to the team) dumped 95% of its holdings, and the price went to zero. A case of a "soft rug within Pump.fun's safety mechanism."
You can combine the 4 dimensions into a simplified scoring model:
| Dimension | Dangerous (1) | Moderate (2) | Safe (3) |
|---|---|---|---|
| Contract permissions | Not renounced, includes mint/pause | Partially renounced | Fully renounced plus multisig |
| Top 10 concentration | > 60% | 30-60% | < 30% |
| LP lock | Unlocked | Locked < 6 months | Locked > 1 year or burned |
| Team | Fully anonymous | Partially public | Public plus KYC |
Total score 4-6: high risk — best to stay away Total score 7-9: moderate risk — a small position could be reasonable Total score 10-12: relatively safe (though contract and economic model risk still deserve attention)
| Tool | Function | Chain Support |
|---|---|---|
| Token Sniffer | Automated contract scanning | Multiple EVM chains |
| Honeypot.is | Honeypot detection | EVM |
| GoPlus Security | Comprehensive risk scanning | Multi-chain |
| RugDoc | DeFi project reviews | EVM |
| DEXScreener | LP and holder analysis | All chains |
| Etherscan/Solscan | Block explorers | Per chain |
| Bubblemaps | Holder relationship mapping | Multi-chain |
| Arkham | Wallet labeling | Multi-chain |
| Solidus Labs | Rug pull risk scoring | Multi-chain |
| Certik Skynet | Project security monitoring | Multi-chain |
Q: Do all anonymous teams eventually rug pull?
No. Andre Cronje (Yearn's founder) and 0xMaki (SushiSwap) were both anonymous when they started out. Being anonymous but pairing that with a long, stable track record of shipped work, backing from well-known VCs, and continuous code updates can still build real trust. But projects that are fully anonymous with no track record almost always end up rug pulling.
Q: Does passing an audit mean a project won't rug pull?
Not necessarily. An audit can only catch code vulnerabilities — it can't stop an admin from intentionally acting in bad faith. If a contract explicitly states "owner can mint unlimited," an auditing firm will flag it, but that won't necessarily stop users from buying anyway. An audit combined with transparent governance and a multisig is what actually makes a project relatively safer.
Q: Are all tokens on a DEX untrustworthy?
DEXs like Uniswap and PancakeSwap let anyone create a pool, with no vetting process at all. You need to do due diligence before buying — checking the contract, holder distribution, LP lock status, and the team. Just "trading on a DEX" says nothing about a project's reliability.
Q: Is a token that's listed on a CEX automatically safe?
Not necessarily. Top CEXs like Binance, OKX, and Bybit do have listing reviews, but plenty of listed projects have still gone to zero after listing (FTT, LUNA, CEL). A CEX listing lowers the risk of a "hard rug," but it doesn't eliminate the risk of an economic model collapsing.
Q: How do you know whether a memecoin will go to zero?
Over 90% of memecoins go to zero within 1-3 months. The few that survive usually need a combination of a strong IP (POPCAT, PEPE), genuine community culture, a CEX listing boost, and sustained social media momentum. Memecoin investing is close to gambling — keep each position under 1% of your total portfolio.
Q: If a project claims to be "fully decentralized," is it safe?
It depends on actual verification. "Decentralized" is a word that gets abused by project teams all the time — it's often just marketing, while the contract still has owner-level privileges, governance is still controlled by a handful of whales, and key decisions remain centralized. Look at the actual on-chain data, not the marketing copy.
Q: Can you recover your losses after buying into a rug pull?
Rarely. Rug pull proceeds are usually laundered multiple times through mixers like Tornado Cash, cross-chain bridges, and CEXs, which makes on-chain tracing difficult. Even if the funds are traced to a CEX account, that account is usually registered under a fake identity and can't be frozen in most cases. Filing a police report can help, but the odds of recovery are low.
Q: Are projects launched on Solana's Pump.fun safe?
Pump.fun has an automatic LP-burning mechanism (the LP is burned the moment a token "graduates" to Raydium), which lowers the risk of a hard rug. But the token itself can still be dumped by whoever holds a large position, and the odds of it going to zero in the short term are still over 90%.
Q: Are DeFi projects with "unlimited upgradeability" always unsafe?
Not necessarily. Top-tier projects like Aave, Compound, and Curve all use the upgradeable proxy pattern, but they keep the upgrade process transparent and resistant to abuse through a multisig, governance, and a timelock. What actually matters is whether the proxy's admin control is decentralized, and whether upgrades require a community vote.
Q: How long does it take to vet a project properly?
A quick due-diligence pass takes about 30 minutes (contract scan, holder distribution, and a search on the team). A deep dive takes 2-5 hours (reading the code, reading audit reports, checking on-chain history, and comparing against similar projects). The more effort you put in, the safer you'll be, but it's worth weighing that against the time cost — deep due diligence makes the most sense for larger investments.
Chainalysis's 2025 crypto crime report, the Solidus Labs rug pull database, CertiK's quarterly reports, Etherscan, Solscan, DEXScreener, and Twitter/media coverage of the individual rug pull incidents referenced above.