How to Spot a Rug Pull: 8 Warning Signs Before You Buy
Updated 2026-06-02 · 6 min read
A rug pull is when a token's creators take investors' money and disappear — by draining liquidity, dumping a huge pre-mined supply, or coding the contract so you can buy but never sell. The good news: almost every rug leaves on-chain fingerprints you can check in seconds, before you risk a cent. Here are the eight warning signs that matter most.
1. Liquidity isn't locked or burned
Liquidity is the pool of paired tokens (e.g. SOL or ETH) that lets people trade. If the team controls that pool, they can withdraw it in a single transaction and the token's price instantly goes to zero — the textbook rug pull.
Safe projects lock liquidity for a set period or burn the LP tokens entirely so no one can pull it. Before buying, confirm the LP is locked or burned. SafuScan surfaces this automatically in every scan.
2. The mint authority is still active
If the mint authority hasn't been revoked, the developers can create unlimited new tokens at will — diluting your holdings to nothing whenever they choose. On Solana especially, an active mint authority is a major red flag.
Legitimate fixed-supply tokens revoke the mint authority. A SafuScan scan checks this on-chain directly, so even brand-new tokens get a real answer.
3. A few wallets hold most of the supply
When the top handful of wallets control 20%, 50% or more of the supply, a single sell can crater the price — and those wallets are often the team or insiders. High holder concentration is one of the strongest predictors of a dump.
Check the top-holder breakdown and be cautious when one non-locked wallet holds an outsized share.
4. You can buy but you can't sell (honeypot)
A honeypot contract is written so buys succeed but sells are blocked or taxed to nothing. Your money goes in and can never come out. These are invisible from the chart alone — the price may even look like it's pumping.
The only reliable check is a live sell-simulation. SafuScan runs one (via honeypot.is) and cross-checks it against contract-security data to flag honeypots before you trade.
5. Hidden or extreme buy/sell taxes
Some contracts charge a transfer tax — sometimes a reasonable 1–5%, sometimes a hidden 30–100% that quietly drains you on every trade. A sky-high or asymmetric (high-sell, low-buy) tax is a deliberate trap.
Always check the real buy and sell tax before trading; treat anything above ~10% with suspicion.
6. Freeze authority is active (Solana)
On Solana, an active freeze authority lets the token's creators freeze your wallet's balance — so you hold the token but can never move or sell it. Reputable Solana tokens revoke the freeze authority.
7. Anonymous team, copied site, and manufactured hype
Off-chain signals matter too: a brand-new anonymous team, a website cloned from another project, a Telegram full of bots, and urgent 'buy now or miss out' messaging are classic pressure tactics. Hype is engineered to stop you from doing the 30 seconds of checking that would save you.
8. No verified contract or locked, renounced ownership claims you can't confirm
Claims like 'ownership renounced' and 'liquidity locked' are meaningless unless they're verifiable on-chain. Don't take a project's word for it — verify the contract state yourself, or use a scanner that reads it directly from the blockchain.
The bottom line: a token can tick every box and still fail, and a clean scan is not a guarantee — but checking these eight signs filters out the overwhelming majority of rugs in under a minute.
Run every check in this guide automatically in seconds — free, no wallet needed.
Frequently asked questions
No tool can be 100% certain — contracts can be upgraded and liquidity can be unlocked later. But checking liquidity locks, mint/freeze authorities, holder concentration and honeypot status catches the vast majority of rugs before you buy.
The most common is a liquidity pull: the team controls the liquidity pool and withdraws it in one transaction, sending the price to zero. Locked or burned liquidity prevents this.
With an automated scanner like SafuScan it takes a few seconds — paste the contract or mint address and you get a SAFE / CAUTION / RISKY / AVOID verdict with the underlying signals.