How Rug Pulls Actually Work: A Technical Breakdown For New Traders

You see a new token that is up 10,000% in a day. You FOMO in. And then, in a matter of seconds, the price goes to zero, and the liquidity disappears. You’ve just been rugged. But what actually happened?

A rug pull is a type of exit scam where a crypto developer creates a new token, hypes it up on social media, and then runs away with all of the investors’ money. This represents one of the most common and most devastating risks for new traders in the DeFi space. Bitget’s June 2025 report states $4.6 billion in total crypto scam losses in 2024. There was also an increase in NFT-related rug pulls, making up 14% of all rug pulls in 2025, with a 35% increase in losses from NFTs in 2024.

This article will provide a technical breakdown of how rug pulls actually work. We will go beyond the headlines and look at the actual smart contract mechanics that allow scammers to steal your money. The goal is to arm you with the knowledge you need to spot a rug pull before it happens.

The Anatomy of a Rug Pull

Step 1: The Bait

The scammer creates a new token with a catchy name and a slick-looking website. In 2025, 31% of rug pulls involved projects claiming to offer real-world utility or metaverse integrations. They often create a fake story about a revolutionary new technology or a partnership with a major company.

Anatomy of a rug pull. Source: Solidus Labs

Scammers bait victims by deploying tokens with alluring names like “QuantumYield” or “MetaVerseX,” paired with professional websites mimicking legitimate projects via no-code tools like Card or cloned templates from successful DeFi protocols. In 2025, 31% of rug pulls featured false claims of real-world utility (e.g., AI-blockchain integrations) or metaverse tie-ins, exploiting hype around virtual land sales and NFT ecosystems.

Fabricated narratives often include bogus partnerships with giants like “Tesla” or “OpenAI,” amplified by AI-generated whitepapers and fake audits in 27% of cases to build instant credibility. Crypto presale scams comprised 30% of these baits, promising exclusive early access but vanishing post-funding without exchange listings. Social media bots flood Telegram and Discord, driving 80% of investor traffic with urgency tactics like “limited supply” or “VC-backed,” targeting 35% under-25 retail traders who comprise 63% of victims. This phase lasts under 12 days on average, priming the liquidity pump before extraction.

Step 2: The Hype

The scammer uses social media bots and paid influencers to create enormous amounts of hype around the new token. Social media promotions drive 80% of rug-pull investor traffic, particularly through Telegram, Twitter, and Discord. They create a sense of urgency and FOMO (Fear Of Missing Out).

Scammers heavily rely on social media, often utilising tactics that mimic legitimate crypto market news outlets, to hype new tokens and lure investors into rug pulls. In 2025, social media promotions drive around 80% of rug-pull investor traffic, especially through platforms like Telegram, Twitter, and Discord. These platforms host thousands of scam channels, where bots and paid influencers create a frenzy of hype using tactics such as announcing fake partnerships, limited-time offers, and exclusive access to projects.

This generates strong FOMO (Fear Of Missing Out), pushing investors, especially younger traders under 35, who make up 63% of victims, to buy quickly without thorough research. Even traders who normally buy ETH, swap crypto, or monitor live crypto prices can be lured when influencers frame every meme token as “the next 100x.” Social media-driven scams include fake airdrops, phishing, and impersonations of known crypto figures, contributing to significant crypto fraud losses. The average time for a rug pull to unfold has decreased to 12 days, highlighting the speed and efficiency of social media-driven promotion and exit scams

Step 3: The Liquidity Pool

The scammer creates a liquidity pool for the new token on a decentralised exchange like Uniswap. They pair their token with a legitimate and valuable token, such as ETH or USDC, to give an illusion of authenticity and liquidity. The scammer initially supplies both tokens to bootstrap trading and attract investors, who buy into this liquidity pool, driving up the token’s apparent market value.

This setup lures investors to trade using this pool, with the scammer maintaining control of the liquidity provider (LP) tokens. At the peak of investor activity, the scammer can then execute the rug pull by withdrawing all the legitimate tokens from the pool or selling large quantities of the new token, collapsing its value and leaving investors with worthless assets. Liquidity locking, a security measure where LP tokens are locked for a fixed period, is often absent in these scams, which serves as a key red flag.

Step 4: The Rug Pull

This is the critical step. On average, rug pull scams attract 2,100 investors before disappearing. The scammer waits for a large number of investors to buy their token. Then, they execute the rug pull. There are two main ways they can do this.

The Red Flags: How to Spot a Rug Pull

No Audit

A smart contract audit from a reputable firm is a must-have for any legitimate project. 75% of projects with unaudited smart contracts were identified as rug-pull scams. A vivid example is the hypervault rug. Without a review from a reputable security firm, hidden risks may remain, such as functions that allow unlimited token minting or give developers full control over the contract.

Anonymous Team

If you don’t know who the developers are, that is a major red flag. While anonymity is part of crypto culture, projects with no transparency around their developers or founders are harder to hold accountable. That makes it easier for bad actors to disappear with investor funds.

Unlocked Liquidity

Legitimate cryptocurrency projects commonly lock liquidity provider (LP) tokens in timelock smart contracts or third-party platforms like Unicrypt or Team Finance to demonstrate commitment and prevent sudden withdrawals that enable rug pulls. Best practices in 2025 recommend locking at least 80% of total liquidity for a minimum of 1 year, with many opting for 3-5 years to align with vesting schedules and build investor trust. Such locks are now expected by most exchanges before token listings.

This mechanism deposits LP tokens into tamper-proof contracts verifiable on explorers like Etherscan, ensuring liquidity remains available for trading without developer access until the period ends. Unlocked or short-term liquidity (under 6 months) appears in 45% of rug pull scams, serving as a primary red flag since it allows scammers to drain paired assets like ETH or USDC at peak hype.

Projects often pair locks with milestone-based unlocks (e.g., 25% at 10,000 users) for flexibility while maintaining transparency through regular on-chain reporting. Investors should always verify locks via tools like liquidity lock checkers before investing, as the absence signals high rug pull risk.

Concentrated Token Holdings

If you see that, say, 5 wallets hold 90% of the supply, that’s a huge risk. You can use a block explorer like Etherscan to see the token holder distribution. If a small number of wallets hold a huge percentage of the supply, that is a major red flag.

Conclusion

The mechanics of a rug pull involve creating fake hype, establishing a liquidity pool, and then either draining the pool or dumping massive token holdings. The key red flags to look out for include no audit, anonymous teams, unlocked liquidity, and concentrated token holdings.

The DeFi space is a wild and dangerous place. It is full of opportunities, but it is also full of scams. The key to survival is to be sceptical, to do your own research, and to never invest more than you are willing to lose. Don’t be someone else’s exit liquidity.

Want to learn more about how to stay safe in the world of DeFi? Use Digitap to explore security-focused crypto projects and avoid potential scams.

FAQ

What is a rug pull?
A rug pull is a scam in the crypto world where the developers of a project suddenly withdraw all funds or liquidity, causing the token’s value to collapse and leaving investors with worthless assets. It is akin to “pulling the rug out” from under investors, exploiting their trust for personal gain.​

How can I tell if a project is a rug pull?
Signs include anonymous development teams, unaudited or suspicious smart contracts, unlocked liquidity, and highly concentrated token holdings. Social media hype with unrealistic promises, fake audits, and liquidity pools controlled solely by developers are major red flags.​

What is locked liquidity?
Locked liquidity means that a project’s liquidity provider (LP) tokens are held in a smart contract or third-party platform with a timelock so they cannot be withdrawn suddenly. This secures the liquidity pool and prevents rug pulls by ensuring liquidity remains available for trading for a set period, usually 1-3 years or more.​

Can I get my money back after a rug pull?
Recovering funds after a rug pull is very difficult. Only a small percentage of stolen assets are recovered through legal action, blockchain tracing, or seizures. Prevention through thorough due diligence is the most effective safeguard.​

Are all new tokens scams?
No, not all new tokens are scams. Many legitimate projects launch new tokens with proper audits, transparency, and locked liquidity. However, new tokens carry risk, and investors should be skeptical and perform due diligence to avoid falling victim to scams.