How Crypto Rug Pulls Actually Work (and How to Check Before You Buy)

By Artemis

Updated August 31, 2026

Most warnings about rug pulls stop at “be careful with new tokens,” which is true and useless. The useful version explains the machinery, because every rug pull relies on a specific power the deployer kept for themselves, and every one of those powers is visible on-chain before you buy. So how do crypto rug pulls work in practice? Three mechanisms cover almost all of them, and each has a corresponding check you can run in a couple of minutes without reading any code.

Key Takeaways

How do crypto rug pulls work? Three mechanisms cover most of them: liquidity draining, honeypot contracts and hidden mint functions.
GoPlus Security detected over 67,000 honeypot tokens across Ethereum, Base and BNB Chain in a single quarter.
Every one of these mechanisms is a permission the deployer retained, and permissions are public.
CoinGecko found 68.67% of Pump.fun tokens recorded their last trade on the day they launched.
Locked liquidity and renounced ownership reduce risk. Neither eliminates it.

How do crypto rug pulls work? Mechanism one: draining liquidity

This is the classic. To trade on a decentralised exchange, a token needs a liquidity pool, typically the new token paired with something real like ETH or a stablecoin. The deployer creates it and receives LP tokens representing their share.

Buyers arrive, put ETH into the pool and take the new token out, so the pool’s ETH side grows. Then the deployer redeems their LP tokens, withdraws the accumulated ETH, and the pool is empty. Anyone holding the token now owns something with no market on the other side.

The whole event can take one transaction. Nothing is hacked, because withdrawing liquidity you provided is a normal function working exactly as designed.

Mechanism two: honeypot contracts

A honeypot inverts the trap. You can buy. You cannot sell. The contract contains logic that reverts sell transactions, or applies a sell tax so extreme it swallows the position, or maintains an allowlist so only certain addresses can exit.

The chart looks superb because it shows only buying, which is the tell once you know to look: a price line with no red candles at all. Meanwhile the deployer sells freely into the demand they have manufactured.

Scale matters here. GoPlus Security reported detecting 67,241 honeypot tokens across Ethereum, Base and BNB Chain in one quarter, alongside TenArmor data putting rug pull losses on Ethereum and BSC above $45.2 million over the same period. Those figures cover Q4 2024, and we found no equivalently detailed public breakdown for 2026, so treat them as illustrating the scale of the category rather than current totals.

Mechanism three: hidden mint functions

The quietest of the three. The contract retains a function letting the owner create new tokens after launch. Supply looks fixed, holders assume it is, and then the owner mints a large quantity and sells it into the pool. Your tokens still exist. They are simply now a much smaller share of a much larger supply.

Related permissions do similar work, and they are the least discussed part of how do crypto rug pulls work. A blacklist function lets the owner block specific wallets from transferring. A modifiable tax function lets them raise the sell fee after you are in. A pausable contract lets them freeze trading entirely.

The checks you can actually run

Here is the practical part, and it answers how do crypto rug pulls work from the defender’s side. Every mechanism above requires a retained permission, and permissions are readable.

Start on the block explorer. Paste the contract address into Etherscan or the equivalent for the chain. A token page gives you the Contract tab, where you want to see verified source code rather than an unverified blob, and the Holders tab, where you want to see supply spread across many addresses rather than concentrated in a handful.

Check ownership. In the contract’s read functions, look at the owner address. If it is the zero address, ownership has been renounced and owner-only functions can no longer be called. If a named wallet still holds it, ask what that wallet is permitted to do.

Check the functions themselves. Scan the write functions for names like mint, setTax, setFee, blacklist, pause or setMaxTx. You do not need to read the code. The presence of the function tells you the power exists.

Check liquidity. Locked liquidity means the deployer’s LP tokens are held in a time-locked contract or sent to a burn address, so they cannot be withdrawn until the lock expires. Look at who holds the LP tokens, when any lock ends, and how much is actually locked.

Run a scanner as a second opinion. Automated tools such as GoPlus Security’s token checker and Honeypot.is, which simulates a buy and a sell to see whether selling is possible, are widely used for this. Verify any tool is live and behaving before relying on it, and never treat a single score as a verdict.

What “locked” and “renounced” do not mean

Both phrases get used as talismans. Renouncing ownership removes owner-only functions, but some contracts keep separate privileged roles under other names, and renouncing an implementation while retaining proxy admin rights leaves the logic changeable. Locked liquidity is only as good as its duration, and a seven-day lock on a two-hour-old pool is not reassurance.

The wider context is worth holding onto. CoinGecko’s research on Pump.fun tokens found 68.67% recorded their last trade on the same day they were created, and only 4.55% survived beyond 90 days. Most tokens fail without anyone pulling a lever. Our guides on evaluating token sales and meme coins versus utility coins cover the non-technical side of that.

Disclaimer: This article is for informational and educational purposes only and is not financial or investment advice, and no token or tool is endorsed. No check described here can establish that a token is safe, and contracts can change behaviour after you buy. Crypto assets are high risk and you may lose everything you put in. Do your own research and consider speaking to a qualified professional. See our editorial policy for how we source and verify our reporting.

Final Thoughts

The reassuring thing about how do crypto rug pulls work is that the answer is mechanical rather than mysterious. Someone kept a power, and later used it. Nothing was broken into. That is why the checks work: you are not trying to predict intent, only to establish which powers still exist.

Run them in order and the process takes minutes. Verified source, ownership status, dangerous functions, liquidity lock, then a scanner for a second opinion. If any step comes back unclear and nobody can explain why, that ambiguity is the answer. The tokens that survive scrutiny are the ones where every one of those questions has a boring, checkable response.