A rug pull is a specific kind of crypto scam: the people behind a token pull the liquidity that lets it be traded, and the price collapses to near zero in one move. It is a different mechanism from a honeypot, where the contract code itself blocks selling. A rug pull needs no special code at all. It just needs the deployer to hold enough of the pool.
Where the liquidity comes from
When a token launches on a decentralized exchange, someone has to seed a liquidity pool, usually pairing the new token with ETH or another established asset. Whoever deposits that pair receives LP tokens in return, a receipt that represents a claim on the pool and the right to withdraw the underlying assets. See liquidity pools and impermanent loss explained for how pools work in general.
At launch, the project's own deployer wallet is usually the pool's biggest liquidity provider, since it is the one that funded the initial pair. That is normal and, on its own, not a red flag. The problem is what that wallet is able to do afterward.
How the pull happens
If the deployer still holds those original LP tokens, nothing stops them from redeeming the LP tokens and withdrawing their share of the pool at any time. As buyers trade into the token, they add real value (ETH or another paired asset) to the pool. When the deployer withdraws, they take out that accumulated value in a single transaction, draining most of the pool's paired asset and leaving the token's price to collapse immediately. Anyone still holding the token is left with a position that can barely be sold for anything, because there is almost nothing left in the pool to sell into.
This is often called a "hard rug." A single transaction, visible on a block explorer after the fact, is usually all it takes.
Variations worth knowing
Not every rug pull looks like a single dramatic withdrawal:
- Soft rugs. Instead of pulling liquidity outright, the team quietly sells its own large token holdings into the pool over time. The price grinds down rather than collapsing instantly, which can look like ordinary market activity until it is well underway.
- Hidden mint functions. A contract can include a function, sometimes disguised or left out of public documentation, that lets the owner mint new tokens at will. Minting a large new supply and selling it has the same draining effect as pulling liquidity, without touching the LP tokens directly.
- Fake or partial locks. Some projects lock a portion of their liquidity to build trust while keeping a separate, unlocked wallet or a second pool that never gets the same treatment.
- Upgradeable contract abuse. If a contract is upgradeable, a later "upgrade" can quietly introduce the ability to drain funds or change token behavior after buyers already feel comfortable.
Locking and burning liquidity, and their limits
Two common protections address the liquidity side directly. Burning LP tokens means sending them to a dead address with no known private key, so they can never be redeemed by anyone, permanently locking that liquidity in place. Locking LP tokens through a third-party locker contract holds them for a fixed time period, after which they become withdrawable again.
Both reduce the risk of a hard rug on that specific pool, but neither is a complete guarantee. A lock has an expiration date, and a project can simply wait it out. A burn only covers the liquidity that was actually burned, not any liquidity added later or held in a separate pool. And neither protection touches the contract's own logic, so a hidden mint function or an upgrade path can still drain value even with liquidity permanently locked.
Checking a token before you buy
A few checks on a block explorer take a few minutes and catch a meaningful share of obvious cases:
- Look at the token holder list. If a small number of wallets, especially the deployer, hold a large share of total supply, that concentration is a risk regardless of what the liquidity pool looks like. See how to use a block explorer.
- Check whether the contract is verified. A verified contract lets you read the actual source code, including whether a mint function, ownership control, or pausable transfer logic exists. See what a verified contract on Basescan means.
- Look at the LP token holder for the pool itself. If the pool's LP tokens sit in the deployer's own wallet rather than a burn address or a named locker contract, the liquidity can be withdrawn at any time.
- Check whether ownership has been renounced. Renouncing ownership removes the ability to call owner-only functions like minting, though it only helps if there is no mint function left to worry about in the first place.
- Be wary of aggressive, fast-moving promotion. Heavy marketing designed to pull in buyers quickly, before anyone has time to check the contract, is a pattern that shows up often around both rug pulls and honeypots.
Rug pull versus honeypot
The two get grouped together because both end with buyers unable to recover value, but the failure point is different. A honeypot's contract code blocks the sell transaction itself, often while buying still works fine. A rug pull needs no such code: the token might transfer perfectly normally in both directions, but the pool backing it has been drained, so there is nothing left to sell into at a reasonable price. See fee-on-transfer tokens and honeypots explained for the contract-level version of this problem.
The takeaway
A rug pull is a liquidity problem, not necessarily a code problem. A token can have clean, honest-looking contract code and still be rugged if its liquidity was never locked or burned, or if a large token supply sits in a small number of wallets. Checking LP token ownership and holder concentration before buying takes only a few minutes on a block explorer, and it catches a real category of risk that reading the contract's transfer function alone will not.