How to Spot a Crypto Rug Pull Before It Happens (2026 Checklist)

Rug pulls are not random. They follow a pattern. Every major rug in the last three years had at least four of the nine signals on the checklist below, visible on chain, days or weeks before the rug actually happened.

The reason most people lose money to rugs is not that the signals are subtle. It's that nobody runs the checks before buying, and once the bag is heavy, the checks start to feel like an attack on the position instead of a defense of the capital. This guide walks through the nine signals, how to verify each one in under a minute, and what to do when a position you already hold trips three or more of them.

What a rug pull actually is

"Rug pull" gets used loosely to mean any token that goes to zero. The original meaning is narrower and more useful: a rug pull is when the people who deployed the token use a built-in capability of the contract or the liquidity setup to extract value from holders without warning.

The three main mechanics:

• Liquidity rug. The dev pulls the LP tokens, draining the pool. Price goes to zero in one block.
• Mint rug. The dev mints a giant new supply and dumps it into the pool. Same result, slightly slower.
• Honeypot. Holders can buy but cannot sell. The dev sells. Pool drains. Game over.

All three are visible on chain before they happen. None of them are surprises if you ran the checks.

The 9-signal rug checklist

These are ordered roughly by how often each one alone has caused real loss. Run all nine before any token enters your wallet and again monthly on tokens already there.

1. Mint authority not renounced

If the deployer still has mint authority on the token contract, they can mint billions of new tokens tomorrow and dilute every holder to dust.

How to check: on Solana, open the token in Solscan and look at the "Mint Authority" field. If it shows an address (not "None" or "Burned"), the dev can still mint. On Ethereum, read the contract on Etherscan and look for mint, owner, or mintable functions. If they exist and aren't permanently locked, the dev can mint.

2. Liquidity not locked, or locked too briefly

Locked LP tokens mean the dev cannot pull liquidity until the lock expires. "Locked for 30 days" is not a lock. It's a 31-day countdown to a rug.

How to check: look up the LP token on the chain explorer. Trace the holder. If the LP is held by the deployer wallet, it's not locked. If it's in a lock contract (UNCX, PinkLock, Team Finance, etc.), open the lock contract and read the unlock timestamp. Demand at least 6 months. Prefer 12+.

3. Top 10 holders own more than 30 percent

When a small group holds most of the supply, you are exit liquidity for them. The dev wallet plus three friends can coordinate a sell and crater the price before anyone else can react.

How to check: chain explorer → token contract → holders tab. Exclude the burn address (0x000...dead), the LP pool contract, and the staking contract (legitimately locked supply). If the top 10 remaining holders are over 30 percent of circulating supply, the token has concentration risk that no chart can fix.

4. Contract not verified on the explorer

An unverified contract means the deployer hasn't published the source code matching the deployed bytecode. You literally cannot read what the functions do. Hard pass, no exceptions.

How to check: Etherscan / Solscan / BSCScan → contract tab. If you see "Contract Source Code Verified" with the source listed, fine. If you see raw bytecode, no.

5. Trading taxes the dev can change

Some tokens have a "tax" on buys and sells (a percentage that gets routed to the dev wallet, the LP, or "marketing"). The risk isn't the tax itself — it's whether the dev can change the tax to 99 percent at any time. If they can, that's a soft honeypot waiting to be flipped.

How to check: read the contract for a setTax, setFee, or setBuyTax function. If it exists and is callable by the owner, the dev can flip the tax to 99 percent and lock holders in. Prefer tokens with hard-coded, immutable taxes — or no taxes at all.

6. No actual product, all marketing

Memes that openly admit they're memes are honest. Memes pretending to be infrastructure are dangerous because the marketing covers for the fact that there's nothing to value. If you can't describe what the project does in one sentence without using the word "ecosystem" or "platform," that's a flag.

How to check: open the docs. Look for an actual technical spec or a working product link. If everything is roadmap and partnerships and "phase 3," you are buying a marketing budget, not a product.

7. Suspicious launch pattern

Real projects usually launch with a fair distribution mechanism (LBP, public sale, airdrop) where the dev wallet starts with a small percentage. Rug-prone tokens often launch with the dev holding 30 to 50 percent of supply via a stealth launch, sniper bots, or insider whitelists.

How to check: look at the earliest 100 transactions on the token contract. If the dev wallet (or wallets clearly linked to it) received massive allocations in the first few minutes, the float was always concentrated. The dump is just waiting for the chart.

8. Pump pattern that doesn't match the volume

A token going up 40x in a week with $50k daily volume is being marked up by a handful of buyers, not discovered organically. The chart looks beautiful right up until the dev dumps and the volume reveals there was never anyone there to catch the bag.

How to check: compare the market cap to the 24-hour volume. Healthy growth tokens trade at least 5 to 15 percent of market cap in daily volume. Anything trading at under 1 percent of market cap is being pumped on paper, not adopted in reality.

9. Dev / team is anonymous and has rugged before

Anonymous doesn't automatically mean rug. Plenty of legitimate projects have anonymous teams. But anonymous plus prior history is a near-certain pattern. The same wallets that deployed a rug six months ago are very often the same wallets behind the next "new" project.

How to check: put the deployer wallet into a chain analytics tool (Arkham, Nansen, even Etherscan's wallet history). Look at what they've deployed before. If their last three deployments went to zero, this one will too.

What to do when a position you already hold trips 3+ signals

This is where people lose money even after they know better. The signals are clear. The bag is already heavy. The chart is still going up. The brain finds reasons to keep holding.

The rule is simple and unsentimental:

• 3 or more signals tripped: size down by at least 50 percent immediately, regardless of P&L.
• 5 or more signals tripped: exit fully, take whatever you can get, write it off as tuition.
• Mint authority + unlocked liquidity (the two worst signals together): exit at any price. This combination has caused more than half of all liquidity rugs.

Taking a 30 percent loss on a position that trips five rug signals is not a loss. It's avoiding a 100 percent loss. The math is one-sided.

How to do this every time without it taking an hour

Doing nine checks manually for every token in a 15-token wallet is two hours of work. Nobody does it consistently. That's why rugs work.

The automated version runs all nine checks on every position in your wallet in about 60 seconds. It returns a contract-risk score per position, surfaces the top flags, and ranks the positions most likely to rug based on the pattern density of the signals. You enter the holdings, the tool runs the checks, the dashboard tells you which positions to fix first.

No seed phrase. No wallet connection. Just a paste-in of your holdings or wallet address (read-only) and the contract-risk score across your bag.

The bottom line

Crypto rug pulls feel like bad luck. They're not. They're a pattern that's visible on chain before it triggers, every time. Run the nine checks. Size positions accordingly. Exit anything that trips three or more flags before the dev makes the decision for you.

Nobody owes you a warning before a rug. The chain shows you everything. You just have to look.