抽地毯式诈骗

概念： What Is a Rug Pull, Hard vs Soft Rug, How It Works, Red Flags, Memecoins and pump.fun, How to Protect Yourself

:::section{mins=5} What Is a Rug Pull :::

:::lead You find a new DeFi protocol, put in $500, and the price doubles in a day. The next morning the site is down, the Telegram is gone, and the liquidity pool is empty. That is a rug pull – the creators collect investors' money and disappear with it, and it is one of the most common and damaging forms of fraud in crypto. :::

:::p{html} The numbers are large. According to Chainalysis, rug pulls accounted for roughly $2.8 billion in 2021 – about 37% of all crypto scam revenue that year (the firm later revised its methodology and put the 2021 figure closer to $5 billion). The yearly totals then fell sharply (around $1.3 million in 2022, about $95 million in 2024), but rug pulls did not go away. Their shape changed: scammers moved from a few huge heists to a conveyor belt of many tiny ones. We mapped the whole threat landscape in 4.1 §1; this card zooms into one category. :::

:::p{html} There are two kinds. A hard rug is a technical attack: the creator builds a backdoor into the smart contract and drains funds in one move. A soft rug is a social one: the team slowly stops working, goes quiet, and sells its tokens on the open market over weeks. The outcome is the same (you lose money), but the speed and the proof differ completely. A hard rug is instant and obvious on-chain; a soft rug hides in the gray zone between fraud and an honest failure. :::

:::p Why are they everywhere? Because the economics are absurd. The upfront cost is small and, crucially, recoverable: the creator seeds a pool on a DEX, hypes the token through Twitter, Telegram, and paid influencers, and rides the excitement up, then sells or pulls liquidity, pocketing the seed money along with everyone else's. Only on a bonding-curve platform like pump.fun does the cost drop to a couple of dollars, because the protocol supplies the liquidity. Unlike traditional fraud, which needs licenses, registration, and a physical presence, a crypto rug pull can run fully anonymously from anywhere. Hard rugs clearly qualify as fraud and the big ones do get prosecuted (OneCoin through the U.S. DOJ, BitConnect through the SEC), but small rugs of $10K–$1M almost never do: anonymity, jurisdiction, and the cost of pursuit all favor the scammer. :::

:::callout A gym is about to open in your neighborhood. The build-out looks well underway, the renders of the floor are gorgeous, and a 'lifetime access' pre-sale is going for almost nothing. Hundreds of people pay in. Anyone can put up a sign-up page like this, and no one checks whether there is a real lease or any equipment behind it. On opening day the doors are locked, the page is gone, and the company was registered to a stand-in name: the money was collected from everyone and simply evaporated. A rug pull follows the same pattern: the project looks real, you put money into its future, and the creators take everyone's funds and disappear, anonymously and almost beyond reach. :::

:::keypoints{label="Key Points"}

  • Thodex (Turkey, 2021): exchange CEO Faruk Fatih Özer made off with ~$2.5B in user funds and fled; Albanian police arrested him in Vlora about 16 months later, and in 2023 a Turkish court sentenced him to 11,196 years. One of the largest rugs on record – and a rare exception, because most scammers are never caught.
  • AnubisDAO (October 2021): a dog-themed project with no website and no whitepaper raised ~13,556 ETH (≈$58–60M at the time) in about 20 hours – and within those same 20 hours the pool's creator cashed out the LP tokens and drained almost all the liquidity. The whole "project" amounted to a dog logo and a couple of social accounts on Discord and Twitter, both soon taken down.
  • Chainalysis tracks a sharp drop in the average rug: in 2023 a typical ERC-20 pump-and-dump netted its creator about $2,700, and the median rug on Raydium in 2024–2025 was about $2,800. The game went industrial – many tiny drains instead of one big score.
  • What separates a crypto rug from classic fraud is permissionless creation: anyone can mint a token and list it on a DEX with no registration, KYC, or approval. There's no gatekeeper at all – which is exactly why the volume is so high. :::

:::details{badge=Advanced title="Rug pull economics: what it costs to run one, what it returns"} The costs below are illustrative ranges drawn from ZachXBT case write-ups and Chainalysis reports – there is no clean public cost breakdown, so treat them as orders of magnitude, not audited figures. On EVM chains, creating a token costs only gas ($5–$50) if you start from a free template, and on pump.fun it comes to barely a couple of dollars. The initial liquidity ($1K–$10K) is not really a cost at all, because the creator takes it back at the moment of the rug – it comes out of the pool along with everyone else's money. The money that actually gets spent goes on attention: follower bots cost $100–$500, a small influencer charges $500–$5K for a post, and a top-tier crypto blogger commands $10K–$50K.

The return side is what makes the model self-sustaining. A small EVM rug might cost $1K–$5K all-in and bring back $20K–$100K, while a mid-sized one costs $10K–$50K and returns $100K–$1M. On pump.fun the bonding curve means $0 of the creator's own liquidity, so a conveyor operator can launch many tokens a day and let a single hit pay for all the misses.

And one does pay for the rest. Per Dune, only about 3% of pump.fun token creators ever cleared more than $1,000 in profit (2024) – but for an anonymous operator with near-zero downside, a 3% hit rate is a viable business. That asymmetry, not any single mega-scam, is why small rugs keep coming. :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s1 label="Check yourself" correct=2 explanation="Correct. The absence of any gatekeeper – no registration, no KYC – is what makes rug pulls mass-scale. Traditional fraud needs licenses and a physical presence to take money; a crypto rug needs neither."} What separates a crypto rug pull from classic financial fraud?

  • Blockchain transparency makes on-chain evidence strong enough to recover stolen funds in most cases
  • Rug pulls exploit bugs in smart contract code, while classic fraud uses forged documents and identity theft
  • Permissionless creation: anyone can mint a token and list it with no KYC – no gatekeeper at all
  • Regulators can freeze crypto tokens within hours, which limits total losses compared to a traditional Ponzi :::

:::section{mins=6} Hard Rug vs Soft Rug :::

:::lead Squid Game Token, late October 2021: SQUID runs from a fraction of a cent to about $2,861 in a few days. Holders rush to sell – and find they can't. One transaction drains the contract and $3.3 million goes to the creator on November 1. That is a hard rug in its purest form. But there is a slower, quieter version that is far harder to prove. :::

:::p The split runs along four lines: method, speed, provability, and defense. A hard rug uses a backdoor and fires instantly, in a single transaction; because everything is on-chain, it is easy to prove. SQUID is the textbook case: the contract was gutted in seconds and holders simply could not sell. A soft rug is the opposite: the team sells its tokens gradually over weeks or months. Proving it is hard, because it lives in the gray zone between "the project failed" and "we were scammed." Many "DeFi 2.0" projects ended this way: a loud launch, an ambitious roadmap, and six months later a dead Discord and a zeroed token. :::

:::p Most hard rugs use one of four mechanisms: :::

:::howto{label="Four hard-rug mechanisms"}

  • Mint function – the creator prints as many new tokens as they want and dumps them into the pool, draining out all the real money (the ETH); holders are left with tokens diluted to zero.
  • LP withdrawal – the creator pulls liquidity off the DEX, leaving holders nothing to sell into.
  • Hidden transfer – a buried function sweeps every wallet's balance to the creator.
  • Honeypot – the contract lets you buy but blocks selling for everyone except the creator. :::

:::p Each leaves a recognizable on-chain trace, and tools exist to catch them before you buy. :::

:::p A soft rug is subtler. The team bleeds out its allocation while development and communication quietly wind down, sometimes dressed up as a "pivot." The one objective signal that separates a soft rug from an honest failure is the order of actions: an honest team announces trouble before it sells, while a soft-rug team sells first and explains later. :::

:::callout A theater is selling tickets to a premiere. In the hard rug version, you take your seat, the lights go down and never come back on. The box office is empty, the staff has vanished, and the audience sits in the dark holding their tickets. It happened in seconds. In the soft rug version, the theater opens to a packed house and the first nights are brilliant. But gradually the leads leave, the sets fray, rehearsals get canceled, fewer seats fill, and next month's schedule never appears. One day the doors are boarded shut. Officially it is "financial difficulties," but the director emptied the company's account three months ago. :::

:::keypoints{label="Key Points"}

  • Squid Game Token ($3.3M, November 2021, on BNB Chain) was a honeypot: buying was open, but the sell path only worked for the creator's address. The price ran from cents to ~$2,861 while holders could not sell a single token.
  • An uncapped mint is the simplest and most destructive mechanism: the creator prints trillions of new tokens and sells them for every bit of ETH in the pool. Token Sniffer flags such functions automatically – but only if the contract's code is verified.
  • Soft rug versus honest failure comes down to one on-chain signal: sequence. Team wallets selling weeks before any "we're winding down" post is a soft rug; announcing problems first and liquidating after is a failure.
  • A large share of newly created tokens carry at least one dangerous function (mint, setFee, blacklist, hidden transfer) – the problem is systemic, not occasional. Verified source code plus an automated scan is the minimum check before buying. :::

:::details{badge=Advanced title="Why a clean honeypot check isn't a guarantee: the detection arms race"} :::p{html} We covered the plain honeypot – buy works, the sell path is blocked – back in 4.1 §3. It earns a second look here because of scale. In its 2022 Rug Pull Report, Solidus Labs found the honeypot to be the single most common type of scam token, part of 117,629 scam tokens deployed that year – roughly 350 a day, up 41% from 2021 – with about 12% of all BEP-20 tokens on BNB Chain and 8% of ERC-20 tokens on Ethereum flagged as fraudulent. SQUID, the $3.3M case from the section above, was named the most prolific honeypot of the year. This is not a rare edge case; it is a standing background rate of the market. :::

:::p{html} The part that matters for an advanced reader is the arms race. Tools like honeypot.is, Token Sniffer, HoneyBadger and QuillCheck simulate a buy and an immediate sell and watch whether the sell goes through – the right test, because the trap is enforced at execution time, not in what the code declares. But a simulation is a point-in-time snapshot, and modern honeypots are built to pass it now and spring later. The common evasions:

  • A 90–100% sell tax – the contract skims a fee on every sale, and at that rate the sell still goes through, so a checker that only asks whether the sell succeeded sees green; but the contract keeps almost all the proceeds (sell $1,000 and you walk away with $10–$100, the rest going to the creator).
  • A post-buy blacklist – the owner blocks wallets from selling after they have already bought in.
  • A 'tradingEnabled' or cooldown switch – the owner flips it on only once enough liquidity has flowed in.
  • An upgradeable proxy – the logic is swapped for a sell-blocking version after the checker has already returned 'clean'.
A token can read clean at 12:00 and be a honeypot at 12:30. :::

:::p{html} So the advanced question is not 'did the simulator pass' but 'who can change the answer.' Read the contract (walked through in 3.4 §1) for owner-only setters – setTax, blacklist, setTradingEnabled, pause – and check whether it sits behind a proxy (see 3.2 §1); if it does, the implementation can be replaced no matter what a 'renounced' owner suggests, because control may live in a separate proxy admin or multisig. A genuinely safe token has no live switch that can turn selling off: fixed taxes, no blacklist, non-upgradeable code, liquidity locked or burned. If even one such switch exists and a stranger holds it, your exit depends on their goodwill – and that dependency is the entire scam. ::: :::

:::details{badge=Advanced title="Slow rug via token unlock: when vesting becomes the weapon"} The scheme rides a legitimate mechanism. The team reserves 20–40% of supply on a 6–18 month vesting schedule; while it is locked, the community buys on the open market and the price climbs – then, the moment it unlocks, the team dumps everything at once.

SushiSwap (2020) is the famous near-miss: anonymous founder Chef Nomi sold roughly $14M from the dev fund right after an unlock, crashing SUSHI about 70% – then returned the funds under community pressure. Not every soft rug ends that well; many "DeFi Summer" projects simply dumped after the cliff and never recovered. Scheduled unlock dumps are the norm, not the exception – an analysis of more than 16,000 unlock events found that about 90% coincide with a price drop, often starting up to 30 days before the date (Webopedia, 2025). So the red flag isn't the unlock itself, which the market prices in; it's the team selling its entire allocation at once and going quiet with no milestones met.

How to track it: Token Unlocks and CryptoRank show vesting schedules and tokenomics. A large cliff unlock (>5% of supply at once) with no matching roadmap milestone is a red flag, and team wallets moving tokens to a CEX before any announced sale is visible on Etherscan or Arkham. And treat vesting that isn't enforced by a verifiable on-chain contract as no vesting at all – a claimed schedule with nothing actually locked on-chain is only a promise. :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s2 label="Check yourself" correct=0 explanation="Correct. Order of operations is the tell: in a soft rug the team wallets sell off weeks ahead of any announcement; an honest project flags difficulties first and liquidates later. Price falling and a quiet Discord happen in both cases."} Which objective on-chain signal separates a soft rug from an honest project failure?

  • The team sells its tokens BEFORE announcing trouble
  • Token price drops 80–90% from its peak within a month, with no recovery
  • Community engagement collapses: Discord goes quiet and the blog stops updating
  • The team's vesting tokens unlock on schedule and they sell over the following weeks :::

:::section{mins=5} Anatomy: How a Rug Pull Works :::

:::lead November 2021: an anonymous developer launches a token with a hit show's logo. Over a few days the price runs from a fraction of a cent to thousands of dollars. An hour later – zero. Every rug pull follows a clear anatomy, and once you know the stages you can spot the attack long before the finale. :::

:::p The process is almost always the same seven steps, and each one is engineered to look like a reason to trust: :::

:::howto{label="The seven stages"}

  • 1. Creation – fork a standard DEX contract, mint a token in minutes; you see "a promising new project."
  • 2. Liquidity – add ~$5K of TOKEN/ETH; you see "it's trading on Uniswap."
  • 3. Marketing – buy bots and pay influencers; you see "everyone's talking about it."
  • 4. Pump – wash trading fakes the volume; you see "price 10x in a day."
  • 5. FOMO – real buyers pile in, thinking "I'll still make it."
  • 6. Rug – the creator removes LP or triggers a drain; you see "TX failed... no liquidity."
  • 7. Disappearance – Telegram, Twitter, and the site go dark; you're left asking "where is everyone?" :::

:::p How long it takes scales with ambition: a fast memecoin can run the whole arc in 2–4 hours, an EVM token in 1–7 days, and an elaborate scheme with a polished site, whitepaper, and fake "partnerships" in 1–6 months. The bigger the production, the larger the haul. Underneath it all is one constant – information asymmetry. The creator knows the project is hollow; you see only manufactured signals, each stacked to push your trust one notch higher. :::

:::callout A con artist's stall at a city fair. The night before opening, a crew rolls up with a flashy banner, sets out goods, cranks the music. By morning there is a line, but half the "customers" are plants, loudly raving and grabbing merchandise. Real visitors see the frenzy and reach for their wallets too. By noon the register is full. By evening the stall is gone and the seller is in another town with the cash. Next morning there is only trampled grass and a few receipts on the ground, and the organizers shrug: "we didn't vet the vendors." :::

:::keypoints{label="Key Points"}

  • Marketing spend roughly sets the rug's scale: $500 on bots tends to mean a $10K–$50K rug, $50K on a major influencer a $500K–$5M one. The hype budget is a decent predictor of how big the trap is.
  • Wash trading costs only gas: the creator trades with themselves across 20–50 wallets, so DexScreener shows "hundreds of unique traders in an hour." Bubblemaps exposes the cluster – if most of the supply sits in a handful of linked addresses, the volume is theater.
  • html: Fake audits are a real stage in elaborate rugs: scammers forge a CertiK/Hacken PDF or pay a small firm for a rubber stamp. Always verify an audit on the auditor's own site, not via the project's link – the audit topic in depth is 4.2 §1.
  • Lifetime tells you which playbook you're in: 2–4 hours points to a pump.fun memecoin, 1–7 days to an EVM token, and 1–6 months to a staged scheme with a fake team. The slower it moves, the more convincing – and expensive – the legend. :::

:::details{badge=Advanced title="When a “hack” is really an insider rug"} Some of the most advanced rugs disguise themselves as hacks. Merlin DEX (April 2023, ~$1.8M) was a zkSync project that passed a CertiK audit, launched, gathered TVL – and was "hacked" two days later. ZachXBT's investigation traced the funds to wallets linked to the dev team: the "hack" was a pre-planned drain through an admin function that the audit scope never covered.

Compounder Finance (December 2020, ~$10.8M), a Harvest Finance fork, announced it had been "hacked via flash loan." The reality: a single person held the admin key and triggered the drain manually through a privileged function; the flash loan was a cover story.

How to tell them apart: an insider rug sends funds to fresh addresses and into a mixer fast, the team disappears, and the abused function was pre-mined and undocumented. A real hack usually shows a published post-mortem, cooperation with auditors, fund flow toward addresses with prior exploit history, and sometimes compensation (Euler was repaid 100%, Wormhole 100% via Jump). rekt.news is the reference for these post-mortems. :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s3 label="Check yourself" correct=3 explanation="Correct. On DexScreener it looks like hundreds of “unique traders,” but it's one person moving funds between linked wallets. Bubblemaps exposes the cluster, which is why distribution analysis beats raw volume."} During the "pump" stage, what is wash trading?

  • Genuine buys from thousands of users who discovered the token through organic marketing
  • Locking the project's LP tokens through a third-party service like Unicrypt
  • Hiring a third-party firm to audit the smart contract before launch
  • The creator trading with themselves across their own wallets to fake volume :::

:::section{mins=5} Red Flags: Spotting It Before You Lose Money :::

:::lead The token launched yesterday, the project has no GitHub, the team is anonymous, and the Telegram is wall-to-wall "to the moon." How many red flags did you count? Three or more, and it is almost certainly a scam. Reading these signals is your first line of defense. :::

:::p{html} The two most critical flags are technical, and either one alone can take everything: an unlocked LP (the creator can pull liquidity whenever they like) and a mint function (the creator can print unlimited tokens). Right behind them sit an anonymous team with no public names and no audit, or an "audit" from a firm nobody has heard of. Legitimate projects deliberately remove these flags – they lock LP, publish real audits, and disclose who they are. :::

:::p The medium-severity signs are about pattern, not a single tell: :::

:::howto{label="Medium-severity signs"}

  • Token concentration – more than ~20% sitting in one wallet.
  • Closed source – no public repository, nothing to read.
  • Unrealistic promises – "1000x guaranteed," "no risk."
  • Paid promotion – a wall of identical influencer shilling.
  • A brand-new contract – under a week old, under 100 transactions. :::

:::p Any one of these alone is not a verdict; the combination almost always is. :::

:::p{html} You don't have to judge by eye. Token Sniffer scores a contract automatically, Honeypot.is checks whether the token can be sold, Bubblemaps shows how the supply is distributed, and GoPlusLabs exposes risks through an API wired into several wallets and aggregators. Reading the contract yourself on a block explorer – covered in depth in 3.4 §1 – is the final check: who is the owner, and can they call mint() or setFee(99%)? :::

:::callout Red flags in crypto work like medical symptoms. A single headache – drink some water, rest, probably nothing. But add arm numbness and blurred vision, and you don't wait until morning, you call an ambulance. A doctor doesn't diagnose from one symptom, yet three together paint a clear picture. Same here: an anonymous team alone isn't a death sentence – legitimate anonymous projects exist. But anonymous team plus unlocked LP plus a mint function isn't "caution" anymore, it's a diagnosis. And there's only one treatment: don't buy. :::

:::keypoints{label="Key Points"}

  • Token Sniffer and Honeypot.is together catch the bulk of hard rugs on EVM in seconds, but neither works on Solana; there, RugCheck.xyz checks mint authority, freeze authority, and top holders in one report.
  • "LP locked" is not safety by itself: Team.Finance and Unicrypt show the percentage and the term, but 50% locked for 30 days is nearly worthless. Trust starts around 90%+ of LP locked for 6+ months.
  • Fake LinkedIn profiles and GitHub commits are a real tactic: scammers use stolen photos and fork active repos to fake dev activity. Check the contribution history and the account creation date, not just that a profile exists.
  • GoPlusLabs is wired into MetaMask Snaps and several aggregators, so a high-risk token can trigger a warning right in the wallet interface – defense you get without running a separate check. :::

:::details{badge=Advanced title="Verifying LP locks and reading a contract for dangerous functions"} :::p{html} If a creator says "LP locked," that is not enough on its own. Check three things:

  • which service holds the lock – Unicrypt, Team.Finance and PinkSale are the reliable ones;
  • for how long – 3 months is suspiciously short, a year is better;
  • what percentage is locked – 50% locked means the other 50% can leave at any time.
DexScreener and GoPlusLabs show lock status in real time. :::

:::p{html} Then read the contract on a block explorer – Contract tab, Read section, walked through in 3.4 §1. The key questions: who is the owner(), and are there mint(), setFee(), blacklist(), or pause() functions an owner could call? An unverified contract is itself a critical red flag. :::

:::p{html} "Renounced ownership" can be an illusion. The contract may hold a hidden admin via a backdoor unrelated to the owner; with a proxy pattern (see 3.2 §1) the proxy admin can be separate from the owner; or ownership may have been renounced before the dangerous wiring was added. Solidus Labs lists 'fake ownership renunciation' as a technique in its own right – the renounce is shown publicly while sensitive functions stay callable. The nastiest version is a hidden mint disguised as a burn: in a case dissected by de.fi, the $K3PV token's 'burn' function credited the creator with 99.9M tokens while emitting no Transfer from the zero address and never updating totalSupply, so the mint was invisible in block explorers and in on-chain tools like Bloxy before the tokens were simply swapped for ETH on Uniswap. If the contract uses delegatecall or an upgrade pattern, even a renounced owner doesn't stop the logic from being swapped through an implementation update. ::: :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s4 label="Check yourself" correct=1 explanation="Correct. An unlocked LP lets the creator pull liquidity at any moment, and an uncapped mint lets them print unlimited supply and dump – both lead straight to zero. The others are real warnings but rated High or Medium."} Which two red flags are rated Critical (not merely High)?

  • Anonymous team and no GitHub
  • Unlocked LP and a mint function
  • New contract and paid promotion
  • Token concentration and unrealistic promises :::

:::section{mins=6} Memecoins and pump.fun :::

:::lead Someone creates a token for $2, three days later its market cap is in the millions, and a day after that it is zero. That is not an anomaly; it is an ordinary Tuesday on pump.fun, a platform that lets anyone launch a token in two minutes and where the overwhelming majority go to zero. :::

:::p{html} pump.fun on Solana (see 2.3 §1) stripped memecoin creation down to a couple of dollars and a couple of minutes. It runs on a bonding curve: the price rises automatically with each buy, and the creator never controls the liquidity; the protocol does. When market cap reaches about $69K the token "graduates" to a full DEX (Raydium until late March 2025, then pump.fun's own PumpSwap). On graduation PumpSwap burns the pair's LP tokens, so liquidity can't be pulled by hand. This removes the classic LP rug, though not dev allocation, bundled launches, or coordinated pump-and-dumps. :::

:::p The statistics are sobering. By early 2025 pump.fun was minting over 600,000 tokens a month (~20,000 a day), and only about 1–1.5% ever graduated to a DEX (a rate that fell to roughly 0.7–0.8% by mid-2025). Most go to zero within hours, and per Dune only about 3% of token creators ever cleared more than $1,000 in profit (2024). This isn't investing; it's gambling. The exceptions (BONK, WIF, PEPE) reached multi-billion-dollar valuations, but all three predate pump.fun and launched elsewhere; they illustrate the market's dynamic, not a repeatable plan. :::

:::p The memecoin market runs on its own logic: no fundamentals, no revenue, no product-market fit. Value is pure attention and virality. A token with a funny name can 100x in a day and zero the next. Here, information and reaction speed matter more than any analysis, which is why the people who profit consistently tend to be insiders or run sniper bots. Everyone arriving later is the exit liquidity they sell into. :::

:::callout Memecoins are like a carnival shooting gallery with oversized prizes in the case. A life-size stuffed bear hangs front and center, and the owner happily shows a photo of last week's winner – "see, somebody won!" A shot costs next to nothing, so you think, "why not." But the sights are bent, the targets a little smaller than they look, and the rules are in fine print. After ten shots you've spent more than the bear is worth. The ones who win are the owner or his friends shooting from behind the counter. And the winner's photo? It's real – one in ten thousand losers. :::

:::keypoints{label="Key Points"}

  • The bonding curve removes the LP rug but opens a new vector – the bundled launch: the creator buys a big chunk of supply in the first transactions at the lowest curve price, then sells into FOMO buyers. RugCheck.xyz detects bundled buys.
  • Per Dune (2024–2025): at peak pump.fun minted ~20,000 tokens a day, and only ~1–1.5% reached a DEX (later ~0.7–0.8%). Only a fraction of a percent of graduated tokens ever reach and hold a million-dollar cap for more than a few days.
  • The rug profile differs by chain: an EVM rug needs seed liquidity ($1K–$10K) and runs $50K–$500K over 3–14 days; a pump.fun one needs no seed and runs $1K–$20K in 2–4 hours. For the victim the risk-to-reward is roughly the same either way.
  • Sniper bots profit off other buyers, not the meme: a bot buys in the first block and resells to a FOMO buyer minutes later at a huge markup. They make up a noticeable share of the earliest transactions, which is part of why "being early" rarely means being first. :::

:::details{badge=Advanced title="Dev allocation, bundled launch, and sniper bots"} :::p{html} Memecoin scams use patterns that classic rugs don't:

  • Dev allocation – the creator spreads 20–50% of supply across dozens of their own wallets and dumps it all at the peak.
  • Bundled launch – via a bundler the creator buys across 16–25 of their own wallets in one launch-block transaction (it shows up as a single green candle at listing), so the large position is not flagged as an 'insider' holding.
  • Sniper bots – they catch the token-creation transaction within milliseconds and take the bottom of the curve before any human, then resell to FOMO buyers: by the time you see the tweet, the bot is already in.
  • Coordinated pump-and-dump – private Telegram groups where insiders 'signal,' members buy in unison, and organizers sell into the frenzy.
:::

The bonding curve helps with one of these – it makes the LP rug impossible because liquidity is managed automatically. It does nothing about dev allocation, so the practical defense is the same as everywhere else in this card: run Bubblemaps on the distribution before you buy, and if one cluster of addresses holds a disproportionate share, treat it as a stop sign. :::

:::details{badge=Advanced title="Game theory: why “I’m early” is the most dangerous thought"} The buyers form a ladder. At the very top sit the creators and insiders, who get in within the first few blocks and hold enormous paper gains. One rung down come the sniper bots, filling the next few dozen blocks. Below them sit the early FOMO buyers of the first hour, and beneath those the mid buyers who roughly break even. On the bottom rung stands the large majority, who arrive after day one and end up deeply underwater. The Dune data fits this shape: only about 3% of participants come out meaningfully ahead, and most of those are running bots or trading on information you don't have.

So the phrase "I'm early" is usually false. If you heard about a token on Twitter or Telegram, the insiders, the bots, and the early FOMO crowd have already bought – you are the exit liquidity they sell into. Three biases keep the wheel turning: survivorship (you see BONK and WIF, not the millions that zeroed), availability (1000x stories stick, −100% stories don't), and the gambler's fallacy ("after five losses, the sixth is surely a winner"). Recognizing that you are almost never actually early is the single most protective thought on this market. :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s5 label="Check yourself" correct=1 explanation="Correct. The creator never holds the LP, and PumpSwap burns the pair's LP tokens on graduation. That doesn't make the memecoin safe, though – dev allocation, bundled launches, and coordinated pump-and-dumps all remain."} Why does pump.fun's bonding curve remove the classic LP rug?

  • The platform maintains an insurance fund that compensates victims if a token goes to zero
  • The protocol controls liquidity, and after graduation PumpSwap burns the LP tokens, so they can't be pulled by hand
  • The creator must pass KYC verification through the platform before launching a token
  • The bonding curve enforces a 24-hour cooldown before any token holder can sell :::

:::section{mins=5} How to Protect Yourself :::

:::lead You've now seen the seven stages, the honeypots, and the red flags. Theory without practice is useless – so turn it into a habit. Five checks before every buy, and discipline will protect you better than any luck. :::

:::p The routine is short. Run the contract through Token Sniffer and Honeypot.is to surface dangerous functions and confirm the token can be sold. Check the LP – is it locked, for how long, what percentage. Look at the team – doxxed, with a track record, or anonymous. Check distribution on Bubblemaps – if more than half the supply sits in five wallets, stop. And find the audit – published, by a firm you can verify. Each step takes a couple of minutes; the whole thing is under half an hour, and those thirty minutes can save you thousands. :::

:::p The harder half is psychological. Don't chase FOMO: if a token has "already done 10x," you are likely the exit liquidity for someone who got there first. Size positions so a total loss is survivable – a memecoin should be 1–5% of a portfolio, not 20%. Set a mental stop-loss before you buy: "I'm ready to lose $X and not a cent more." Emotions are the real enemy; when you see "100x in a day," logic switches off, and that is exactly the moment scammers are paid. :::

:::p{html} Match the tools to the chain. Rabby (see 3.1 §1 and 3.2 §1) flags risky contracts as you sign. For Solana memecoins, RugCheck.xyz and Birdeye specialize in token analysis; on Ethereum and other EVM chains, DexScreener and DEXTools cover pairs and liquidity. None of them removes the need to think – they just make the thinking faster. :::

:::callout Checking a token before buying is like a pilot's pre-flight checklist. Before every takeoff a pilot runs the list: fuel, instruments, control surfaces, radio, tire pressure. Even after a thousand flights, the list is mandatory – because memory fails and the cost of error is lives. You don't take off until every item is ticked. A pilot who skips the checklist because "we're running late" isn't brave, just reckless. In crypto your checklist is the contract, the LP, the team, the distribution, the audit. Five items, half an hour – and you either take off confidently or stay on the ground with your wallet intact. :::

:::keypoints{label="Key Points"}

  • Token Sniffer plus Honeypot.is cover the bulk of EVM hard rugs in seconds, but not Solana; there, RugCheck.xyz checks mint authority, freeze authority, and top holders in a single report.
  • A lock is only as good as its terms: 90%+ of LP locked for 6+ months through a reputable service is meaningful; 50% for 30 days is theater. Always read the percentage and the duration, never just the word "locked."
  • Position sizing saves you at any skill level: on a $10K portfolio a $100 memecoin (1%) loses you 1% if it zeroes – bearable. A $2K position (20%) changes your behavior and triggers tilt. The number you choose matters more than the token you pick.
  • A rule of thumb from ZachXBT: when several large accounts post about a token at once, all without an "#ad" disclosure, it's very likely a coordinated promo. Influencers often take 1–5% of funds raised and exit before the dump. :::

:::details{badge=Advanced title="Step-by-step due diligence, and how much to risk"} :::p{html} A full check is seven steps you can run in order:

  • DexScreener – chart, volume, liquidity, holder count.
  • Token Sniffer – contract analysis and risk score.
  • Bubblemaps – holder distribution and clusters.
  • Etherscan / Solscan (see 3.4 §1) – is the contract verified, which owner functions exist.
  • Twitter / Telegram – real community or identical bot praise.
  • GitHub – does code exist and is it actually being developed.
  • Audit – published, by whom, with what findings.
It takes 15–30 minutes at first; with practice the obvious scams fall out at step one or two. :::

On sizing, the Kelly criterion is blunt but honest: optimal bet = (edge × odds − 1) / (odds − 1). For the average participant on memecoins the edge is roughly zero, which makes the optimal bet roughly zero too – the expected value is negative. The only real edges are information (insider knowledge), speed (bots), or luck. If you have neither of the first two, you are relying on the third, and that is the definition of gambling. The practical version: set a fixed "gambling budget" you can lose without flinching, and never exceed it. :::

:::further{label="Further Reading"}

:::quiz{id=q-4-3-s6 label="Check yourself" correct=2 explanation="Correct. “Locked” alone says nothing. Trust starts around 90%+ of LP locked for 6+ months through a reputable service (Unicrypt, Team.Finance); a partial or short lock is theater, and locking says nothing about a mint function."} A creator says "LP locked." What does that tell you on its own?

  • The token is safe from LP withdrawal because the creator no longer controls the pool
  • The contract has been audited and the audit firm confirmed no critical vulnerabilities
  • Not enough – you still need the percentage and the duration; 50% locked for 30 days is nearly worthless
  • The mint function has been disabled, so the creator cannot inflate the token supply :::