Rug Pull Red Flags: A Visual Checklist for 2026
Rug pulls cost retail traders billions every year. A 12-point checklist for spotting them before you buy — covering contract, liquidity, holder concentration, and social signals.
A rug pull is the simplest crypto scam: launch a token, attract buyers, drain the liquidity pool, leave holders with worthless tokens. The mechanics are straightforward; the prevention is straightforward; the losses continue because retail traders don't do the 60-second check before buying.
This is the checklist. Twelve red flags, each addressing a specific vulnerability. Run through it before any low-cap or new token purchase. Any token failing three or more should be skipped — and most fail more than three.
Contract-level red flags
1. Unverified contract on the explorer
The contract source code should be verified on Solscan, Etherscan, or the chain's equivalent. Unverified contracts can contain hidden functions — including the ability to mint unlimited supply or revoke holder permissions. Always check verification first.
2. Mint authority not revoked
On Solana SPL tokens, the "mint authority" controls supply expansion. If not revoked, the creator can mint arbitrary new supply at any time, diluting holders to zero. Token sniffer tools like RugCheck (rugcheck.xyz) verify this in seconds.
3. Freeze authority not revoked
Solana also has a "freeze authority" that can freeze any holder's tokens, preventing them from selling. If not revoked, the creator can selectively freeze sellers during a rug pull, leaving them unable to exit.
4. Suspicious functions in the contract
On EVM chains, watch for functions like `pause()`, `setMaxTxAmount()`, `excludeFromFees()`, `manualSwap()`. Each can be used to selectively trap sellers or extract liquidity. Tools like Token Sniffer flag these automatically.
Liquidity red flags
5. Liquidity not locked
The token's liquidity pool tokens should be locked (typically with services like Team.Finance or Unicrypt for EVM, or burned to a dead address for Solana). Unlocked liquidity = rug-pull-ready. Lock duration should be at least 6 months; permanent burn is better.
6. Liquidity pool too small relative to FDV
If a token has a $50M fully-diluted valuation but only $200k in liquidity pool, the pool can be drained for far less than the FDV suggests. Healthy ratio: at least 5-10% of FDV in pool liquidity.
7. Liquidity providers concentrated to one wallet
If 80%+ of LP tokens are held by the deployer wallet, that wallet has unilateral rug-pull capability. Healthy: diversified LP holders, ideally with team allocations locked.
Holder distribution red flags
8. Top 10 wallets hold more than 50%
Token sniffers show top-holder distribution. If the top 10 wallets hold more than 50% of supply (excluding LP, burn addresses, and known DEX wallets), price discovery is fragile — any of those wallets can crash price by selling.
9. Insider addresses with day-0 acquisition
Wallets that received tokens in the very first block of trading and have not moved them are often insiders. If they sell later, they're distributing into your buy. If they're also LP providers, they can withdraw liquidity simultaneously.
Social and team red flags
10. No verified team identities
Doxxed team members (verified identities) create accountability. Anonymous teams aren't automatically scammers — but they have nothing to lose if they rug. Treat anonymous teams as elevated risk and size accordingly.
11. Discord/Telegram drowning in bot accounts
Most active community channels of legitimate projects show diverse organic conversation. Manufactured projects show bot-heavy "🚀 LFG WAGMI" patterns. Watch unique message authors per hour — anything below 10% of total messages is suspect.
12. Sudden Twitter influencer pumping
When multiple mid-tier crypto influencers post about the same token within a 24-hour window, it's almost always paid promotion ahead of distribution. Real grassroots takeoffs build organically over days/weeks.
The 60-second pre-trade routine
- Go to RugCheck.xyz (Solana) or Token Sniffer (EVM).
- Paste the contract address.
- Read the risk report. Failing 3+ checks = skip the token entirely.
- Check liquidity lock status manually. Locked? For how long?
- Check top 10 holder concentration. Above 50% (excluding known LP/burn) = skip.
When all the checks pass
Even a fully-passing token can still rug-pull or pump-and-dump through other mechanisms (wash trading, coordinated distribution, smart-contract bugs). The checklist eliminates the most obvious rugs. It does not eliminate all risk.
Final defense: position sizing. Treat any memecoin or low-cap token as a 100%-loss-eligible position. Never size more than 0.5-1% of account. The expected return from these positions assumes total loss as the modal outcome.