Avoiding rug pulls

In this post, we’ll explain “rug pulls,” a common type of crypto scam targeting primarily retail investors.

A “rug pull,” derived from the expression “pulling the rug out” — suddenly taking away support, — is a type of crypto scam in which a project’s team pumps its token before disappearing with the funds received from retail investors.

According to a report from the blockchain risk monitoring firm Solidus Labs, 117,629 rug pulls occurred in 2022, a 41% increase over the previous year, a sign that this type of scam is on the rise and has the potential to thrive.

Meanwhile, not all kinds of rug pulls are technically illegal. Still, those that are classified as hard rug pulls can be pursued under the law.

Hard rug pulls: liquidity theft and scam tokens

Liquidity theft involves creating a liquidity pool within a scam project and luring users to add pairs of tokens to it by promising a triple-digit APY. A project of that kind also typically releases a new token that is heavily promoted. Thus, hoping for substantial passive income from the project, users add their tokens to the pool and receive LP tokens in exchange. Eventually, the team responsible for maintaining the pool withdraws the tokens and exits, abandoning investors with worthless LP tokens and no way to get their funds back.

Technical manipulation with a smart contract algorithm is another type of a hard rug pull, enabling stealing from investors in various ways. For example, the “approve” part of the code needed for the smart contract to spend a token within a transaction can be modified in a way that allows users only to buy the token. In this scheme, those who invested in the scam token of a hyped project on its rise are left with nothing after the developers disappear — the price of the token drops, and the holders cannot resell it. Also, worthless tokens can contain a 99% buy or sell fee, as well as other surprises.

Soft rug pulls: token dumping

A pump-and-dump scheme relies on artificially inflating a project’s value and dumping the team’s assets when the price is at its peak, instantly devaluing the tokens of tricked investors.

To facilitate a scheme of this kind, the team can hold on to a disproportionately large number of tokens since the project’s launch. How significantly the token price falls, depends on how many tokens the team throws onto the market at once. Technically, these actions are not illegal, but they are certainly unethical. Sometimes, when promoting a project, developers may even promise donations to charity, eventually failing to do that and simply cashing in on people buying up the token of a project that no one ever intended to develop.

Famous rug pull examples

Some rug pull schemes can mislead even risk experts. For example, when the price of the Flare project fell by more than 95%, opinions split on whether it was a rug pull or an exploit, the latter version promoted by the project’s team. Meanwhile, the fact that about $17 mln Flare tokens were received by addresses associated with the project’s developers was an argument in favor of a scam.

Day of Defeat also claimed to be hacked, with its value decreasing by more than 96%. All project assets worth over $1.35 mln were withdrawn to external wallets. Once the funds disappeared, the project claimed that third parties had compromised it.

Basically, these schemes follow more or less the same scenario, involving a project pumping up its price and then swapping its tokens for liquid assets and transferring them to external wallets. Usually, the project’s social media accounts and websites also end up being removed.

This is exactly what the DeFi project DRAC Network did in mid-2022, dropping the price of the TEDDY token by 99,4% and transferring $10,000 in BNB and $2 mln in BUSD to Binance. Quantitative trading company MGNR went the same way, draining a total of $52 mln in USDC to Coinbase and Genesis Trading, then deleting all of its tweets.

Sometimes, rug pulls combine multiple types of scam, as was the case with one of the most notable fraudulent projects in scam history, SQUID. The developers, who have not yet been identified, attracted many investors by offering a game based on the popular South Korean TV series Squid Game but not officially affiliated with it. Their SQUID token contained hidden modifications that blocked its resale. Therefore, none of the holders could get rid of their tokens after the development team withdrew all the liquidity from the project, which was worth about $3.3 mln.

How to detect a rug pull

Lack of audit: You should only join liquidity pools of projects that have been audited by a trustworthy security firm, no matter how quick and large returns the project promises.

Disproportionate distribution: The white paper, as one of the essential documents of any project, contains its token distribution program. If a large number of tokens is held by the project team, it’s a potential red flag. Block explorers like Etherscan allow users to check which wallets hold specific tokens. Block explorers also show the total supply and the number of transfers. If the number of wallets holding the tokens is small while the token’s value is skyrocketing, there is obviously some price manipulation happening. Ideally, there shouldn’t be more than 20% of the total new token amount in the top 10 wallets.

Absence of liquidity lock: If liquidity is locked in a project, no one can withdraw it instantly. When providing tokens to a pool, temporary locking implies a period that can vary and reach five years, but its complete absence is also a red flag.

How to detect a rug pull 

• Lack of audit: You should only join liquidity pools of projects that have been audited by a trustworthy security firm, no matter how quick and large returns the project promises.
• Disproportionate distribution: The white paper, as one of the essential documents of any project, contains its token distribution program. If a  large number of tokens is held by the project team, it’s a potential red flag. Block explorers like Etherscan allow users to check which wallets hold specific tokens. Block explorers also show the total supply and the number of transfers. If the number of wallets holding the tokens is small while the token’s value is skyrocketing, there is obviously some price manipulation happening. Ideally, there shouldn’t be more than 20% of the total new token amount in the top 10 wallets.
• Absence of liquidity lock: If liquidity is locked in a project, no one can withdraw it instantly. When providing tokens to a pool, temporary locking implies a period that can vary and reach five years, but its complete absence is also a red flag.

Using only reputable platforms can be a security guarantee for those who don’t want to dig into block explorers or white papers of new projects. The same applies to tokens. A hidden code function is unlikely to be visible to a non-expert user. Therefore, at the very least, it is worth it to make sure that you are dealing with tokens having transactions behind them. There is also an option of trading with some small token amount in a test mode or using online rug pull-detecting tools to analyze tokens and platform code.