Anatomy of a Rug Pull
A deep-dive into how crypto rug pulls are engineered — from token contract design to liquidity manipulation, fake audits, and the psychology of exit timing. Understanding the mechanics that have stolen billions from retail investors.
A rug pull is a type of crypto exit scam in which developers of a project — most commonly a token or DeFi protocol — suddenly drain liquidity, sell their holdings, and disappear, leaving investors with worthless assets.
The term comes from the idiom "pulling the rug out from under someone." In crypto, it typically happens in one of three structural forms: a hard rug, a soft rug, or a slow rug. All three have stolen billions of dollars from retail investors since 2020.
The Three Types
Hard Rug
A hard rug is the fastest and most violent form. The developers build a malicious function directly into the smart contract — typically a hidden withdraw or mint function — that lets them drain all liquidity in a single transaction.
The sequence:
- Token launches, builds hype, price rises
- Developers send a single transaction calling the hidden function
- All LP (liquidity pool) funds transfer to dev wallet in seconds
- Token price drops 100% instantly — there is literally no liquidity left to sell into
- Dev converts to stablecoins or bridges to another chain
Time from launch to rug: As short as 20 minutes. Some hard rugs have occurred within the same block as the token's first trade.
Soft Rug
A soft rug is technically legal — or at least harder to prosecute. The developers hold a large percentage of the token supply and sell it gradually or all at once once the price has risen sufficiently.
No contract exploit is needed — the dev simply sells their tokens on the open market. Because they hold a massive amount, their selling pressure crashes the price to near zero.
Why it's harder to prevent: There is no "exploit" — the developer is just selling tokens they legitimately hold. The problem is the undisclosed concentration of holdings.
Detection: Check token distribution before buying. If the top 5 wallets hold >40% of supply and one of them is the deployer, treat it as a red flag.
Slow Rug
The most sophisticated form. Developers build a real-looking project, generate community trust over weeks or months, and drain value gradually:
- Taking developer "salaries" that are disproportionately large
- Running paid partnerships and marketing that never materializes
- Selling tokens slowly to avoid triggering panic
- Abandoning development quietly while maintaining social media presence
Slow rugs can take 6–18 months. By the time the community realizes, the developers have extracted millions.
The Fake Audit
A critical component of most modern rug pulls is the fake audit. After a wave of exploits made investors wary of unaudited contracts, a cottage industry emerged: audit firms willing to approve nearly anything for a fee.
Red flags in audits:
- Audit firm has no verifiable history, LinkedIn presence, or previous audits
- Audit was completed in under 48 hours (real audits take 1–4 weeks)
- The audit report contains no specific code references
- The firm's website was registered within the last 90 days
Legitimate audit firms: CertiK, Trail of Bits, Consensys Diligence, OpenZeppelin. If you've never heard of the firm, check their audit history before trusting the badge.
The Psychology of Timing
Rug pulls are not random. Developers study markets and time their exits strategically:
Peak FOMO moment. The best rug exits happen when retail FOMO is highest — typically when a coin has just made a new all-time high and social media buzz is peaking. Retail buyers are entering fastest, giving developers maximum exit liquidity.
Weekend/holiday timing. Exchanges, regulators, and most investigative journalists are less active on weekends. By Monday morning, the developer is three chains removed from the stolen funds.
After a major announcement. Some developers manufacture "catalysts" — a fake partnership announcement, a celebrity tweet — specifically to generate a final pump they can sell into.
On-Chain Red Flags
Before buying any new token, check these on-chain signals:
| Signal | Tool | What to Look For |
|---|---|---|
| Token distribution | Etherscan / Solscan | Top 10 wallets < 30% |
| Liquidity lock | TechRate / Mudra | LP tokens locked ≥ 6 months |
| Contract verified | Block explorer | Source code readable |
| Mint authority | Block explorer | Mint disabled or renounced |
| Dev wallet | Block explorer | Not holding >5% |
Notable Rug Pulls
Squid Game Token (2021) — $3.38M stolen. Built a buy-only contract that prevented selling. When they pulled, price crashed from $2,861 to $0.0007 in minutes.
Evolved Apes (2021) — $2.7M. NFT project. Developer disappeared with the mint proceeds before delivering any content.
Frosties NFT (2022) — $1.1M. Developers were arrested, convicted, and sentenced — one of the first criminal prosecutions of an NFT rug pull in the US.
Anubis DAO (2021) — $60M. Raised funds, developer drained the entire treasury 20 hours after launch.
If You Get Rugged
- Screenshot everything — transaction history, website, social media
- Report to the FBI's IC3 (ic3.gov) and the FTC
- Document on-chain — post the dev wallet address publicly
- Join or form a victims' group — coordinated reports carry more weight
- Consult a lawyer if the amount is significant — some rug pulls have resulted in criminal charges
The blockchain is permanent. Stolen funds leave a trail. More developers are being prosecuted each year.
Revision history(2)
| # | Edit summary | Editor | Date | $WIKO |
|---|---|---|---|---|
| 2 | Image fix | WiKobia...17SRV | 3w ago | 1.0K $WIKO |
| 1 | Initial creation | WiKo9rK...WiTdC | 3w ago | 100.0K $WIKO |