What exactly is a rug pull?
A rug pull (literally "pulling the rug out from under someone") is a type of scam where the people who created or control a token suddenly remove its value and render it worthless for everyone else.
The point isn't that the price falls. Prices fall all the time. A rug pull is a specific mechanism: value disappears from the project because of an action taken by its creators, and they were only able to take it because they had permissions or access that others didn't.
An important note right at the start: in this text we describe patterns of behavior. Charliedesk will not label any specific project a scam until a regulator or court says so. The difference between "this looks suspicious" and "this is a proven scam" is the whole point of this section.
How does a rug pull happen technically?
There are two main types, and it's worth not confusing them.
1. Liquidity pull. For a token to be tradeable at all on a decentralized exchange (a DEX, such as Uniswap), someone has to deposit a pair into a so-called pool: the token itself plus something valuable, like ETH or a stablecoin. This pair is the liquidity. Whoever holds the so-called LP tokens (proof of deposited liquidity) can withdraw the liquidity again. When the creators withdraw it, the valuable part (ETH/stablecoin) disappears from the pool and only the token itself remains, with nothing left to trade it against. The price on the chart effectively drops to zero within a single transaction.
2. Fraud in the contract itself (hard rug). The token's smart contract contains functions that give the creator extraordinary power: the ability to mint unlimited amounts of tokens, to block selling by others (a so-called honeypot, where you can buy but not sell), or to change fees to levels that effectively make selling impossible.
The difference from what's called a "soft rug" or a slow abandonment of a project is that the creators simply stop working and the token slowly fizzles out. That's bad, but technically it differs from a one-time drain.
What traces does it leave on the blockchain?
The main thing worth understanding: the blockchain is public and doesn't forget. The action that carries out a rug pull is a recorded transaction like any other.
Specifically, after the event itself you can find:
- The liquidity removal transaction (removing the pair from the pool), with a timestamp and the address that carried it out.
- The creator's (deployer's) address, meaning the wallet from which the contract was deployed, and where the funds may have flowed.
- The token's holding distribution before the event: what percentage was held by the first few addresses.
- Sales from these large addresses just before the price collapse.
The problem isn't that no trace exists. The problem is that after a transfer through a mixer or through a chain of wallets, the trace isn't broken, but attributing it to a specific person becomes harder. The blockchain will show you that value flowed to address 0x...; it can't tell you on its own who controls that address. That's the line between on-chain evidence and identifying the perpetrator.
Which signals can you verify in two minutes, before anything happens?
This is the preventive part, not post-collapse diagnosis. None of these points on its own means a scam, and conversely their absence doesn't guarantee safety. They are indicators, not verdicts.
| What to check | What you're looking for | Why it matters |
|---|---|---|
| Holding concentration | What % of tokens the top 10 addresses hold | When a few addresses hold a large majority, they have the power to move the price or empty the pool |
| Liquidity lock | Whether the LP tokens are locked or burned | If the creator can withdraw liquidity at any time, a drain is technically possible |
| Contract permissions | Whether there's a mint function, a sell pause, or changeable fees | These functions give one party extraordinary power |
| Contract ownership | Whether the contract is "renounced" (ownership given up) or someone controls it | A controlling address can change the rules on the fly |
| Code verification | Whether the source code is publicly verified | Unverified code can't be checked, only trusted |
A practical example of how to read this: say you see that for a token, one address (outside the liquidity pool itself and exchanges) holds 60% of the supply and the liquidity isn't locked in any way. That doesn't tell you it's a scam. It tells you that a single party has the technical ability to control both the price and the pool, and that any decision you make should take that possibility into account. That's the difference between "this is a scam" (a verdict we won't allow ourselves) and "here's a specific risk that's visible in the data" (a description).
Tools that show this data exist (block explorers as public blockchain viewers and various automated contract scanners). Charliedesk neither recommends any of them nor guarantees their accuracy; an automated scan can be wrong in both directions.
Why can't you tell for sure in advance that it's a rug pull?
Because most risky features also have legitimate uses.
A mint function can serve planned, transparent issuance. Unlocked liquidity can mean the team is just about to set up a lock. High concentration can be expected in a brand-new project. On-chain data shows you the ability to do something, not the intent to do it. And intent is exactly what distinguishes a scam from a risky but honest project.
That's why the claim "this is a rug pull" before the event itself is always an estimate, not a fact. It becomes a fact only at the moment the drain is recorded on the blockchain, and a scam in the legal sense only when the relevant authority states so.
What you should now be able to do, and what remains uncertain
After reading, you should be able to:
- Distinguish a price drop from a rug pull (the mechanism of creators removing value).
- Distinguish a liquidity drain from fraud built directly into the contract.
- In a few minutes, look at holding concentration, liquidity status, and contract permissions in the data.
- Articulate what the data proves (ability) and what it doesn't prove (intent and identity).
What remains uncertain even with perfect data:
- Who is behind a specific address, until an investigation links it to a real person.
- Whether the controlling party will actually abuse its power.
- Whether a specific project is a scam in the legal sense; that's not for a journalist, but for a regulator or a court.
This is part of the "Don't Get Fooled" series in charliedesk Classroom. We describe the mechanics and the data. We don't tell you what to buy or what to sell.