What Is a Rug Pull?

The AnubisDAO token sale opened on 28 October 2021 with very little behind it. There was no website, only a Discord server and a Twitter account, and the project was a dog-themed copy of an existing DeFi protocol called OlympusDAO, named after the Egyptian god Anubis. Buyers still put in more than 13,000 ether, worth roughly $57m to $59m at the time, through a liquidity bootstrapping sale on a platform called Copper.

About 20 hours into the sale, the pool's ether moved to a different address. Buyers had been due to receive the project's ANKH tokens once the sale closed, and the money left before that could happen. The Twitter account linked to the transfer, run by a pseudonymous figure called Beerus, was deleted soon afterwards. Beerus later claimed that opening a malicious link in a PDF had exposed the private keys.

That is a rug pull in its plainest form. The people behind a token or project collect buyers' money, then take it and vanish, leaving holders with something nobody will buy. This is an educational guide, not financial advice.

Four ways the rug gets pulled

The mechanics differ, and knowing which one you are looking at tells you what to check.

• Liquidity pulled. A new token usually trades against ether or a stablecoin in a pool on a decentralised exchange. Whoever funded that pool holds LP tokens, which act as a claim on it, and redeeming them takes both sides back out. If the team holds those LP tokens, it can withdraw the ether in a single transaction and leave a token with nothing left to trade against.

• Honeypot or hidden mint. The contract lets anyone buy but quietly blocks selling, or hides a function that lets the owner mint fresh supply and dump it on the market.

• Insider dump. Wallets tied to the team hold a big slice of the supply and sell into the first wave of buyers. No special code is needed, which makes it hard to tell apart from ordinary early selling.

• Soft rug. Nothing dramatic happens on any single day: updates slow down, the Discord goes quiet and the team's wallets drain over months until the project is a ghost.

Frosties: the NFT version

Tokens are not the only target, and an NFT collection can be emptied the same way, with the creators walking off with the mint money. Frosties was a collection of 8,888 ice-cream-themed NFTs that sold out in January 2022 at 0.04 ETH each, about $112 at the time of minting.

On 9 January 2022, prosecutors say, the two creators abandoned the project within hours of the sell-out, took the website down and moved about $1.1m in crypto to wallets they controlled. Federal prosecutors in New York announced charges against the pair on 24 March 2022. Both were charged with conspiracy to commit wire fraud and conspiracy to commit money laundering.

Prosecutors also said the pair had a second collection, Embers, lined up for around 26 March, which was expected to bring in about $1.5m. Decrypt reported it as the first known case of the Department of Justice charging NFT creators with conspiracy to defraud buyers.

A criminal complaint is an accusation rather than a conviction, and the account above is what prosecutors alleged when they brought the case. Court records show that one of the two later pleaded guilty to a single conspiracy count and was sentenced in June 2025 to a year of probation.

How big the problem got

In figures published in December 2021, Chainalysis estimated that rug pulls had taken more than $2.8bn from victims that year. That was 37% of all crypto scam revenue for the year, against just 1% in 2020.

The headline number carries a large asterisk, because nearly 90% of it, more than $2bn, came from a single case, the collapse of the Thodex exchange. For the smaller cases, Chainalysis pointed to a structural gap: most decentralised exchanges let anyone list a token without a code audit.

What a block explorer can show you

Most of the warning signs sit in public view on a block explorer such as Etherscan, and four checks cover the bulk of them.

Is the code verified? A verified contract has its source code published and matched against what is actually deployed. An unverified one means trusting bytecode that nobody outside the team has read.

Who owns it? Many tokens give an owner account special powers, such as minting, pausing trading, blacklisting addresses or changing fees. Renounced ownership means that owner has handed the role to nobody. In the widely used OpenZeppelin template, the contract is then left without an owner and owner-only functions can never be called again.

Is the liquidity locked? Locked liquidity means the LP tokens have been placed in a time-lock contract until a set date, or sent to an address nobody controls, which is usually called burning them. Liquidity the team can still withdraw is exactly what makes the first kind of rug pull possible.

Who holds the supply? The holders tab lists the largest wallets, and if a handful of addresses, other than pools and known exchange wallets, hold most of the tokens, those wallets can sell into everybody else.

Where the checks run out

Every one of those checks lowers the odds, but none removes the risk, and each has a known way round it. Liquidity locks expire, and when the date passes, the team can withdraw the liquidity again. Renounced ownership covers only the functions tied to that one owner role, so a contract can still hold other admin roles or sit behind an upgradeable proxy whose code can be replaced. A clean contract cannot stop insiders selling slowly either, and it has nothing to say about a team that stops turning up.

In both AnubisDAO and Frosties, the organisers could reach the money by design: AnubisDAO's sale pool ran on the project's own keys, and Frosties paid its mint proceeds to the creators. Reading the contracts would have told buyers mostly what they already knew.

So the questions that would have helped were about the people. Who are they, what have they shipped before, and why does a project with no website need this much money this fast? Plenty of crypto teams are pseudonymous, and that proves nothing by itself. A pseudonymous team in a hurry, holding the keys to everyone's money, is another matter.