How to spot a rug pull before you buy
Updated October 28, 2026
A rug pull is when the people behind a token take the money and leave holders with something they cannot sell for anything. It is the most common scam in memecoins. The good news is that most rugs leave traces on-chain before they happen, and you can check them in a couple of minutes. This guide explains how rugs work on Solana, which signals matter, in which order to check them and what to do if it already happened to you.
What a rug pull is, in plain words
The name comes from the expression "pulling the rug out from under someone". A token is created, gets attention, people buy it, and at some point the creators or a small group of insiders take out the value that buyers put in. The price collapses, often by more than 90% in a few minutes, and holders are left with tokens nobody wants.
On a regulated exchange this would be hard to do. On a decentralized exchange anyone can create a token and a trading pool in minutes, without identity checks, without audits and without anyone approving the listing. That freedom is what makes memecoins fast and fun, and it is also what makes rugs cheap to run. Thousands of new tokens appear on Solana every day, and a large share of them are designed to be sold to latecomers.
A rug pull is not the same as a token that simply goes down. Prices fall for many reasons: the hype ends, the market turns, early buyers take profit. What makes it a rug is that the people with control over the token use that control, or their huge share of the supply, to extract money from the other holders.
The four ways a rug happens
Almost every rug you will see falls into one of these patterns. Knowing them tells you exactly what to look for.
- Liquidity pull: the creator added the liquidity to the pool and still controls it. They withdraw it in one transaction, the pool is empty and there is nothing left to sell into. Your tokens still show in your wallet, but they cannot be converted back to SOL.
- Dump by large holders: one wallet, or a group of wallets controlled by the same person, holds a big share of the supply. They sell everything at once into the pool and the price crashes. This is the most common pattern on Solana memecoins, because the liquidity is often burned and cannot be pulled.
- Mint and dump: the mint authority was never revoked, so the creator can print new tokens at any time. They mint millions of fresh tokens and sell them, diluting everyone else to almost zero.
- Freeze or trap: with an active freeze authority, or with special token rules, the creator can stop your account from moving tokens. You can buy but you cannot sell. This is what people call a honeypot.
Hard rug and soft rug
A hard rug is technical and fast. The liquidity disappears, new tokens are minted or accounts are frozen, usually within minutes or hours of launch. There is no doubt about what happened, and it can often be predicted by reading the token settings.
A soft rug is slower and harder to prove. The team keeps the project alive for a while, promises a roadmap, maybe a website and a few partnerships. Meanwhile insiders sell a little every day. Eventually the socials go quiet and the price fades. Nothing in the contract was malicious, but the result for holders is the same.
Hard rugs are where on-chain checks help the most. Soft rugs are where holder distribution and the creator wallet history help, because the selling always comes from somewhere.
Why Solana memecoins need their own checks
Most rug pull guides were written for Ethereum and BNB Chain. They tell you to read the smart contract on Etherscan and look for hidden functions. On Solana most tokens do not have their own contract at all. They are created with the standard token program, and what matters is a small set of settings attached to the token and the way supply and liquidity are distributed.
That makes Solana tokens easier to check than EVM tokens, as long as you know where to look. The questions are always the same: can someone create more tokens, can someone freeze my tokens, can someone take the liquidity, and who holds the supply.
Signal 1: mint authority
The mint authority is the address allowed to create new units of a token. If it is still set, the supply is not fixed: the holder of that key can mint as many tokens as they want and sell them.
For a memecoin there is no good reason to keep it. The supply should be fixed at launch and the mint authority revoked, which means set to nobody. Once revoked it cannot be restored. If you see an active mint authority on a young memecoin, treat it as a critical red flag, whatever the team says about "future rewards" or "burns".
Some legitimate tokens keep a mint authority, for example stablecoins or tokens of protocols that issue rewards. Those are different products with known issuers. The point is to know whether the token you are looking at can be inflated, and by whom.
Signal 2: freeze authority
The freeze authority can freeze any token account for that token. A frozen account cannot send or receive tokens. In practice this means the creator can let you buy and then stop you from selling.
Like the mint authority, it should be revoked on a memecoin. Regulated stablecoins keep it to comply with law enforcement requests, and that is expected. On an anonymous token launched yesterday, an active freeze authority has only one realistic use.
Signal 3: special token rules (Token-2022)
Solana has a newer token program, often called Token-2022, that adds optional extensions. Most are harmless, but a few can be used against holders and are worth checking on any token that uses this program.
- Transfer fee: a percentage is taken on every transfer. A small fee can be part of the design; a fee close to 100% makes selling pointless.
- Permanent delegate: an address that can move or burn tokens from any account, including yours, without your signature.
- Transfer hook: a custom program runs on every transfer and can make transfers fail, for example only when you try to sell.
- Default frozen state: new accounts start frozen and must be unfrozen by the issuer.
Signal 4: liquidity, burned or locked
Liquidity is the pool of SOL and tokens that lets people trade. When someone adds liquidity they receive LP tokens, which are the right to withdraw it. Whoever holds the LP tokens can take the liquidity back.
Burned liquidity means the LP tokens were sent to an address nobody controls: the liquidity can never be withdrawn. Locked liquidity means the LP tokens are held by a locking contract until a date: safe until that date, then the owner can withdraw. Unlocked liquidity held by the creator is the setup for a classic liquidity pull.
Size matters too. A pool with a few thousand dollars can be moved by a single wallet, and even without a rug the price impact of a normal sale will be brutal. Check how much liquidity there is compared to the market cap people talk about.
Burned liquidity does not make a token safe. It only removes one way to rug. On Solana memecoins most rugs today are dumps by large holders, which work perfectly well with burned liquidity.
Signal 5: who holds the supply
This is the check that catches the most rugs, and the one most often done badly. Look at the top holders and remove the addresses that are not people: the liquidity pool, exchange wallets and burn addresses. What remains tells you how concentrated the token really is.
As a rough rule, a single wallet with more than 10 to 20% of the supply, or the top ten wallets together holding more than half, means a few people can crash the price whenever they want. Lower numbers do not guarantee anything, but they make a coordinated dump more expensive.
Be careful with wallets that look separate but are not. A common trick is to split the supply across dozens of fresh wallets so that no single holder looks big. Signs of this are many wallets created at the same time, funded from the same source, or that all bought in the very first seconds of trading.
- Bundled buys: several wallets buy in the same block as the launch, often controlled by the creator. They look like early fans; they are supply waiting to be sold.
- Snipers: bots that buy in the first seconds to sell to the people who arrive later. Heavy sniper activity means a lot of supply in the hands of quick sellers.
- Dev wallet: how much the creator still holds, and whether they are already selling.
Signal 6: the creator's track record
On-chain history does not disappear. The wallet that created the token, and the wallet that funded it, often have a past. If the same creator launched ten tokens last week and all of them went to zero within hours, the eleventh is unlikely to be different.
A creator wallet that is brand new is not automatically bad, since many scammers use fresh wallets precisely because they know history is visible. That is why the creator check works best combined with the holder check: fresh creator, fresh holder wallets and fast early buys together form a pattern.
Signal 7: age, speed and hype
Most memecoin rugs happen in the first hours, many in the first minutes. A token that is a few hours old has not yet shown how its holders behave. That does not mean you can never buy young tokens, but it does mean you are taking the highest risk there is.
Social signals are the weakest evidence because they are the easiest to fake. Paid posts by influencers, bots in Telegram groups, countdowns, fake volume and messages like "last chance" or "guaranteed 100x" are designed to make you buy before you check. A real project will still be there in ten minutes. A rug often will not.
A useful habit: when you feel urgency, that is the moment to slow down and run the checks.
The 2-minute checklist
Run these checks in this order. The first ones are the fastest and the most decisive: if one of them fails, you can stop there.
- Mint authority revoked? If not, stop.
- Freeze authority revoked? If not, stop.
- Token-2022 extensions: no high transfer fee, no permanent delegate, no unknown transfer hook.
- Liquidity burned or locked, and large enough for the size you want to trade.
- Top holders excluding pools and exchanges: no single wallet with a dominant share, no cluster of linked fresh wallets.
- Creator wallet: how much it holds, whether it is selling, what happened to its previous tokens.
- Age and activity: are other wallets actually selling successfully?
- Only then look at the socials and the story.
How often rugs happen
Every week Nemira publishes a report on the new Solana tokens it scanned: how many there were, how many scored as high risk and which red flags appeared most often. The numbers move with the market, but the pattern is stable: a large share of new tokens carries at least one critical flag, and concentrated holders are the flag you will meet most often.
The Daily Rug Report shows the same data for the last 24 hours, with the riskiest new tokens of the day. Looking at it for a week is the fastest way to train your eye.
What a scanner can and cannot tell you
Automated scanners, including Nemira, read the token settings, the liquidity and the holder distribution in seconds and turn them into a grade. That covers the hard-rug signals very well and gives a strong hint on dump risk.
A scanner cannot read intentions. A token with a good grade can still be dumped by a group of holders who stay below the thresholds, and a soft rug can start months later. Use the grade as a filter that removes the obvious traps, not as a promise. The decision and the risk remain yours.
If you think you have been rugged
First, protect what is left. If you signed transactions or approvals on a site linked to the token, revoke them and move remaining funds to a wallet that never interacted with it.
Second, ignore anyone who offers to recover your money. Recovery services that contact you after a rug are almost always a second scam: they ask for a fee or for your seed phrase, and the money is gone twice.
Third, keep the evidence: the token address, the creator wallet, your transactions and screenshots of the promotion. Report the token where you found it and warn others in the community. In some countries you can also file a report with the police or the financial regulator; the chance of recovery is low, but reports help investigators connect cases.
Questions
- Is a rug pull illegal?
- It depends on the country and on how it was done. Taking investors' money with false promises is fraud in most legal systems, and in the EU the MiCA regulation covers market manipulation of crypto-assets. In practice anonymous creators are rarely caught.
- Can I get my money back after a rug pull?
- Almost never. Blockchain transactions cannot be reversed. Be very careful with anyone who promises recovery: it is one of the most common follow-up scams.
- If the liquidity is burned, is the token safe?
- No. Burned liquidity removes the liquidity-pull scenario, but large holders can still dump into the pool. Always check the holder distribution as well.
- Can a token with a good scan grade still rug?
- Yes. A good grade means the known technical traps are absent and the supply is not obviously concentrated. It cannot exclude coordinated selling or a project abandoned later.
- What is the most common rug on Solana today?
- Dumps by a few wallets that hold a large share of the supply, often split across many fresh wallets to look decentralized.
Check mint, freeze, liquidity and holders before every buy. Paste the address in the Nemira scanner: it checks these signals in seconds and explains each one.
Scan a token