There is a chart shape I have learned to recognize on sight. Vertical up for a day or two, a brief plateau, then a drop to effectively zero that takes less time than making coffee. The answer to what happened is almost always a rug pull, and the annoying part, once you have read enough post-mortems, is how many of them were visible in advance. Most rugs leave fingerprints before they happen. You just need to know which five places to look.
The term gets used loosely, but it covers two fairly different scams, and it is worth keeping them separate because you detect them in different ways. I think of them as hard rugs and soft rugs.
Hard rugs: the money leaves in one transaction
A hard rug is mechanical. The exit is built into the plumbing before you ever buy. The classic version is the liquidity pull. When a token launches on a decentralized exchange, someone seeds a pool with the token on one side and something valuable on the other, usually ETH or a stablecoin, and that pool is the only thing that lets you sell. In return for seeding it, the deployer receives liquidity provider tokens, and whoever holds those can withdraw the entire pool at any time. If the team keeps them, they are holding a lever. When they pull it, one transaction drains the pool and every holder is left with a token that still exists on-chain but can no longer be exchanged for anything. The vertical drop on the chart is the last few sellers racing each other into an empty pool.
The other flavor is the minting or permission exploit. The contract looks normal from the outside, but somewhere in the code a privileged wallet can create unlimited new tokens, change the transaction tax to 100 percent, or block everyone outside a whitelist from selling. Honeypots sit in this bucket, tokens you can buy but never sell because the transfer function quietly checks who you are. I watched one project run for about two weeks with a real-looking community and a rising chart before the deployer used a leftover function to mint himself a supply many times larger than everything in circulation and dumped it into the pool in a single block. The people who bought that morning had done what most people do, which is check the chart and skim the Telegram.
Soft rugs: the money leaves over months
Soft rugs are slower, far more common, and legally much murkier. Nothing in the contract is hostile. The value leaks out over months instead, either through neglect or through deliberate, patient selling.
Team abandonment is the gentle version. The roadmap stalls, the GitHub commits thin out and stop, the Discord announcements go from weekly to monthly to never, and the founders quietly resurface on a new project under new handles. No single transaction stole anything, but the token you bought as a claim on a future product is now a claim on nothing, and it bleeds out over a year instead of a minute. I have seen holders defending a project long after the deployer wallet had gone six months without signing a transaction. Hope does a lot of the scammer's work for free.
Treasury dumping is the calculated version. The team allocates itself a large slice of supply at launch, often somewhere around a quarter of it, and rather than one dramatic exit they sell into every rally. Each sale is small enough to look like noise. One project I traced had a treasury wallet that hopped through three intermediate addresses before hitting an exchange, on a schedule, every time the price recovered meaningfully. Over roughly a year the team extracted most of what the community kept pouring in, and there was never a single moment you could point to and call the rug. On the chart it just looked like a token that could not catch a bid.
The five checks I run before buying anything small
None of this requires forensic skills to defend against. Before I put money into anything new and thinly traded, I run five checks, and if any one of them fails I pass. The whole routine takes maybe twenty minutes.
- Liquidity lock. Find the pool, find the LP tokens, and verify where they went. Burned to a dead address is best. Locked in a reputable locker contract is acceptable if the lock is long, and by long I mean a year or more, because a thirty-day lock just schedules the rug. If I cannot verify the lock myself on a block explorer, I assume it does not exist. A screenshot in the project Telegram is not verification.
- Contract permissions. The source code should be verified and published on the explorer. From there, check who owns the contract and what the owner can do. Mint functions, pausable transfers, editable fees, and blacklists are all levers someone can pull later. Automated scanners catch the common patterns and are worth running, but they miss the creative ones, so treat a clean scan as necessary rather than sufficient. An unverified contract is an automatic no.
- Team wallets. Trace the deployer. What share of supply sits in wallets it funded, and where did its own gas money come from? A pattern I see constantly is a dozen fresh wallets, all funded from the same source, all buying in the first block. That is one person wearing twelve masks, and every mask sells at the same time.
- Vesting terms. Team and investor allocations should vest on-chain, in a contract you can read, on a schedule you can check. A pie chart on the website saying the team is locked for two years is a promise, and promises from anonymous teams are worth what you paid for them. If the vesting is real, someone can show you the contract address. Ask for it and see what happens.
- Social footprint. Are the founders identifiable people with a history that predates the project? Doxxed teams still rug occasionally, but far less often, because reputations are expensive to rebuild. On the community side, look at the ratio of members to actual conversation. Tens of thousands of Telegram members with a dozen people talking is a bought room. Real communities argue about small things.
The checklist will not make you immune. Hard rugs keep getting more creative, and a soft rug by definition looks like ordinary underperformance until long after you have bought. What the checks do is remove the easy wins, because most of the rugs I have read post-mortems on failed at least one of the five, usually the liquidity lock or the wallet trace. The wallet trace is also the step people skip most, which is part of why we built wallet tracking into Blockcircle. What insider clusters actually do with their tokens tends to say more than anything the team posts.
And when a project fails a check, pass. Do not talk yourself into it because the community seems friendly or the entry looks clean. There is always another launch tomorrow, and the ones worth owning survive twenty minutes of scrutiny without breaking a sweat.