How to Spot a Rug Pull On-Chain Before It Happens
A rug pull is one of the most common ways to lose money in crypto. The contract looks fine, the chart is moving, the community is hyped, and then the developers drain the liquidity and disappear. Most of this damage is visible on-chain before it happens. Knowing where to look does not make you immune, but it shifts the odds considerably.
What a rug pull is
A rug pull is an exit scam. A team launches a token, drives up demand through marketing or artificial volume, then drains the liquidity pool, the pool of paired assets (usually ETH or a stablecoin) that lets other traders buy and sell on a DEX. Once the liquidity is gone, the token becomes worthless and unsellable. Holders are left with a bag they cannot move.
There are two broad types:
- Hard rug: the team drains the LP in one transaction and vanishes immediately.
- Slow rug: the team sells their large allocation gradually over days or weeks, suppressing price while maintaining the appearance of a live project until selling is complete.
Both are detectable from the same set of on-chain signals.
On-chain red flags
Owner can still mint new supply
If the token contract's owner can still call its mint function, someone, usually the deployer, can create new supply at any time. An unlimited supply injection is enough to dilute every existing holder to near zero.
Check whether ownership has been renounced or the minter role removed. Treat a live mint function as a critical risk. Legitimate projects renounce ownership as a public gesture of commitment, typically at or before launch.
LP not locked or not burned
A liquidity pool represents the actual assets you receive when you sell a token. If the LP tokens, the receipts issued for adding liquidity, are not locked in a time-lock contract or burned permanently, the deployer can remove liquidity in a single transaction.
- Locked LP: tokens held in a third-party locker for a defined period. Duration matters: a 30-day lock is meaningless on a token launched yesterday; a 2-year lock carries real weight.
- Burned LP: LP tokens sent to the zero address. This is the strongest guarantee: liquidity cannot be removed because the receipt is gone forever.
If liquidity is neither locked nor burned, draining it is a single contract call away.
Extreme holder concentration
When a small number of wallets controls most of the supply, a coordinated sell can collapse the price before other holders can react. This includes hidden team wallets, addresses funded from the same source as the deployer that hold large positions under different identities.
Holder concentration analysis shows you the top holders and the percentage of supply each controls. A rough threshold: if the top 10 wallets hold more than 30–40% of supply and none are clearly exchange cold wallets or locked contracts, treat that as elevated risk.
Large sudden transfers to fresh wallets
Watch for large token movements into wallets with no prior history. This pattern often signals the team distributing tokens to insider accounts before a public dump. A fresh wallet receiving a significant share of total supply minutes or hours before a public launch is a clear warning.
Blockchain data lets you trace every token transfer from the moment of deployment. You can follow the initial minting, see exactly how tokens were allocated, and identify whether early recipients are connected to the deployer by funding source.
Honeypot sell restrictions
A honeypot is a contract that lets anyone buy but blocks selling. It does this through a hidden function that reverts sell transactions, a transfer tax set to 100%, or a whitelist that only permits the deployer to sell. Buyers see a rising chart and believe they are in profit, but they cannot exit.
Detection requires reading the contract code directly or running the address through a honeypot checker. The core check is whether a test sell transaction reverts. If you cannot simulate a successful sell, do not buy.
A pre-buy checklist
Before committing any capital to a new token, run through these steps. Each one takes under two minutes using the token page on Datablocks and free on-chain tools.
- Verify the mint function: can the owner still mint, or has ownership been renounced?
- Check LP lock or burn: are LP tokens locked for a meaningful duration, or burned? Who controls the locker contract?
- Review holder distribution: what percentage does the top 10 hold? Are those wallets exchange addresses or unknown fresh wallets?
- Trace deployer funding: where did the ETH that deployed this contract come from? A mixer or a new wallet with no history is a risk signal.
- Simulate a sell: use a honeypot checker to confirm you can exit the position.
- Check contract verification: is the source code verified on-chain? Unverified contracts hide what the code actually does.
- Review transfer history: are there large pre-launch transfers to unknown wallets?
The limits of detection
On-chain data is transparent, not predictive. A project can pass every check above and still fail, through poor execution, market conditions, or a sophisticated attack vector you did not anticipate. Conversely, some projects carry alarming metrics that reflect design choices rather than malice (a single large holder who is a known exchange, for example).
Detection has hard limits:
- Multi-sig and time locks are social guarantees, not code guarantees. A 3-of-5 multi-sig can still be controlled by five wallets owned by one person. A time lock buys delay, not prevention.
- Audit reports do not guarantee safety. An audit checks for known vulnerability patterns; it does not certify a project is honest or that new vulnerabilities do not exist.
- No single signal is proof. Sophisticated actors stage the easy ones (throwaway team wallets, staged distributions, fake lock periods). The harder-to-fake layer is how wallets are funded and how they behave over time, which is exactly where tracing the connections between addresses pays off.
- Social proof amplifies risk. Telegram communities and engagement on X can be manufactured. On-chain metrics are harder to fake than follower counts.
The goal is not certainty but eliminating the most common and avoidable mistakes. A project that fails the mint check, the LP check, and the concentration check is a strong no before you even read the whitepaper.
For a broader framework on reading on-chain data, start with our On-Chain Analytics guide. When you find a token worth investigating, the token page on Datablocks gives you holder concentration, the size-tier breakdown, and the full top-holders list in one view.