Anatomy of a Rug Pull, On-Chain

Most explanations of a rug pull describe it in the abstract. This one walks through a real, confirmed liquidity rug exactly as it appears on-chain — with the block numbers and the transaction hash, so you can verify every figure yourself. It is drawn from Orixa's forward benchmark, which freezes a snapshot of each token before any outcome is known and only confirms a rug strictly later, from the chain itself.

How a rug is confirmed, not guessed

Orixa's benchmark does not call a token "rugged" because its price fell. It requires two on-chain facts together: the pool's base reserve collapses to a tiny fraction of what it held at the frozen snapshot, and a liquidity-provider (LP) burn is recorded after that snapshot. Reserve collapse alone can be a price dump; reserve collapse with an LP burn is the liquidity being removed and destroyed. As of August 2026, 65 tokens in the stream met that strict test — every one on BNB Chain, every one by the same mechanism: liquidity removal via burn.

One case, block by block

Take one confirmed example — a BNB Chain token paired against WBNB (contract 0x0036a3…1b62, pair 0xaa7c5a…e7fa). The numbers below are the pool's own reserves, read from the chain.

• At the frozen snapshot (block 118,214,548): the pair held about 9.25 WBNB of base liquidity. A working market — you could buy, and there was real value to sell back into.
• A few hundred blocks later (confirmed by block 118,215,177 — hours, not days): the base reserve had collapsed to about 0.00009 WBNB. That is a 100% drop — effectively the entire pool gone.
• The mechanism: a single LP burn recorded after the snapshot (rug transaction 0xb18bab…98efa). The liquidity position was removed and the LP tokens destroyed, converting the pool's WBNB out and leaving holders with a token that has nothing to sell into.

The whole arc — a funded pool, then a single transaction that empties it — played out in hours. This is the "hard rug" pattern in What Is a Rug Pull made concrete: the ability to pull was present the moment the pool's LP could be removed; the pull itself was one transaction away.

What was visible before it happened

The point of reconstructing this is not hindsight — it is that the risk was structural and readable at the snapshot. Before the burn, the pool's liquidity sat in a position that could be removed. That is the single most important pre-rug signal, and it is checkable on any token before you buy: is the liquidity burned or in a credible time-lock, or can it simply leave? A pool whose LP can be pulled is a pool that can be rugged, whatever the chart says. (See Why Locked Liquidity Isn't Always Safe for the nuances of reading a lock.)

Why the confirmation method matters

Retrospective "rug detectors" that only look at price are easy to fool and easy to game. Confirming from reserve collapse plus an LP burn recorded after a frozen snapshot is leakage-free: the snapshot cannot have seen the future, and the burn is a specific, timestamped on-chain event. That discipline is why these 65 cases are stated as facts rather than guesses — and why the same test can be run on any pool without trusting anyone's label.

This case is a confirmed on-chain event; the block numbers and transaction hash are public and verifiable on BscScan. Aggregate counts are from Orixa's forward benchmark as of August 2026 and grow as new outcomes mature. Check whether a token's liquidity can be removed before you buy by pasting its address into Orixa. Orixa is decision support, not a guarantee of safety.