What Is a Rug Pull? Types, Anatomy, and How to Avoid One

A rug pull is a crypto scam in which the people behind a token remove its value out from under the people who bought it — most often by draining the liquidity that lets the token be traded, or by dumping a hidden reserve of tokens into the market. The name comes from "pulling the rug out": one moment there is a working market, the next there is nothing to sell into.

Rug pulls are not a niche problem. They cluster around newly launched tokens on decentralized exchanges, where anyone can deploy a contract and open a market in minutes with no gatekeeper. That openness is the point of DeFi — and also the opening scammers exploit.

Hard rugs vs. soft rugs

Not every rug looks the same. It helps to separate two broad patterns.

Hard rugs are sudden and technical. The contract or the liquidity setup contains a mechanism that lets the operator take the funds directly: removable liquidity, an infinite-mint function, an owner-only withdrawal, or a honeypot that blocks selling entirely. When it triggers, holders are trapped or wiped out in a single transaction.

Soft rugs are gradual and behavioral. There is no single malicious function; instead the team slowly sells its allocation, abandons the project, stops communicating, and lets the price bleed to zero while keeping up appearances long enough to attract more buyers. Soft rugs are harder to prove and easier to deny, which is exactly why they work.

The anatomy of a typical liquidity rug

Most hard rugs follow a recognizable arc:

1. Launch. A token is deployed and paired with a real asset (ETH, BNB, USDC) in a liquidity pool so people can buy it.
2. Promotion. The project builds hype — a slick site, social accounts, influencer mentions, a countdown. Buying pressure pushes the price up.
3. Accumulation of trust. Early buyers see gains and tell others. Volume rises. The pool fills with real money contributed by buyers.
4. The pull. The operator removes the liquidity they control (or dumps a large reserve), converting the pool's real assets into their own wallet. The token's price collapses to near zero because there is nothing left to sell it into.
5. Exit. Wallets are abandoned, socials go quiet, and the same actors often redeploy a near-identical contract under a new name.

The mechanism that makes step 4 possible is usually visible before step 1 matters to you — in the contract's permissions and the liquidity's lock status. That is where analysis earns its keep.

The warning signs you can actually check

You do not need to predict intent. You need to check whether the ability to rug exists. Concretely:

• Removable or unlocked liquidity. If the liquidity-pool tokens sit in a wallet the team controls (not burned, not in a credible time-lock), the liquidity can leave. Locked liquidity reduces this specific risk — but a lock is not a guarantee of safety on its own.
• Dangerous owner powers. Functions that let an owner mint new supply, disable selling, change taxes, blacklist wallets, or replace the contract logic behind a proxy are all levers a rug can pull.
• Concentrated ownership. When a few wallets — or one — hold most of the supply, a single sale can end the market. Exclude known exchange, burn, and pool addresses, then look at what is left.
• A failed sell simulation. If an independent tool cannot complete a test sale, treat it as a red flag and investigate why before risking real funds. (This overlaps with honeypots; see What Is a Honeypot Crypto Token.)
• Thin liquidity relative to market value. A token can advertise a large "market cap" while holding very little tradable liquidity, which makes both exits and manipulation easy.

None of these, alone, proves an intent to defraud. Together, they describe how exposed you would be if the intent were there.

How Orixa frames rug risk

Orixa's analysis includes a Rug Probability signal: an estimate, from the evidence available at scan time, of how much a token resembles a rug-like failure pattern — liquidity fragility, dangerous control permissions, sell restrictions, or suspicious concentration. It is deliberately not a claim that a project will commit fraud. It is a way to compare the combined effect of the signals above, alongside the overall Risk Score and a Confidence value that tells you how much evidence actually supported the result. You can read more in What Is Orixa and How Does It Analyze Token Risk.

A high-risk classification reflects on-chain and market evidence at the time of the scan. It is not, by itself, proof of criminal intent — and a low score today is not a promise about tomorrow, because liquidity, ownership, and permissions can change.

What to do with this

Treat every new token as guilty until the evidence says otherwise: verify the exact contract address, check liquidity lock and owner powers, look at holder concentration, and run at least one independent sell simulation. If the ability to rug is present and unexplained, the safest position is usually no position.

If you have already been caught by one, revoking token approvals and moving your remaining assets to a fresh wallet still protect what is left.

Run a token's contract address through Orixa to see its liquidity, owner permissions, holder concentration, and honeypot evidence in one report — then verify the critical findings independently before you act. Orixa is decision support, not financial advice or a guarantee of safety.