Rug Pull and Slow Rug: how projects quietly drain investors

📖 Why rug pull risk remains the main threat for new tokens

Rug pull is a scam where the team or related wallets extract value from the token market: liquidity disappears or supply is sold aggressively, and an exit becomes almost impossible for most holders.

Slow rug looks less obvious: related wallets sell the token gradually, pool reserves shrink step by step, and the exit price gets worse before the sharp collapse.

Goal of this guide: to show rug pull and slow rug signals through verifiable on-chain objects: liquidity-pool reserves, LP-token storage and the presence of an LP lock, owner and proxy rights in the contract, fees (tax) and sales by top wallets.

Rug pull risk is higher where the token trades only through a DEX pool and has not gone through listing. In that market, any address can create a contract and a pool, while the chart shows price and volume but does not show who holds the LP tokens (tokens that give the right to withdraw liquidity from the pool) or which admin functions are built into the contract.

A classic rug pull looks like a sudden collapse: liquidity disappears in one transaction or the team performs a large dump, and pool depth vanishes. A slow rug looks like steps downward: top wallets sell regularly, pool reserves melt gradually, and each following sale receives a worse exit price because liquidity is lower.

In most cases the signals are visible in advance: LP tokens remain with the team without a lock, the owner can change fees or enable sell restrictions through a blacklist (a list of addresses that the contract forbids from selling the token), and related wallets start selling before the chart turns into a vertical dump.

A rug pull differs from a slow rug not by the “style” of the scam, but by exactly how liquidity leaves and how sales are distributed over time.

🧩 Rug pull and slow rug: precise definitions and differences that help identify a scam

Both scenarios end with lost liquidity and a price collapse, but the source of the market shock is different: a rug pull creates a liquidity gap immediately, while a slow rug creates it through a series of transactions.

Rug pull is a hard scenario in which liquidity-pool reserves fall sharply: the team withdraws liquidity through access to LP tokens or sells large token volumes over a short period. After that, sales for most holders execute at distant AMM levels with heavy slippage.

Slow rug is a scenario in which pool reserves shrink gradually: related wallets sell the token in batches over weeks or months, and every sale moves the price according to the AMM formula (the automated market maker where price depends on the ratio of assets in the pool), because the reserve ratio changes through a series of transactions rather than one trade.

The difference between a rug pull and a slow rug is captured in two on-chain objects: the dynamics of pool reserves and the transaction sequence of top wallets. Marketing messages do not change those two data sources.

Rug pulls happen more often in low-liquidity pools when LP tokens and owner rights are held by one address or a group of related addresses.

🧭 Why rug pull became a systemic DeFi risk and which conditions make a market vulnerable before entry

Rug pull risk is formed not by “volatility”, but by access to two levers: liquidity-pool reserves and admin functions in the token contract. These levers are concentrated with the project creators before the token achieves broad distribution.

On a DEX, trades are executed by an AMM: the price in the pool depends on the ratio of reserves of two assets. If reserves are small, even one large order moves the price, because after the trade the reserve ratio changes more strongly than in a deep pool.

The highest risk is at the start of trading, when the pool is still small and token distribution is concentrated. A similar logic of vulnerability in early offerings is described in the guide: Launchpads and IEO/IDO platforms — how to participate, assess risks and choose the best ones.

In the basic rug pull scenario, the team creates a token and a DEX pool, then stimulates demand and price growth.

• As buyers enter, liquidity accumulates in the pool and visible market depth forms.
• When demand reaches a peak, the team exits first: it withdraws reserves through LP tokens or sells a pre-held token allocation.
• Pool reserves shrink sharply, market depth disappears, and price starts moving against sellers.
• Attempts by the remaining holders to sell execute with heavy slippage or become economically unattractive.

Systemic rug pull risk begins where owner rights and LP tokens are controlled by one decision-making center. That control is checked through two artifacts: LP-token storage and the list of owner functions in the contract.

Control over the exit can arise through pool liquidity, contract parameters or movement of funds between related addresses.

🧨 Types of rug pull and slow rug: which levers projects use and what exactly to check before entry

Rug pull types differ by which object the team controls: LP-token storage, the contract function set, upgrade ability, token distribution among holders and treasury fund movement.

Rug pull checking begins by matching control levers to addresses: who holds LP tokens, who can mint, who can change tax and who can upgrade the proxy.

A DEX price drawdown can result from AMM mechanics and arbitrage, not only from liquidity withdrawal or a sell ban.

🧯 When a price drop is not a rug pull: honest reasons for a drawdown and how to tell them from a scam

Sharp DEX price moves can arise both from market reasons and from liquidity withdrawal, sell restrictions or systematic sales by related wallets.

In small pools, one large order changes the reserve ratio, and the AMM recalculates price so the chart looks like a dump. In that scenario, the cause is pool size, not a sell ban or LP withdrawal.

A price drop alone does not prove a rug pull. A rug pull is recorded on-chain either as withdrawal of pool reserves, contract-level sell restrictions, or a series of sales by related wallets while liquidity is depleted.

A rug pull check relies on three sources: a network explorer for contract functions, a DEX tracker for pool reserves, and the holder list for supply concentration.

🧰 A 5-minute token-check toolkit: what to open before buying and where to look

A network explorer shows the owner, proxy and mint/blacklist functions. A DEX tracker shows pool reserves and trade history. The holder list shows top-wallet shares and transfers between them.

Before buying on a DEX, it is important to understand two mechanisms. AMM recalculates trade price from pool reserves, so every sell moves price against the seller. Approve lets a smart contract spend a user’s tokens within a given limit without a separate signature for each operation.

Both mechanisms are connected to risk. A thin pool creates heavy slippage on sell because AMM price changes with reserves. Active approvals are dangerous because a contract can spend tokens within the approved limit without the user’s involvement, for example after an interface swap or if a malicious function exists. Basic DEX mechanics are covered in the guide Decentralized exchanges (DEX): list of top platforms.

If these tabs are open in advance, the check relies on addresses and transactions rather than chat messages and team claims.

• Network explorer. Code verification, proxy, mint/blacklist functions, owner and parameter-change events.
• DEX tracker and chart. Pool size, pair reserves, swap history and trade slippage.
• Holder list. Top-wallet shares, repeated transfers and address links by patterns.
• Fee and restriction check. Tax, the ability to change it, sell restrictions and honeypot signals.
• Permission revocation. The approval list and revoking active allowances if compromise risk appears.

The risk of losing the exit is defined by contract functions, owner rights, pool reserves and supply concentration among top wallets.

The exit is lost for three reasons: reserve withdrawal through LP, contract-level sell blocking and top-wallet sales under high supply concentration.

🔎 On-chain checks before buying a token: 12 steps that filter out most rug pulls

On-chain checking filters risk by addresses and functions. A rug pull usually rests on one object: LP tokens, owner functions, proxy upgrades, tax or supply concentration at related addresses.

1. Check the contract address. The address must match in the token interface, documentation and network explorer.
2. Make sure the code is verified. Verified source code lets you check mint, blacklist, tax and proxy.
3. Determine whether a proxy is used. A proxy means logic can change through an implementation upgrade.
4. Check the rights holder (owner). The owner controls contract parameters and can change tax or restriction lists if such functions exist.
5. Check protection for governance actions. A timelock adds a delay between the change transaction and its activation.
6. Check mint functions and issuance limits. Mint without a limit means new tokens can be issued and sold into the pool.
7. Check blacklist/whitelist and sell restrictions. These functions define who can sell and under what conditions.
8. Analyze transaction tax. High tax reduces the amount the seller receives on sell and worsens the exit price.
9. Check whether fees can be changed. If the owner can change tax, risk increases when there is no timelock.
10. Assess liquidity and the LP lock. LP lock is confirmed by the LP-holder address and the lock contract.
11. Study holder distribution. Supply concentration in 1–3 addresses means the ability to run a series of sells with price control.
12. Watch movement from team wallets, treasury and top holders. A series of transfers to new addresses and a series of sell transactions often precede liquidity depletion.

The checklist links rug pull risk to specific control points: LP tokens, owner functions, proxy upgrades, tax and supply concentration.

A slow rug appears as a series of team decisions that keep buyers in position while top wallets sell and pool liquidity decreases.

🧠 Behavioral slow rug signals: how the team reveals the drain before a major drawdown

In a slow rug, the main signal is not a candle on the chart but a change in communication mode: addresses, numbers and reports disappear, while discussion of LP, owner and treasury leaves public channels. This coincides in time with top-wallet sell transactions and liquidity outflow.

• Pauses in reporting. Breaks of 7–14 days without release notes, commits or on-chain addresses coincide with sell periods by top wallets in a number of cases.
• Repeated deadline postponements. A series of postponements without new metrics keeps part of the audience in position while sellers spread their exit over time.
• Replacing product with marketing. Posts about contests and memes crowd out changelogs, testnets and treasury reports.
• Opaque treasury transfers. Transfers from treasury go to new addresses without a recipient list and without a reporting structure for expenses.
• Moderating questions about LP and owner. Deleting questions about LP lock, tax and blacklist reduces visibility of on-chain risks for new buyers.
• Tokenomics changes without protection. A tax increase or new allocation without a timelock worsens sell conditions when liquidity is already declining.

“First there were reports and deadlines, then only ‘believe’, ‘hold’ and new raises.”

— user sentiment

Behavioral slow rug signs have a verifiable basis: they are compared with top-wallet transactions and pool-reserve dynamics, not with chat sentiment.

The cases below show the same technical pattern: the contract restricts selling or the team withdraws pool reserves, while buyers do not check LP and owner before buying.

📌 Rug pull and slow rug cases: repeated mistakes that lead to losses

Cases differ by sector and packaging, but in each case one lever becomes critical: LP tokens, contract sell restrictions or supply concentration among related wallets.

In all cases the critical mistake is the same: buyers do not check the object that gives the team control over the exit — LP tokens, sell restrictions or treasury addresses.

When a rug pull is suspected, the key risk is liquidity: every sell worsens price more strongly when pool reserves are small.

⏱️ Action plan when a rug pull is suspected: how to reduce damage and keep control

During a rug pull, the price decline is connected to shrinking pool reserves and rising slippage. If reserves are small, one large sale moves price more strongly because the AMM recalculates price according to the new reserve ratio after the trade.

The next steps depend on the stage. In a hard rug pull, liquidity disappears quickly through LP withdrawal or a large dump. In a slow rug, liquidity decreases through a series of transactions, and the exit price worsens gradually.

1. Immediately stop new signatures. Do not sign approve and do not confirm transactions from new links, because the signature can give the contract additional rights.
2. Check sell with the minimum amount. A small sell shows whether the contract rejects the sale (revert) and what tax applies on exit.
3. Assess pool depth. If a small sell produces large slippage, pool reserves are not enough for a larger exit without a strong price move.
4. Exit the position in stages. Several smaller sells usually move price less than one sell of the same total size, because AMM impact grows with trade size relative to reserves.
5. Revoke approvals. An active allowance lets a contract spend tokens within the limit without a new signature, so allowance is reset to zero when risk appears.
6. Record on-chain traces. Transaction hashes, contract addresses and key-wallet addresses are needed for later analysis and confirmation of events.

Related threats (phishing, frontend replacement, safe signatures and revoke) are expanded in the guide: DeFi security: threat map, cases and checklist.

During a rug pull, the main variables are pool liquidity and the contract-level ability to sell. These two points are checked through a test sell and pool-reserve analysis.

Risk management in early tokens comes down to two parameters: the portfolio share in the position and the liquidity of the pool where sell execution happens.

🛡️ Protection and risk-management strategies: how to systematically reduce losses in early tokens

Early tokens often trade in pools with smaller reserves, so one entry mistake or one rug pull can produce a disproportionately large loss at the sell execution price. Limiting position size and checking LP/owner reduce scenarios where the exit is technically closed or lost through slippage.

Damage is limited by position size and control of contract rights, while risk increases with supply concentration, free access to LP and mutable tax.

Even with basic filters, operational risk remains: phishing, frontend replacement and old approvals. These risks are connected to the fact that a wallet signature and allowance operate at the contract level, not the website level.

• Separate wallets. A separate wallet for experiments limits the amount of assets exposed to one signature.
• Set exit rules in advance. A pool-liquidity threshold and a tax threshold define when selling stops being acceptable.
• Check sell before increasing size. A honeypot appears on sell through a revert or abnormal tax.
• Do not rely on one website. A fake interface can look like the original but make you sign transactions to different addresses.
• Revoke permissions regularly. Old permissions let a contract spend tokens if it is compromised.

Risk management reduces losses through position-size limits, LP/owner checks and control of sell conditions (tax, revert, slippage) against pool reserves.