How to Identify a Rug Pull

Rug pulls — where token creators drain liquidity or dump massive holdings on unsuspecting buyers — stole approximately $1.1 billion from retail investors in 2023 alone (Chainalysis). They're not random; they follow predictable patterns that can be identified before losing money. The fundamental due diligence framework involves five layers: tokenomics, liquidity, contract code, team credibility, and community authenticity.

Tokenomics red flags: a single wallet or cluster of wallets holding >20% of supply (use Etherscan token holders tab, Bubblemaps, or DEXtools). Team wallets with no vesting period — immediate ability to dump entire allocation on launch. Token minting functions that allow unlimited supply creation. In legitimate projects, team tokens are subject to cliff-and-vest schedules (e.g., 1-year cliff, then 2-year linear vest) enforced by smart contracts.

Liquidity red flags: unverified contract (code hidden, can't be read on Etherscan). No liquidity lock or lock period under 6 months (verify on Unicrypt or Team.Finance). Honeypot contracts where you can buy but not sell (test with a small amount or use Honeypot.is checker). Trading restrictions like maximum sell percentages that reset to allow developer dumps. The contract audit section is crucial: verify the contract is both deployed and verified on-chain, then read or use automated scanners (TokenSniffer, GoPlus Security, DexScreener's security flags).

Social/community red flags: anonymous team with no verifiable history, copy-pasted whitepaper, unrealistic return promises, fake follower counts on Twitter (use Sparktoro or similar), paid shill campaigns flooding Telegram groups, celebrity endorsement (real celebrities usually don't shill anonymous tokens), and website/social profiles created within days of the token launch. Alpha Factory's /scam-check tool walks through this checklist systematically.