A rug pull is the abandonment of a token project by the people who created it, in a way that transfers the buyers' money to them. It comes in a hard variant, where the code was built to make it possible, and a soft variant, where the code is ordinary and the team simply sells everything and disappears. The distinction matters because only one of them can be detected in advance with certainty.
The hard variant is a property of the contract. A liquidity rug works when the creators hold the pool tokens representing the trading liquidity: once enough buying has come in, they withdraw the pool, and the market for the token ceases to exist. A honeypot is a contract with transfer logic that permits buying and blocks selling for everyone except addresses the creator controls — the chart looks like a perfect one-way rise, because no sell has ever been possible. A mint function left open lets the creator issue unlimited new supply and sell into the pool at will.
All three leave evidence in the contract before anything happens. Is the liquidity locked, and for how long, and by a locker that can be verified? Has the contract been renounced, or does an owner address retain privileged functions? Is there a mint function, a blacklist, a transfer fee that can be raised arbitrarily? Contract-scanning tools automate most of these checks, and a simulated sell — attempting a tiny buy and then a tiny sell — is the practical test that catches most honeypots.
The soft variant leaves no such evidence, because there is nothing anomalous about the code. It is detected only through distribution and behaviour: a handful of wallets holding most of the supply, a treasury with no vesting, an anonymous team, promotion that is heavy on urgency and silent on mechanism, and a token that trades against one shallow pool. Concentration is the single most informative number. A supply held by a few addresses is a supply that can be sold into a thin market at any moment.
The lifecycle is consistent enough to recognise. A token launches with a small pool. Coordinated promotion arrives — paid influencers, engineered social volume, a chart that only goes one way. Buyers arrive; liquidity remains thin so the price rises steeply on modest volume. Then the exit: pool withdrawn, or supply dumped, or selling quietly disabled. The website goes down, the chat is deleted, and the same team appears under a new name a few weeks later.
The defences are simple and unpopular because they exclude most of what is exciting. Check the contract before buying, not after. Check holder concentration. Prefer tokens with locked liquidity and public, accountable teams. Treat an anonymous team plus a thin pool plus loud promotion as a single combined signal, because it usually is one. And treat anything bought in this category as capital you are prepared to lose entirely, since even the projects that are not frauds fail at a rate that would be considered catastrophic anywhere else.