Rug pulls, honeypots and phishing

In stocks, fraud is rare enough to be news. In crypto, especially on decentralised exchanges, it is the base rate: a large majority of newly created tokens on the busiest networks are either outright scams or abandoned within weeks. This lesson describes the three mechanisms that take the most money from beginners, and the checks that catch most of them.

Rug pulls

A rug pull is a token whose creators remove the liquidity, or dump their supply, leaving holders with something that cannot be sold. Variants:

Liquidity pull. On a DEX, a token trades against a pool of, say, the token and ETH. The deployer supplied the pool. Once buyers have swapped ETH in, the deployer withdraws the pool, taking the ETH. The token still exists; there is simply nothing to sell it for.

Supply dump. The team holds most of the supply (see the tokenomics lesson), waits for the price to rise on promotion, and sells everything. Slower than a liquidity pull, and it can look like an ordinary crash.

Mint and dump. The token contract has a function that lets the owner create unlimited new tokens. They mint, sell, and repeat until the price is zero.

Checks that catch most rug pulls before you buy:

• Is the liquidity locked, and for how long? Reputable launches lock the pool in a third-party contract for months or years. "Locked for 7 days" is not locked.
• Is the contract ownership renounced, or does the owner retain functions to mint, pause trading, or change fees? Token scanning sites list these functions.
• What share of supply do the top ten wallets hold, excluding the pool and known contracts? Above 30% to 40% in a few wallets is a dump waiting to happen.
• How old is the deployer wallet, and what else has it deployed? Serial scammers reuse wallets.

Honeypots

A honeypot is a token you can buy but cannot sell. The contract allows purchases from anyone and sales only from whitelisted addresses (the deployer's). The chart goes up and to the right, because every transaction is a buy, which attracts more buyers. Nobody notices until they try to sell.

Variants include contracts with a sell tax of 99%, contracts that block sales above a tiny amount, and contracts where the sell function is enabled and then disabled after a promotion.

Checks:

• Run the contract through a honeypot checker (several free sites simulate a buy and sell). Not infallible, since contracts can be changed after the check, but it catches the crude ones.
• Look at the transaction history: are there any successful sells from wallets other than the deployer's?
• Test with an amount you would not miss: buy, then immediately sell a fraction. If the sell fails or the tax is enormous, walk away.

Key idea: On a DEX, the default assumption for a new token is that it is designed to take your money. Locked liquidity, renounced ownership, distributed supply and a successful test sell are the minimum before you risk anything you care about.

Phishing and wallet drainers

Phishing in crypto goes beyond stolen logins. The standard attack is to get you to sign a transaction or grant an approval that hands your wallet to the attacker. Common forms:

Fake sites. A lookalike of a wallet, exchange or DEX, reached through a search ad, a message, or a typo. It asks for your seed phrase ("to sync"), or presents a transaction to sign.

Malicious approvals. On most networks, to let a contract trade your tokens you first "approve" it. A scam site asks for unlimited approval of your most valuable tokens, then drains them later, possibly weeks later, from a wallet you thought was fine.

Signature requests. Some signatures are not transactions but still authorise transfers (permit-style signatures). A page asking you to "sign to verify ownership" may be collecting exactly that.

Address poisoning. Attackers send tiny amounts to your wallet from an address whose first and last characters match one you often send to. Next time you copy an address from your history, you copy theirs.

Fake support. After you post a question in a public channel, a "support agent" DMs you with a helpful link. Real support does not initiate contact.

Defences:

• Never type a seed phrase into anything. There is no legitimate "sync", "validate" or "restore" page.
• Read every transaction on the hardware wallet screen before confirming. If the wallet says "approve unlimited", stop.
• Use a token-approval revocation tool monthly to cancel approvals you no longer need.
• Keep a separate "burner" hot wallet with small funds for interacting with anything new. Your main wallet never connects to unfamiliar sites.
• Copy addresses from a saved address book, never from transaction history, and verify the whole address on the device screen.
• Treat all links in messages, comments and search ads as hostile; navigate by bookmark.

The scale of the problem

The reason for the blunt tone: wallet-drainer kits are sold as a service, with the operators taking a cut of stolen funds, and the amounts stolen this way run to hundreds of millions of dollars a year. The attackers are professional, patient and better at web design than most legitimate projects. Your only advantages are a small number of habits, applied every time.

Try it: Pick any token launched on a DEX in the last 24 hours. Run the four rug-pull checks and a honeypot checker on it. Then open a token-approval tool for a wallet you use and count the active approvals. Revoke every one you cannot explain.

Recap

• Rug pulls remove liquidity or dump supply; check liquidity locks, ownership functions, holder concentration and deployer history.
• Honeypots let you buy but not sell; check for real sells in the history and test with a trivial amount.
• Phishing in crypto means malicious approvals and signatures, not just stolen passwords; read every request on the device screen.
• Use a burner wallet for anything new, revoke old approvals, copy addresses only from a saved book.
• Assume new tokens and unsolicited links are hostile by default; the base rate justifies it.