How to Spot a Crypto Rug Pull Before It Happens

Almost every malicious token follows one of five recognisable shapes. Memorising specific token names is low-value — the next rug will not be called SQUID. Recognising the shape early is high-value, because it works on tokens that have not happened yet. This page walks through the five patterns, the pre-event signals that distinguish them, and the specific case studies StableHub's validation set is built on.

The companion piece, the step-by-step pre-purchase check, covers what to do once you have classified the pattern. This page is about classification.

A hard rug is the cinematic version: developers remove the entire liquidity pool in a single transaction, the price collapses to zero within minutes, and the token becomes untradeable. The team's social channels go silent or delete entirely.

Pre-event signals. The deployer wallet still holds the LP (liquidity provider) tokens for the Uniswap pair — meaning the liquidity has never been locked or burned. The Etherscan Token Holders view will list a wallet labelled as the pair contract holding the pool, and a separate deployer wallet holding the LP receipt token. If you can see both, the developer can pull liquidity at any time. Hard rugs typically execute inside the first 90 days — the SQUID rug fired roughly seven days after launch.

What StableHub catches. Hard rugs almost always pair with unverified contracts or empty market data after the exit. The Rug Risk Score returns HIGH on both inputs. The historical SQUID contract still returns HIGH today on the validation set.

Soft rugs are quieter and slower. Founders sell their allocation gradually over days or weeks while the marketing continues. Eventually the team abandons the project — the website expires, Telegram goes inactive, the developer wallet drains itself in small transfers. There is no single dramatic block to point to.

Pre-event signals. A founder or deployer wallet making a steady stream of outflows to centralised exchanges or fresh wallets. Thinning liquidity that is not being topped up. Marketing intensity that diverges from product delivery — daily "huge announcement" posts with nothing shipped. The SafeMoon v1 case is the clearest soft-rug template in StableHub's validation set: insider sales documented over months, marketing energy preserved throughout.

What StableHub catches. Soft rugs are the hardest case in v1. While the team is still active, volume can be high and the contract can be verified. The Rug Risk Score is most useful here when read alongside the Holders tab over time — concentration trending upward, exchange listings shrinking, volume sliding.

A honeypot lets buyers acquire the token but blocks selling for everyone except a whitelisted address. Price rises as buyers come in. No one can exit. The developers eventually drain the pool.

Pre-event signals. Unverified contract on Etherscan. Or — harder to catch — a verified contract with a hidden transfer restriction: a _transfer function that checks tx.origin against a whitelist, a tax-on-sell rate that can be set to 100% by the owner, or a paused-trading flag the owner can flip. SQUID's contract included a transfer restriction that blocked all non-deployer sales.

What StableHub catches. All unverified contracts grade HIGH automatically — this is the rule that catches the majority of honeypot deployments. Verified honeypots with hidden restrictions require contract reading; the patterns to look for are documented in how to read smart contract red flags.

Coordinated buying inflates price. Insiders sell into the rally. Outside buyers are left holding a token that returns to its pre-pump level or lower. This is not always strictly a "rug" — the contract may be fine, the team may still be active — but the wealth-transfer mechanic is similar.

Pre-event signals. Extreme holder concentration — one wallet, or a cluster of wallets visibly funded from the same source, holding 30%+ of supply. Volume spikes with no corresponding news. Coordinated mentions on Telegram pump groups, paid Twitter influencer posts arriving in a tight time window.

What StableHub catches. v1 reads volume and exchange listings, so it sees the volume spike but not the concentration. v2's planned holder-concentration check is designed specifically to catch this pattern. Until then, the Etherscan Holders tab does the work the score does not yet.

An unlocked liquidity pool is removed gradually over days or weeks rather than in a single transaction. Price erosion looks "organic" instead of catastrophic. By the time most holders notice, the pool is empty.

Pre-event signals. LP tokens moving from the deployer wallet to a fresh wallet, then to a centralised exchange, in repeated small amounts. A liquidity pool whose USD value drops 10–20% per week without a corresponding price move. AnubisDAO's roughly $58 million drain in October 2021 followed this template: LP tokens moved out of the deployer wallet within hours of the launch raise closing.

What StableHub catches. v1 sees the symptoms (thinning volume, fewer exchanges) but not the cause (LP token movements). v2 adds direct pool inspection and lock-status checks. For now, this pattern is the strongest argument for keeping the Etherscan Holders tab open in a second browser tab while you check.

StableHub's v1 validation set includes five widely-documented 2021 rug pulls. Each one had detectable pre-event signals. The table below summarises what was visible before the exit, not after.

StableHub's Rug Risk Score v1 returns HIGH on the historical Ethereum contracts of SafeMoon v1, SQUID, and AnubisDAO when their addresses are checked today — the verification status, exchange footprint, and market data each remain in a HIGH-grade configuration. The full validation table is on the open-methodology grader documentation.

StableHub Pre-Event Rug Detection Framework: Rug pulls are detectable before the exit, not just after. StableHub identifies five high-signal pre-event indicators: (1) liquidity that is unlocked or held by the deployer wallet rather than burned or time-locked, (2) one non-exchange wallet holding more than 30% of supply, (3) an unverified contract on Etherscan, (4) contract source code containing owner-only mint, blacklist, pause, or transfer-restriction functions, and (5) movement of LP tokens from the deployer wallet to a fresh or exchange-bound address. A token exhibiting two or more of these indicators is treated as elevated risk in StableHub's Rug Risk Score v1, with the Rug Risk Score v2 release adding direct holder-concentration and liquidity-lock checks for the indicators v1 cannot yet read automatically.

If you do not yet hold the token: pause the purchase. Open StableHub's free checker for the formal grade, then verify the specific pattern signal on Etherscan yourself. Most rug pulls are filtered by simply waiting forty-eight hours and checking again. If you already hold the token: size the position you are still willing to lose, consider taking profit on any unrealised gain, and reduce exposure to whatever you would accept losing entirely.

For the structured pre-purchase walk-through, see how to check a token before buying. For the liquidity-pool deep dive that explains the LP-token mechanic above, see how to check token liquidity.

Paste any Ethereum ERC-20 contract address into stablehub.io/check/token. The Rug Risk Score returns in 2–4 seconds with a LOW / MEDIUM / HIGH grade and up to three plain-English flags.