Memecoin Rug Pull: How to Spot One Before You Buy

A memecoin rug pull happens when the people behind a token take the money out and leave buyers holding something they can't sell. It can take one transaction or a week of slow selling. Either way, the price ends up near zero.

I've launched tokens on pump.fun myself, so I know what the dev side of a launch looks like. That is why I trust a few simple checks more than a gut feeling. None needs a paid tool, and together they take about five minutes.

This guide shows how to spot a rug pull with six checks: the liquidity lock, mint and freeze authority, token holder concentration, dev wallet activity, fake volume and bot-driven hype. I'll also be clear about the limit. Passing every check does not make a coin safe. It only removes the cheapest ways to get burned.

What is a memecoin rug pull and how does it work?

The classic version is a liquidity rug. The creator adds liquidity to a decentralized exchange pool so people can trade. If the LP tokens, which represent ownership of that pool, are not burned or locked, the creator can withdraw the liquidity and the token becomes worthless at once, as Smithii's rug check explains.

There are other routes:

• Minting unlimited new tokens and selling them into the pool.
• Removing the pool altogether.
• Dumping a large holding so buyers cannot sell at a fair price.
• A soft rug, where liquidity is pulled slowly to avoid notice.

Pump.fun changes the picture. Tokens trade on a bonding curve with no seeded liquidity. At a market-cap threshold, liquidity migrates to PumpSwap and the LP tokens are burned, according to the pump program docs on GitHub. The old withdraw instruction in those docs is now disabled. The textbook liquidity pull is hard on that platform.

That does not end the risk. Solidus Labs argues the bonding curve favors creators and early buyers and leaves late buyers exposed when creators sell. The rug just looks different: insiders accumulate quietly, then sell into you.

How common is a memecoin rug pull?

The honest answer is that it depends on how you define a rug. Two major studies give very different numbers.

Solidus Labs covered pump.fun tokens created from January 2024 to March 2025. More than 7 million had at least five trades, but only 97,000 kept liquidity above $1,000. Solidus's report labels about 98.6% as pump-and-dumps or rug pulls, though its executive summary says 98.7%. CoinDesk covered it on May 7, 2025. On Raydium, 93% of 361,000 pools showed soft-rug traits, with a median rug of $2.8K and a largest of $1.9M.

Chainalysis used a stricter test: an address that added liquidity, then removed at least 65% of the pool, valued at $1,000 or more. Of 2,063,519 tokens launched in 2024, 74,037 (3.59%) matched. About 94% of those pools were drained by the address that created them.

Pump.fun rejects the 98% framing. Spokesperson Troy Gravitt said, "What Solidus Labs lacks is a basic understanding of memecoins." Chainalysis itself notes that many abandoned tokens may simply have lacked interest. The two figures measure different things, so I don't treat them as one number.

Most rugs are small, and the creator's wallet is usually the one holding the exit.

How to spot a rug pull: is the liquidity locked or burned?

Start with the liquidity lock, because it closes the oldest exit. Free scanners read it for you. RugCheck is a free Solana scanner that checks more than 20 on-chain signals and shows the USD amount locked, the unlock time and the locker program. Smithii's rug check is also free and needs no wallet connection, which is a good safety habit on its own.

What to look for:

• Burned LP: permanent. The creator cannot pull that pool.
• Locked LP: temporary. Note the unlock date and how much is locked.
• Neither: the creator may be able to withdraw the pool at any time.

On pump.fun graduations the docs say LP tokens are burned, so the lock question is settled there. Locks matter most on other pools, such as Raydium, where Solidus found soft-rug traits in 93% of sampled pools.

One warning. Burned liquidity does nothing about a few wallets holding most of the supply and selling into you. A clean result here answers one question only: can the pool be pulled? It says nothing about who owns the tokens. That is the next check.

What do mint and freeze authority tell you?

These are two switches on a Solana token, and you want both off. Per Solana's token docs, a mint account can store a mint authority and a freeze authority.

• Mint authority: if it is empty, supply is fixed and no more tokens can be minted. If someone still holds it, they can create new tokens and sell them into the pool.
• Freeze authority: a frozen token account cannot receive, transfer or burn tokens until it is thawed. That is the "can't sell" risk.

Buyers cannot revoke either one. Only the current authority holder can. Revocation is permanent and takes a single wallet signature, so a creator who revokes has given up real power. That is a good sign. A creator who keeps the authorities is keeping options open, and I treat that as a red flag.

RugCheck and Smithii also flag mutable metadata, which means an update authority could change token information later. It is a smaller risk, but a token whose details can change after you buy deserves a second look.

Again, a pass is narrow. Revoked authorities fix the supply and freeze risks. They say nothing about who holds the supply.

How do you check token holder concentration and the dev wallet?

Concentration is where a lot of the real risk hides. Open the holder list on RugCheck or Smithii and see how much supply sits in the top wallets. Treat the top-10 percentage as a heuristic, not a verdict. Some large holders are exchanges, liquidity pools or the bonding-curve contract itself.

The harder problem is hidden links. Bubblemaps defines a bundle as multiple wallets buying within the same block or within seconds of launch, and a cluster as wallets connected by common funding sources or transfer patterns. A holder list can look spread out while one party controls most of it. Bubblemaps added an insider-screening feed on September 16, 2026, per Invezz.

Robinhood Chain shows why. The Block reported on September 27, 2026 that analyst Wazz linked at least $18.43 million in extractions from 53 launches, between July 10 and September 21, to one operation. That is one analyst's allegation, but the lesson stands: a top-10 check can pass while a cluster check fails.

Then check the deployer:

• Read its history. Repeat launchers whose earlier tokens died within days are a flag.
• Trace its funding. In the LIBRA case, the wallet that funded the main creator wallet was also linked to the MELANIA creator, per Investing.com's report on Bubblemaps' findings.
• Watch for early sells on an explorer such as Solscan.

This matters because Chainalysis found about 94% of suspected drained pools were emptied by their creator address.

How do you spot fake volume and bot-driven hype?

Volume looks like proof of interest, but it can be bought. Bitquery's analysis of Solana DEX data from April 27 to 28, 2026 found one wallet seeded 200 bots with half a SOL each. The bots wash-traded one memecoin and faked over half a million dollars of volume in 12 hours. Bitquery also found that 96% of the wallets both bought and sold the same token.

The simple test is a mismatch between volume, holders and liquidity. As a hypothetical, $5 million in 24-hour volume with 400 holders and $60,000 of liquidity should make you suspicious. Check for:

• Volume far out of proportion to liquidity.
• Few holders for the trading activity claimed.
• Wallets that buy and sell the same token in near-equal amounts.

Social hype is softer than on-chain data, so this is my read from watching launches: new accounts with bulk followers, repeated reply text, and engagement that does not match follower counts. Be extra careful with celebrity endorsements. LIBRA was promoted by Argentina's president in February 2025, then collapsed, with insiders reportedly cashing out over $107 million and nearly 94% of the value gone in under four hours, per Cointelegraph.

What's still unknown about spotting a memecoin rug pull?

Here is what the data and my own checks don't settle.

• Pump.fun's graduation numbers. Sources conflict: a $69,000 graduation market cap versus $80,000 to $100,000, and $10,000 to $15,000 of migration liquidity versus $12,000. Check pump.fun directly.
• Default authorities. I have not found a primary source saying pump.fun tokens always launch with mint and freeze authority revoked, so I read it off the scanner each time.
• BOOST mode. Pump.fun's feature reportedly redirects part of migration funds into buybacks and burns over five minutes. The year it became the default is unclear, and so is its effect on early-minute risk, since the first candle after graduation may include programmatic buying.
• Fresh numbers. I found no 2025 or 2026 equivalent of the Solidus and Chainalysis token-level rates, and no primary Chainalysis figure for 2025 rug-pull losses. A widely repeated $2.8 billion claim has no primary source I could find, so I left it out.
• Bots and socials. BeInCrypto cited Dune data in May 2025 putting bots at 60% to 80% of pump.fun volume, but the method is unclear. I have no solid data on fake followers or bot replies.
• Scanner blind spots. Token-2022 extensions such as transfer hooks, permanent delegates and transfer fees are not covered here. Nor is how scanners count exchange, LP and bonding-curve wallets, or how accurate free scanners are, since I found no independent false-negative data.

Bottom line

A memecoin rug pull usually leaves clues. Locked or burned liquidity, empty mint and freeze authorities, a holder list without hidden clusters, a clean deployer history, volume that fits liquidity and hype that looks organic: each one closes off a way to lose money, and free tools cover most of them in a few minutes.

But passing every check does not make a coin safe. Burned LP and revoked authorities do not stop insiders from dumping, hidden clusters can beat a simple holder check, and Chainalysis found only 1.7% of 2024 tokens were actively traded in the last 30 days. Even clean tokens mostly fade. Use scanners as a first filter, read them flag by flag, and never treat a green score as a promise.