Rug Pull Check : How to Verify the Legitimacy of a Crypto Investment

Shrewd investors are constantly searching for projects in the early stages that seem to be headed for success. After all, that’s how some investors managed to make a fortune on Bitcoin (BTC). However, “aping” into a cryptocurrency project without previously researching it can result in financial ruin. This was the case for those who fell for the Baller Ape Club NFT scam and lost $2.6 million altogether to fraudsters.

The desire for high-risk investments that promise rewards is especially strong in the cryptocurrency industry, where a steady stream of new projects generates interest and attracts new capital. However, unlike regulated financial markets, the cryptocurrency ecosystem is still developing. Bad players keep coming up with new strategies to trick unwary investors into making poor choices.

A common scam in the cryptocurrency realm is a so-called crypto rug pull. A developer or originator of the project will advertise it like a novel crypto or NFT project, only to vanish with investors’ money. The decentralized and pseudonymous nature of blockchain enables those “rug pullers” to hide their identities, making it challenging to identify bad actors.

Luckily, there are ways that help you recognize potential rug pulls and avoid losing money.

What is a rug pull in crypto?

You are probably familiar with the expression too good to be true. If something seems so marvelous that you can’t believe it’s real, then it probably isn’t. This saying applies not only to the real world but also to the world of cryptocurrency. So how does this relate to the meaning of rug pull?

The phrase rug pull originates from the expression pulling the rug from underneath. It refers to a malicious practice where cryptocurrency developers ditch a project and vanish with investors’ money. Most of these illegal schemes seem legitimate and alluring until the project’s creators decide to abruptly withdraw all investments.

Rug pulls have been prevalent in crypto projects related to Web 3.0, NFTs, decentralized finance (DeFi), and different metaverse projects. The potential for huge returns and the absence of middlemen in transactions make the developing DeFi sector vulnerable to rug pull scams. These scams are also challenging to spot early on because many new cryptocurrency projects begin in the same way. A new, alluring token appears, beguiling investors to pour money into the project hoping its value will increase.

Crypto rug pull is a common occurrence in DeFi. With the appropriate technical skills, it is simple and inexpensive to develop new tokens and list them on decentralized exchanges (DEX) without auditing a code. Code audits enable third parties to perform security checks, making sure that any related smart contracts are secure and free of flaws. Rug pull scams are frequent in the NFT industry as well, since there is a growing demand for cryptocurrency art and a steady stream of new initiatives.

How does rug pull work?

Contrary to what people believe, it doesn’t take a malicious actor to hack a protocol to perform a rug pull. They simply need to “pull the rug” i.e., swiftly vanish with the money they have taken from investors they have seduced with promises of lucrative returns. In addition to learning what they are, it’s advisable to master how rug pulls work so that you could perform a rug pull check when necessary. 

First, the scammers create a token and use marketing strategies—primarily using Twitter and Telegram—to generate some buzz around it. Next, the token is listed on a decentralized exchange such as UniSwap or PancakeSwap, typically paired with another well-known token like ETH or BNB. At this point, token creators are likely to increase marketing efforts and add a significant amount of liquidity to their pool in an effort to draw a sizable amount of exit liquidity from investors.

At this moment, unaware investors start purchasing tokens in anticipation of making enormous profits. The liquidity of the pool (typically ETH, BNB, or SOL) will be drained once the scammers are happy with the quantity of purchased tokens. Eventually, they leave only their worthless scam tokens behind. Unaware of the scam and not knowing how to check crypto rug pull, investors are frequently enticed to purchase the token pair. This is necessary in order to add liquidity to the token’s pool.

Rug pull scam example

To illustrate, suppose that you purchased the fictitious RUG token from UniSwap. To take advantage of their 1,000% APY rather than simply holding your tokens, you become a liquidity provider for the RUG-ETH pool. 

Next, you purchase an identical amount of ETH, pair it with a RUG token, and deposit both to the pool to reap yield. Once the rug is pulled, not only do you lose your RUG but also the ETH with which you purchased RUG. The RUG token is now declared worthless.

Types of rug pulls

Crypto rug pulls can be classified into two categories: hard and soft. A hard rug pull happens abruptly and without any prior notice. Investors are informed that they have been defrauded and that the project’s creators have abandoned the project after the numbers crash to zero and all tokens instantly lose their value. Optionally, developers might prefer to delay their plans for a while. This would give them an opportunity to attract more investors and thus more profit before they vanish.

In a soft pull, developers play the long game by offering their share of the profits along with a fictitious public image devoted to a project’s long-term success. Regardless of the tempo, rug pulls fall into three groups: dumping, limiting sell orders, and stealing liquidity.

Liquidity stealing

The most frequent scheme on the list of crypto rug pulls is liquidity stealing. It occurs when token creators take all of the coins and tokens invested or pooled into a project. 

The liquidity pools are expected to have enough funds to keep the program operating should investors decide to withdraw their money or perform big transactions. However, if a creator drains the liquidity, a program might not be able to run. As a consequence, investors might not be able to get their money back.

Dumping

Crypto rug pulls, also referred to as ‘pump-and-dump’ schemes, typically rely on fabricated public hype that is often generated through social media channels. They aim to beguile large groups of eager cryptocurrency investors. The scammers would boost the value of a flashy new coin related to a hot and promising project. At the perfect moment, developers sell their shares and vanish, causing the token’s value to crash for unaware investors that have remained.

Limiting sell orders

Last but not least on the list of crypto rug pulls is limiting sell orders. This is a more clandestine tactic that includes an investor’s capacity to sell crypto on an exchange, which can be tampered with at any point. After a platform has attracted a significant amount of traffic, scammers may modify the code of a project to restrict traders from buying anywhere except on their platform. Only malicious accounts are allowed to sell their coins and tokens, as all other accounts have been banned from doing so.

The biggest crypto rug pulls so far

It’s incredibly easy to fall prey to a rug pull scam if you don’t conduct thorough research and aren’t aware of what to look for. Familiarizing yourself with some of the most common tactics can help you understand the pattern and identify crypto rug pulls before they catch you off guard. 

OneCoin

In 2014, Ruja Ignatova, a self-described “crypto queen,” founded OneCoin Ltd., a cryptocurrency business headquartered in Bulgaria. In order to attract investors, Ignatova and her cronies allegedly made untrue statements about the coin and its estimated worth.

Three years later, Ignatova vanished and the exchange abruptly closed. It’s estimated that the site defrauded victims of over $4 billion in total.

AnubisDAO

Occasionally, rug pulls are easy to detect, but only if individuals take the necessary precautions and perform a thorough rug pull check. In 2021, AnubisDAO, a canine-themed DeFi initiative was launched, making claims that it was backed by a number of resources. Without a website or whitepaper, the project’s crew started a Discord server and a Twitter account. 

In return for the project’s ANKH token, investors contributed nearly $60 million worth of ether (ETH) to the project’s liquidity pool during its initial token sale. Within less than a day into the sale, the project’s primary Twitter account was shut off, the liquidity in the pool sent to a different address, and ANKH’s value plummeted to zero.

Thodex

Thodex, a centralized Turkish cryptocurrency exchange was established in 2017 and gathered around 400,000 users. In 2021, it banned users from withdrawing money. Its creator and CEO Faruk Fatih Ozer vanished shortly after. 

On the night prior to the exchange going down, some users reported that certain cryptocurrencies, such as Dogecoin (DOGE), were being traded at notably lower prices than those in other markets. Users lost a total of over $2 billion in bitcoin.

How to check crypto rug pull

Investors can safeguard themselves against rug pulls by being vigilant and looking for several telltale warning signs, such as unsecured liquidity and the absence of an external audit. The following indicators should warn users against potential rug pull scam.

Anonymous or fake founders

When it comes to the crypto industry, anonymity is no good. Anonymity provides malicious developers with numerous opportunities to execute rug pulls while avoiding accountability. Despite the fact that Satoshi, the creator of Bitcoin, remained anonymous, he never urged anyone to purchase Bitcoin, only to mine it. DeFi projects ask you to entrust them with your hard-earned money, so it is crucial that actual identities are associated with a project.

At the beginning of your rug pull check, look for the project founders. To confirm their identities and ensure that the records are accurate, look through their social media profiles. Some teams are skillful and cunning in concealing their anonymity by making fictitious Twitter or LinkedIn accounts. 

Due to this, you should assess how solid and trustworthy their information is. It’s a bad sign if they don’t engage with their followers or connections. Along with a lack of engagement, another warning sign is having a low number of followers and connections.

No liquidity locked

Inspecting if a cryptocurrency liquidity is locked is one of the simplest ways to tell a fraudulent coin from a real cryptocurrency. Nothing prevents the project’s developers from stealing all the liquidity if there is no lock on the coin supply.

Liquidity is secured via time-locked smart contracts. They should last three to five years after the token’s original offering. Though developers can write their own time locks using custom scripts, implementing third-party lockers can offer more security.

When performing a rug pull check, investors should examine the proportion of the liquidity pool that has been locked. A lock is beneficial only in proportion to the amount of the liquidity pool it protects. This amount, known as total value locked (TVL), should range between 70% and 100%.

Unrealistic returns on investment (ROI)

Always keep in mind that if something appears too good to be true, it’s likely not legitimate. Since they require a lot of liquidity to operate, scam DeFi projects frequently assert that they offer high rewards, varying from 500% to 5,000% APY. In order to identify ROI figures that are unsustainable, rely on your common sense. It will help you discern realistic from unrealistic ROI projections.

Limits on sell orders

A bad actor can program a token to restrict certain investors from trading it, while leaving others with unrestricted access. These sales restrictions are telltale indicators of a fraudulent project and crypto rug pulls in general.

It can be challenging to determine whether there is fraudulent behavior because selling restrictions are hidden in the code. One method to check this is to buy a small quantity of the new coin and then try to sell it right away. The project is probably a scam if there are issues offloading what was just bought.

The absence of external audit

A legitimate cryptocurrency project should have its smart contracts examined by an impartial audit company. Ideally, this should be done before it lists its coin or allows investors to participate. Unaudited smart contracts may contain flaws serving as a backdoor for developers or another party to steal user funds.

In order to perform a rug pull check, investors should also examine the audit report on their own. Some ventures merely claim to have undergone an audit, which can mislead investors. If you look carefully enough, an audit report might show the scammers’ intended escape route.

Skyrocketing price movement

Unexpected and colossal price fluctuations should be taken with caution. This is particularly the case with tokens that have no liquidity locked. Significant price increases for new DeFi tokens are frequent indicators of the “pump” before the “dump,” which are the elements of a pump and dump scheme. 

If something is fishy and makes you skeptical about the project, you can use a block explorer. It will help you determine the number of currency holders. If a token has only a small number of holders, it may be vulnerable to price manipulation. This is because a handful of large investors, also known as “whales,” may be capable of selling off their positions, resulting in significant and rapid drops in the token’s value.

No effort or innovation

Another sign of crypto rug pulls and scams, in general, is the absence of effort. Namely, fraudulent projects aren’t built to last. The most glaring indication of a scam is a poor-quality website. Some of them might even only post a “launching soon” landing page. 

This also holds true for fraudulent whitepapers, which frequently feature ambiguous language and prominent buzzwords such as “DeFi,” “blockchain,” “metaverse,” or “GameFi.” Additionally, the content may be plagiarized from other projects. If a protocol’s whitepaper or documentation seems nonsensical, it’s important to question its validity.

The takeaway

Scammers are always on the lookout for ways to target DeFi protocols, seeking to steal as many funds as possible. Luckily, there are methods to guard users against shady endeavors. Law enforcement organizations and regulators are continuing their efforts to prosecute cryptocurrency scammers, demonstrating a wider commitment to holding scammers responsible and deterring unethical behavior.

It’s worth keeping in mind that none of these strategies are 100% reliable. Hence, always do your due diligence using your best judgment. To navigate the space securely, Remember to safeguard your accounts and familiarize yourself with not only crypto rug pulls but also other types of scams. 

And remember, we at Veli.io have got your back. Whenever you’re in doubt or need educational advice, feel free to turn to our experts. 

Latest Articles