A crypto rug pull happens when the people behind a project drain its liquidity pool or sell their token allocation without warning, leaving investors holding worthless coins. The phrase comes from the image of yanking a rug out from under someone. It's fast, it's intentional, and in most cases the perpetrators are never identified. Australian investors lost an estimated AU$4.2 billion to crypto fraud between 2021 and 2025 according to ACCC data, with rug pulls making up a significant portion of that figure.
They're not all the same. Some rug pulls are sudden exits where founders disappear overnight. Others are slower "soft pulls," where developers quietly sell down their allocation over weeks while the community still believes in the project. Both types end the same way: investors can't sell their tokens for anything meaningful, and the team is gone.
How a rug pull actually works
Most rug pulls follow a predictable structure, even if the branding changes every time. A team launches a token, usually on a decentralised exchange like Uniswap or PancakeSwap. They pair it with a major asset (ETH or BNB typically) to create a liquidity pool. Early buyers drive the price up. Marketing ramps up on X, Telegram, and Discord. Then the team removes the liquidity they seeded, or dumps the large token allocation they held from launch, crashing the price to near zero. The whole cycle can run from days to months.
The mechanics matter because they reveal the detection window. Before the pull, several structural signals are usually present. Developers retain a large share of the token supply. The liquidity isn't locked. The smart contract has functions that allow minting of new tokens or restricting sells. None of these facts are hidden; they're on-chain. Most investors simply don't look.
Red flags to check before you buy
The single most useful check is the token's smart contract. Tools like Token Sniffer and DEXTools will flag common vulnerabilities: honeypot functions that let developers prevent you from selling, mint functions that allow supply to be inflated at will, and blacklist functions that can freeze your wallet. Run every new token through at least one of these before touching it.
Beyond the contract, watch for these structural problems:
- Unlocked liquidity. If the liquidity provider tokens aren't locked via a service like Unicrypt or Team.Finance, the pool can be drained at any time. Check this on DEXTools before buying.
- Anonymous team with no verifiable history. Pseudonymous teams aren't automatically fraudulent, but a launch with no prior GitHub commits, no audits, and no named founders carries much higher risk.
- Token concentration. If the top 10 wallets hold more than 40–50% of supply, a coordinated sell from any one of them can crater the price. Blockchain explorers like Etherscan show holder distribution for free.
- Copied or plagiarised whitepapers. A quick web search of a few sentences from the project's whitepaper will often reveal it's lifted from another project verbatim.
The social signals matter too. Paid influencer promotions, engagement pods that flood comment sections with identical replies, and Telegram groups where criticism is immediately deleted are all soft indicators. They're not proof of fraud on their own, but they cluster around projects that later turn out to be exits.
Soft pulls vs hard pulls
A hard pull is the overnight vanish: liquidity removed, social accounts deleted, website offline by morning. These are the easiest to recognise in hindsight and the hardest to catch in advance because the window between suspicion and execution is short.
A soft pull is subtler. The team stays visible and communicative while their wallets steadily offload tokens into buy pressure from new investors. Price action during a soft pull often looks bullish on short timeframes but shows consistent sell pressure from a small number of wallets on-chain. Watching the dev wallet activity using a crypto portfolio tracker or a dedicated wallet monitoring tool can surface this pattern before the exit completes.
Soft pulls are also harder to prosecute. If a team can argue they simply lost confidence in the project and sold their holdings, that's not obviously criminal under current Australian law. The legal threshold for fraud requires demonstrating intent to deceive from the outset, which is difficult to establish.
What Australian law says
Rug pulls sit at the intersection of several Australian legal frameworks and none of them offer clean remedies. Under the Criminal Code Act 1995, fraud requires dishonest conduct causing a financial disadvantage. If prosecutors can show the team always intended to exit, charges are possible. In practice, anonymous offshore developers make this rare.
ASIC can act when a token qualifies as a financial product. If the token was structured to give holders rights to dividends, profit sharing, or governance that resembles a managed investment scheme, ASIC has jurisdiction and can pursue the promoters under the Corporations Act 2001. The agency has used these powers before, though primarily against larger and more identifiable operators.
The ACCC's Scamwatch records rug pull complaints and shares intelligence with overseas regulators, which matters because many pulls originate from jurisdictions with no extradition arrangements with Australia. If you've been caught in one, reporting the scam to Australian regulators is still worth doing. It builds the data set that supports enforcement and may assist others who were also affected.
For tax purposes, the ATO treats a complete loss of value in a token as a capital loss, provided you can demonstrate the asset is genuinely worthless and you've abandoned it. Keep every transaction record: the original purchase, the wallet address, and any communications from the project team. A crypto tax tool with a strong audit trail is useful here.
The Squid Game token case as a template
The 2021 Squid Game token (SQUID) is the most-cited modern rug pull because the warning signs were visible and largely ignored. The token had a honeypot function preventing sells, a completely anonymous team, and it rode viral media attention with no audited code. Within five minutes of the pull, it went from roughly US$2,800 to near zero. Investors globally lost around US$3.4 million. No one was ever charged.
SQUID isn't an outlier; it's a template. The specific pop-culture hook changes, but the contract structure and the exit mechanics repeat almost identically across hundreds of subsequent projects. That's why checking the contract is more reliable than evaluating the marketing.
How to protect yourself going forward
The practical checklist is short. Before buying any new token: check the smart contract on Token Sniffer, verify that liquidity is locked and for how long, look at the holder distribution on a block explorer, and search for any independent audit. If any of these checks fail, the risk is high enough to skip.
Portfolio-level protection matters too. Position sizing in genuinely new, unaudited projects should reflect the real probability of a total loss. Keeping the bulk of your crypto holdings in established assets on AUSTRAC-registered exchanges reduces exposure. Keeping your wallet addresses private also reduces the chance of being targeted by ancillary scams that follow a rug pull, including phishing attempts and fake recovery services.
Recovery services that promise to retrieve lost funds from a rug pull are almost universally scams themselves. They charge upfront fees, do nothing, and disappear. If someone contacts you after a rug pull offering to help recover funds for a fee, that contact is the second scam.
Rug pulls work because they exploit the same impulse that drives legitimate early-stage crypto gains: getting in before the crowd. The best defence is slowing down long enough to check what you're actually buying before the crowd arrives.