What exactly is pulled in a rug pull?

The liquidity. In an automated market maker, a token is only sellable because someone deposited a pool of that token alongside a valuable asset. Whoever controls the pool deposits can withdraw them, and once they do there is nothing on the other side of a sale.

Is a rug pull the same as a pump and dump?

They overlap but are not identical. A pump and dump sells into demand at inflated prices and leaves buyers with a token that still trades. A rug pull removes the ability to trade at all. Many schemes do both: promote, sell, then pull what remains.

Is a rug pull illegal if the token is not a security?

Yes. Wire fraud does not require the asset to be a security or a commodity — it requires a scheme to obtain money by deception using interstate wires. Most criminal rug pull prosecutions in the United States have been charged this way.

What is a liquidity lock and does it work?

A liquidity lock places the pool tokens in a time-locked contract so they cannot be withdrawn before a date. It genuinely prevents that specific attack, provided the lock contract is what it claims to be and the lock is long enough to matter.

Can a rug pull happen through the token contract rather than the pool?

Yes. A contract retaining an unlimited mint function lets the operator create supply and sell it. Contracts with adjustable transfer taxes or blacklists can make selling impossible for everyone but the deployer, which is sometimes called a honeypot.

Are audits reliable protection?

They help and they are not a guarantee. An audit examines code for defects; it does not establish that the team is honest, that the deployed contract matches the audited one, or that privileged keys will not be used. Audited projects have been rugged.

How quickly does it usually happen?

Sometimes within hours of launch, sometimes after months of building credibility. A longer runway allows a larger pool and a larger take, at the cost of more exposure to scrutiny.

Can funds be recovered?

Occasionally, where the proceeds move through exchanges that comply with US process, or where the operators are identified and assets are frozen. Where funds pass through mixers or non-cooperating venues, recovery is usually unsuccessful.

Who has jurisdiction?

It depends on the token's characterisation and the location of participants. The SEC acts where the token is a security, the CFTC where it is a commodity or a derivative, and the Department of Justice under the general fraud statutes regardless of characterisation.

Is anything about this genuinely new?

The technology, not the technique. A worthless instrument, promoted hard and then made unsellable, is a very old fraud. What is new is that the removal of liquidity can be executed in a single transaction, permissionlessly, in seconds.

Rug pulls

A rug pull is a crypto scheme in which the operators withdraw the liquidity backing a token, or mint unlimited new supply, leaving holders with an asset that cannot be sold at any price.

Also called liquidity pull, exit scam. Observed in crypto. One of the crypto-native manipulation techniques. 1 enforcement action in the library.
Updated 2026-09-07

How does a rug pull work?

A rug pull depends on a feature of decentralised exchanges that has no equivalent in traditional markets: the ability to sell a token exists only because somebody deposited the other side of the trade, and that somebody can take it back.

On an automated market maker, a token trades against a pool. If the pool holds 1,000 units of a valuable asset and 10,000,000 units of a new token, the formula prices the token accordingly, and anyone can swap in either direction. The pool is the market. Whoever holds the pool’s deposit receipt — the liquidity provider tokens — can withdraw the contents.

The scheme runs in five stages.

Deploy and seed. The operator creates a token and deposits a pool pairing it with a valuable asset. They hold the liquidity provider tokens, and usually most of the token supply as well.
Promote. Influencer posts, messaging-app groups, coordinated social media, sometimes paid listings on aggregator sites. The claims are about a future product, and there is rarely anything present to contradict them.
Take the inflow. Buyers swap valuable assets into the pool for tokens. The pool’s valuable side grows with every purchase. This is the money that will be taken.
Pull. The operator withdraws the liquidity, or mints an unlimited quantity of new tokens and sells them into the pool, or disables selling for everyone else. All three end at the same place.
Disperse. Proceeds move through bridges, mixers or exchanges. Speed matters more than sophistication, because on-chain analysis begins immediately.

The whole final stage is a single transaction. There is no settlement period, no custodian, no counterparty to object, and no mechanism to reverse it.

Five stages, of which only the last is instantaneous.

A worked example with real numbers

An operator deploys a token with 1,000,000,000 units of supply and seeds a pool with 20 units of a valuable base asset priced at $2,500 each, alongside 100,000,000 tokens.

Stage	Pool base asset	Pool tokens	Implied token price
Seeded	20 ($50,000)	100,000,000	$0.0005
After promotion inflow	340 ($850,000)	5,882,000	$0.1445
Liquidity withdrawn	0	0	No market

Buyers put roughly $800,000 of value into the pool. The constant-product formula pushed the implied token price up by a factor of nearly 300 as they did, which is what the price chart showed and what drew further buyers in.

At the moment of the pull:

Operator withdraws            340 base units  =  $850,000
Operator's original stake      20 base units  =   $50,000
Net taken from buyers                         =  $800,000

The remaining 900,000,000 tokens the operator never sold are irrelevant — they always were. The token’s price on any chart is now undefined, because there is no pool to price it against.

Note the two things that make this different from an equity fraud of similar size. There was no intermediary at any point: no broker took an order, no transfer agent recorded a holder, no custodian held anything. And the entire terminal event was one transaction, visible on-chain the moment it occurred but irreversible by anyone.

Why is a rug pull illegal?

A rug pull is fraud, and the interesting legal question is not whether it is unlawful but which regime reaches it.

Wire fraud is the most robust route. 18 U.S.C. § 1343 requires a scheme to obtain money or property by materially false pretences, using interstate wires. It does not require the asset to be a security, a commodity, or anything else in particular. This is why most criminal rug pull prosecutions in the United States are charged as wire fraud, sometimes with money laundering counts attached under § 1956 for the dispersal stage.

Securities fraud applies where the token is a security. Whether it is turns on the Howey analysis — an investment of money in a common enterprise with profits expected from the efforts of others — which many promoted tokens satisfy comfortably, since the entire pitch is that a team will build something valuable. Where it applies, Securities Act § 17(a) and Rule 10b-5 are available, and so is § 5 for the unregistered offering.

Commodity fraud applies where the token is a commodity and the conduct touches derivatives or, on the CFTC’s view of its own authority, spot markets. Rule 180.1 is the operative provision.

State law adds consumer protection and blue sky claims, and state regulators have been active where federal characterisation is contested.

The genuinely unsettled area is a spot token that is neither a security nor traded in derivatives, sold on a decentralised exchange to buyers worldwide. The conduct is plainly deceptive; the question is whose rules reach it and who can enforce them against an anonymous operator. Wire fraud is the answer that has worked in practice, because it attaches to the deception rather than to the instrument.

Provisions most often charged
Provision	Citation	Primary text
Wire fraud	18 U.S.C. § 1343	Read the text
Securities Act — fraud in the offer or sale of securities	15 U.S.C. § 77q(a)	Read the text
SEC Rule 10b-5	17 C.F.R. § 240.10b-5	Read the text
CFTC Rule 180.1 — fraud-based manipulation	17 C.F.R. § 180.1	Read the text
Money laundering	18 U.S.C. § 1956	Read the text

Which real enforcement actions have alleged rug pulls?

This library holds 1 enforcement action tagged rug pulls. The table shows the largest by civil penalty together with the most recently filed. Every row links to a page carrying the regulator's own release and, where one was published, the complaint.

Selected rug pulls actions
Action	Agency	Filed	Penalty	Status
SEC v. Eric Zhu (rug pulls, 2025)	SEC	2025-01-16	—	settled

All 1rug pullsaction →

How does a rug pull get detected?

Uniquely among the techniques on this site, rug pulls can be detected before they happen, because the capability is written into the contract and the contract is public.

Contract analysis. Automated scanners read the deployed bytecode for the functions that make a pull possible: an unlimited mint, an owner-only transfer restriction, an adjustable fee that can be set to a confiscatory level, an upgradeable proxy pointing at a mutable implementation. A contract with any of these is not necessarily a fraud, but it is a fraud that has been made possible.

Liquidity lock verification. Whether the pool tokens are held in a time-locked contract, burned, or sitting in an ordinary wallet. This is checkable in seconds and is the single most informative fact about a new token.

Holder concentration. The distribution of supply across wallets, and the funding history of the largest holders. Several apparently independent wallets funded from one source shortly before launch is a coordination signature.

On-chain flow analysis. After the fact, tracing proceeds through bridges, mixers and exchange deposits. This is how operators are identified, and it is why exchange compliance functions matter so much to recovery.

Promotion mapping. Which accounts promoted, when they were created, whether they were paid, and whether the same cluster has promoted previous tokens that ended the same way. Repeat promoters are a durable signal.

Contract functions permitting unlimited minting, arbitrary transfer restrictions, or unilateral fee changes, held by a single key.
Liquidity pool tokens held in an ordinary wallet rather than locked in a time-locked contract or burned.
Ownership concentration in a small number of wallets funded from a common source shortly before launch.
Promotion volume that precedes any deployed product or audited code.
Sell transactions from the deployer wallet beginning during the peak of inbound buying.

What penalties does rug pulls actually attract?

The numbers below are computed from this site's own case records at build time, not quoted from a secondary source. They change whenever a new action is added to the library.

Actions recorded: 1
Median penalty: —
Largest penalty: —
Criminal parallel: 0%
Median sentence: —

Computed from 1enforcement action in our own case library tagged rug-pulls , filed between 2025 and 2025. Median penalty covers the 0actions where a civil monetary penalty was disclosed; median sentence covers the 0 defendants who received a custodial term. Penalties exclude disgorgement and prejudgment interest, which are reported separately on each case page.

What are the red flags?

The project's liquidity can be withdrawn by whoever deployed it, and there is no lock proving otherwise.
Anonymous team, no audit, and a roadmap that is entirely future tense.
A token you can buy but where sell transactions from ordinary wallets fail or are heavily taxed.
Rapid, coordinated promotion across influencer accounts that all began posting in the same week.
Total supply held mostly by wallets created within days of the token.

The one check worth doing above all others: try to establish who can withdraw the liquidity, and on what conditions. If the answer is “one wallet, at any time”, the token has no floor, whatever else is true about it. Everything else on the list is secondary to that.

What a rug pull is not

It is not a project that failed. Most tokens go to nothing because the idea was bad and the market lost interest. That is not fraud, and treating every collapse as a rug pull makes the term useless.

It is not a price decline. The distinguishing feature is the removal of the ability to transact, not the level of the price.

It is not the same as a hack. Funds taken by an outside attacker exploiting a defect is theft from the project. A rug pull is the project taking the funds, which is why the two attract different charges and, often, different sympathy.

Frequently asked questions about rug pulls

What exactly is pulled in a rug pull?: The liquidity. In an automated market maker, a token is only sellable because someone deposited a pool of that token alongside a valuable asset. Whoever controls the pool deposits can withdraw them, and once they do there is nothing on the other side of a sale.
Is a rug pull the same as a pump and dump?: They overlap but are not identical. A pump and dump sells into demand at inflated prices and leaves buyers with a token that still trades. A rug pull removes the ability to trade at all. Many schemes do both: promote, sell, then pull what remains.
Is a rug pull illegal if the token is not a security?: Yes. Wire fraud does not require the asset to be a security or a commodity — it requires a scheme to obtain money by deception using interstate wires. Most criminal rug pull prosecutions in the United States have been charged this way.
What is a liquidity lock and does it work?: A liquidity lock places the pool tokens in a time-locked contract so they cannot be withdrawn before a date. It genuinely prevents that specific attack, provided the lock contract is what it claims to be and the lock is long enough to matter.
Can a rug pull happen through the token contract rather than the pool?: Yes. A contract retaining an unlimited mint function lets the operator create supply and sell it. Contracts with adjustable transfer taxes or blacklists can make selling impossible for everyone but the deployer, which is sometimes called a honeypot.
Are audits reliable protection?: They help and they are not a guarantee. An audit examines code for defects; it does not establish that the team is honest, that the deployed contract matches the audited one, or that privileged keys will not be used. Audited projects have been rugged.
How quickly does it usually happen?: Sometimes within hours of launch, sometimes after months of building credibility. A longer runway allows a larger pool and a larger take, at the cost of more exposure to scrutiny.
Can funds be recovered?: Occasionally, where the proceeds move through exchanges that comply with US process, or where the operators are identified and assets are frozen. Where funds pass through mixers or non-cooperating venues, recovery is usually unsuccessful.
Who has jurisdiction?: It depends on the token's characterisation and the location of participants. The SEC acts where the token is a security, the CFTC where it is a commodity or a derivative, and the Department of Justice under the general fraud statutes regardless of characterisation.
Is anything about this genuinely new?: The technology, not the technique. A worthless instrument, promoted hard and then made unsellable, is a very old fraud. What is new is that the removal of liquidity can be executed in a single transaction, permissionlessly, in seconds.

Pump and dump — A pump and dump is a scheme in which shares are accumulated cheaply, promoted with misleading claims to drive the price up, and then sold into the demand the promotion created, leaving later buyers with the loss.
Exchange wash trading — Exchange wash trading is a trading venue reporting volume that did not genuinely occur, or permitting others to generate it, in order to appear more liquid and rank higher than it is.
Oracle manipulation — Oracle manipulation moves the price source a smart contract reads, usually a shallow liquidity pool, so that a protocol values collateral wrongly and can be drained within a single transaction.
Market maker loan arrangements — A market maker loan arrangement lends token inventory to a market maker on terms tied to price or listing outcomes, creating an incentive to generate activity rather than to quote neutrally.
Chat group pumps — A chat group pump is a coordinated buying campaign organised inside a messaging group, where organisers accumulate before announcing a target and sell into the buying their announcement produces.

Terms defined on this page

Rug Pull Term · Liquidity Pool · Automated Market Maker · Token · Digital Asset · Howey Test

Sources

18 U.S.C. § 1343 — fraud by wire, radio, or television — Cornell Legal Information Institute
SEC — crypto assets and cyber enforcement actions — US Securities and Exchange Commission
CFTC — digital assets — Commodity Futures Trading Commission
SEC Rule 10b-5 — Electronic Code of Federal Regulations

Reviewed September 7, 2026. Every statute link points at the primary text. If something here is wrong, tell us — corrections are logged in public.