How to Spot a Rug Pull On-Chain, Before You Buy

A rug pull is when the people who created a token take the money and leave. The chart looks healthy right up until it doesn't, and by the time the candle tells you anything the liquidity is gone. Charts are the wrong instrument for this particular danger.

The blockchain is the right one. Every rug leaves the same fingerprints in public data before the price ever moves: who holds the supply, when those wallets were created, and where their money came from. Three questions, three queries, about five minutes. Every number on this page came from a live query you can run yourself.

What a rug pull is

The same three queries answer both sides. You are not looking for a scam label — you are checking whether the holder set is independent.

Mechanically, a rug pull is a liquidity event. Someone controls enough of the supply — or enough of the pool — to sell into every bid at once, and does. The token does not gradually decline; it gaps to near zero in a single block.

It is detectable because it requires concentration. To take the money out, a small number of related wallets must first hold enough to matter — and that concentration exists on chain before the exit, sitting in public view. It looks nothing like the ownership structure of a token with real distribution.

So the check is not "is this a scam" — that question has no data behind it. The check is narrower and answerable: is the holder set independent, or is it one entity wearing several addresses?

Signal 1: who actually holds the token

The ten largest holders of a healthy token, live from token_holders. All 10 are labeled exchanges — $1.82B of net inflow between them. A rugged token’s top ten look nothing like this.

Start with the largest holders and look at what they are, not just how much they hold.

Genuine distribution shows a top-ten dominated by entities you recognise. The chart above is a real query against a healthy token: all ten of the largest holders resolve to labeled exchanges — Binance, Robinhood, Upbit, OKX — with $1.8 billion of net inflow between them. Those addresses belong to venues holding coins on behalf of thousands of separate customers. That is what distributed supply looks like from the outside.

Now picture the inverse, which is what a rug returns. Ten addresses, none labeled, none recognisable, sitting on the bulk of the supply between them — no exchange, no market maker, no institution, just anonymous wallets that appeared from nowhere and hold everything. None of that is illegal. Plenty of legitimate early-stage tokens look the same on day one, which is exactly why you check the next two signals rather than stopping here.

Signal 2: how old the wallets are

When each top holder first appeared on chain. They are spread across years. In a rug, this chart collapses into a single vertical line a few days before launch.

Concentration alone proves little. Concentration in fresh wallets proves a great deal.

Every address carries a first-seen date, and it is the single most underrated field in on-chain analysis. The holders in the timeline above first appeared across a span of years, the earliest in 2023. They accumulated at different times, for different reasons, through different venues — the signature of independent actors who each arrived on their own schedule.

In a rug, that timeline collapses into a single vertical line: ten wallets created within days of each other, all just before the token launched, none with any history that predates it. Real holders have a past. Wallets built to warehouse a scam's supply do not, because they were minted for one job and never used before it.

When I look at a token now, wallet age is the first thing I check, before price or volume or anything else.

Signal 3: where the money came from

Two hops out from one large holder, via wallet_trace at a $1M minimum. 10 of 12 wallets reached are labeled exchanges or market makers. A rug’s trace converges on one unlabeled funder instead.

The third question is the one that actually settles it: follow the funding backwards.

Trace outward from a large holder and you get a graph of who funded whom. In the trace above — two hops, at a one-million-dollar minimum — most wallets reached resolve to labeled exchanges and a market maker. The money arrives from many independent directions, which is what happens when unrelated people buy the same asset.

A rug's trace does the opposite. Follow each anonymous top holder back and the paths converge, usually within a hop or two, onto one funding address. That convergence is the tell, and it is very hard to hide, because someone paid the gas to create those wallets and the chain remembers exactly who. The mistake I made early was reading each suspicious wallet on its own. They only mean anything as a group.

The five-minute check

The whole check, in five queries. Each is a single call you can run yourself — the same calls that produced every figure on this page.

Run these before you buy anything with a short history. None takes longer than a query.

Those five steps are the whole method, and each maps to exactly one query: token_holders for who owns it, wallet_trace for where the funding came from, token_transfers for who is selling into the bid right now. Note what none of it requires — no insider knowledge, no paid data, no judgement about anyone's intentions. If the answers come back "anonymous, days old, one funder, cluster is distributing" you have learned something concrete, and the price chart told you none of it.

Pair it with the chart rather than replacing it. On-chain data tells you who is positioned and how they got there; a candlestick pattern or an RSI reading tells you what price is doing about it. The two answer different questions and neither substitutes for the other.

Where these signals fail

Here is the honest section, and for this method it needs to be a long one.

These checks produce false positives constantly. A brand-new legitimate project also has fresh wallets, concentrated supply and a single funding source — because that is simply what launching looks like. Early-stage distribution is indistinguishable from a scam's distribution on day one. Anyone telling you otherwise is selling something.

They also produce false negatives. A patient operator can age wallets for months, fund them from separate exchange withdrawals, and defeat every signal here. Sophisticated rugs look clean precisely because the operators know these checks exist.

And labels are incomplete. An unlabeled wallet is not a suspicious wallet; it is a wallet nobody has labeled yet, which still describes the vast majority of addresses on any chain, so treating "unlabeled" as "guilty" will have you skipping perfectly good tokens for no reason at all. Read it as a flag, never a verdict.

So the method buys you a shift in the odds rather than any certainty — and it filters out the lazy scams, which, thankfully, are most of them.

Frequently asked questions

Can you detect a rug pull before it happens? Sometimes. You can detect the conditions that make one possible — concentrated supply in related, freshly-created wallets. You cannot detect intent, and plenty of tokens with that structure never rug.

What holder concentration is dangerous? There is no single number, which is why concentration is the weakest of the three signals alone. Ten anonymous wallets holding most of the supply matters far more than the percentage itself.

Does an unlabeled wallet mean something is wrong? No. The large majority of wallets are simply unlabeled, because nobody has gotten to them. It matters only in combination — unlabeled and freshly created and commonly funded.

Do these checks work on every chain? The logic does, since it only relies on public transfers. Coverage of labels and history varies by chain, so a wallet that looks anonymous on one chain may be well known on another.

This is educational material, not financial advice. On-chain signals describe probabilities, not certainties, and every real trade carries real risk — size positions so a wrong read costs little.

Read the DeFi primer