How to Spot Crypto Scams: Rug Pulls, Honeypots and Fake Tokens

Anyone can create a token in a few minutes, list it on a decentralized exchange and start promoting it online. That openness is part of what makes crypto interesting, but it also makes it attractive to scammers. Many schemes follow familiar patterns, and once you know what to look for, they become much easier to recognize. This guide walks through the most common types of crypto scams and ends with a checklist you can use before interacting with any new token or website.

Rug pulls

A rug pull happens when the people behind a token attract buyers and then suddenly take the money. The most common method is removing liquidity from the DEX pool. Once the liquidity is gone, holders are left with tokens that cannot be sold at any meaningful price.

Other variations include the team selling a huge pre-minted allocation all at once, or using hidden contract functions to mint new tokens and dump them. Warning signs include liquidity that is not locked, a team that controls most of the supply, anonymous developers making big promises, and aggressive marketing that pushes people to buy quickly before they have time to check anything.

Honeypots

A honeypot is a token whose contract lets people buy but blocks or heavily restricts selling. The chart may show steady price growth because only buys are succeeding, which makes the token look like a great opportunity. When victims try to sell, the transaction fails or an extreme sell tax takes almost everything.

Honeypots can be hard to detect by looking at the price alone. Signs include a chart with almost no sell transactions, unverified contract source code, functions that allow the owner to blacklist addresses or change taxes at will, and comments from people saying they cannot sell. Some security tools simulate a sale to detect this, but no tool is perfect.

Fake tokens and copycats

Token names and symbols are not unique. Anyone can create a token called the same thing as a famous project, with the same logo and ticker. Scammers use these copycats to catch people who search by name on a DEX or follow a link shared in a chat group. The fake token may even have real trading activity, which makes it look legitimate.

The only reliable way to identify a token is its contract address. Get it from the project’s official website or documentation and compare it carefully with what you see on the exchange or block explorer. If a well-known project seems to have just launched a new token on a new chain, be especially suspicious.

Mint authority, freeze authority and concentrated holders

On Solana, tokens can have a mint authority and a freeze authority. If the mint authority is still active, the holder of that key can create new tokens at any time, diluting everyone else. If the freeze authority is active, the holder can freeze token accounts, preventing people from moving or selling their tokens. Legitimate projects sometimes keep these for good reasons, but for a new, unknown token they are serious red flags. Similar powers exist on EVM chains through owner-only functions such as minting, pausing or blacklisting.

Holder concentration matters too. If a handful of wallets hold most of the supply, those wallets can crash the price by selling. Check whether the top holders are exchange wallets, liquidity pools or locked contracts, which are usually less concerning, or unknown individual addresses. On CoinBoard you can see a token’s number of holders and, for Solana tokens, whether mint and freeze authority are still enabled; the full holder list is available on the chain’s block explorer.

Fake airdrops, phishing and guaranteed returns

Not every scam involves a token chart. Many target your wallet directly:

• Fake airdrops: unknown tokens appear in your wallet with a message telling you to visit a website to claim a reward. Connecting your wallet and signing there can give the scammer permission to drain your funds.
• Phishing sites: copies of popular exchanges, wallets or DEX interfaces with slightly different web addresses, often promoted through ads, search results or direct messages.
• Fake support: people pretending to be customer support or project admins who contact you first and ask for your seed phrase, private key or remote access to your device.
• Guaranteed-return schemes: offers promising fixed daily profits, doubling your crypto, or rewards for recruiting others. No legitimate investment can guarantee returns, and these schemes typically pay early users with money from new ones until they collapse.

💡 No real project, exchange or support agent will ever need your seed phrase. Anyone who asks for it is trying to steal from you.

A practical checklist

Before buying a new token or connecting your wallet to an unfamiliar site, run through these questions:

1. Did I get the contract address from an official source, and does it match exactly?
2. Is the contract source code verified on the block explorer?
3. Is the liquidity meaningful, and is it locked or burned?
4. Do a few wallets hold most of the supply?
5. On Solana, are mint and freeze authority revoked? On EVM chains, can the owner mint, pause or blacklist?
6. Are there real sell transactions, not only buys?
7. Is the website address correct, and did I reach it myself rather than through a random link or ad?
8. Is anyone pressuring me to act fast or promising guaranteed profits?

If several answers make you uneasy, the safest choice is simply to walk away. Missing an opportunity costs nothing compared to losing funds to a scam.

Do your own research

Warning signs help, but scammers adapt constantly, and a token that passes every check can still fail or lose value. Use multiple independent sources, be skeptical of hype, and test with small amounts if you decide to proceed. Nothing in this article is a recommendation to buy or avoid any specific asset; it is educational information to help you make more careful decisions.