NFT Scams and Rug Pulls: How to Spot Them Before You Lose Real Money
Key Takeaways
Every week, someone somewhere mints an NFT project with a slick website, a Discord full of hype, and a roadmap that promises big things. A few weeks later, the developers are gone. The Discord is deleted. The money has vanished.
This is a rug pull. And it's not a rare edge case. According to CoinLaw, rug pull losses exploded to $94.8 million in 2024, and more than 60% of new meme coins launched in 2025 were flagged as potential rug pulls within 30 days. NFT rug pulls specifically made up 14% of all scam incidents in 2025.
The good news: most rug pulls leave visible traces before they happen. Here's what to look for.
What is a rug pull, exactly?
The name comes from the idiom of pulling the rug out from under someone. In the NFT world, it describes a pattern: developers build hype around a project, collect money from buyers, then vanish, taking the funds with them. The project goes dark. The NFTs become worthless. And the people who believed in it are left holding nothing.
Rug pulls aren't all identical. Some happen fast, in days or even hours. Others play out over months, with developers maintaining just enough activity to keep buyers engaged before disappearing. What they share is a deliberate intent to deceive, which is what separates a rug pull from a project that simply fails.
According to CoinLaw, NFT rug pulls made up 14% of all scam incidents in 2025, and social media drove more than 80% of investor traffic to rug pull schemes. These aren't fringe events anymore. They're a structured part of how fraud operates in the digital asset space.
The three main ways rug pulls play out
Not every rug pull looks the same, but most follow one of three mechanics.
Liquidity theft is the most direct. Developers create a token or NFT project tied to a liquidity pool, attract buyers, and then drain the pool entirely. Once the liquidity is gone, there's no way to sell. Your NFT or token is effectively frozen at zero value.
Token dumping is more gradual. The team allocates themselves a large share of the supply upfront, then spends weeks or months hyping the project on social media. When the price peaks, they sell everything at once, crashing the value and leaving other holders with losses.
Honeypot contracts are the technical version. Hidden code inside the smart contract lets buyers purchase tokens but blocks them from ever selling. By the time anyone realizes what's happened, the developers have already exited.
According to Kaspersky, hard rug pulls use malicious backdoors written directly into smart contracts, while soft rug pulls rely on the team simply dumping their tokens and abandoning the project. Both outcomes are the same: you lose.
Seven red flags to check before you buy
Most rug pulls leave traces, if you know where to look. Here are the signals that should make you pause.
1. Anonymous or unverifiable team
If the people behind a project have no public identity, no social history, and no verifiable track record, that's a risk most buyers underestimate. Anonymity isn't inherently suspicious in crypto, but it becomes a serious problem when there's no accountability layer. CoinLaw reports that 75% of rug pull projects lacked audited smart contracts, and anonymous teams are often directly correlated with that gap.
2. No smart contract audit
A legitimate project will have its smart contract reviewed by an independent security firm. This audit is publicly available and verifiable. If a project skips the audit or can't point you to one, there's no way to confirm the code does what they claim. This matters especially for honeypot contracts, which are specifically designed to look normal to casual inspection.
3. Unlocked liquidity
Liquidity should be locked into a third-party time-lock contract for a meaningful period, typically a year or more. If the team controls the liquidity directly and can pull it at any time, the only thing preventing a rug pull is their goodwill. Research cited by CoinLaw shows unlocked or short-term liquidity appears in 45% of rug pull scams.
4. Extreme hype with thin substance
Heavy promotion on Discord, Telegram, and Twitter combined with a vague or generic roadmap is a recognizable pattern. Real projects can usually explain, in plain language, what they're building and why. If every communication is about price targets and "getting in early" rather than the actual product, that's a signal worth taking seriously.
5. Concentrated token holdings
If a small number of wallets hold a large portion of the token supply, those holders can crash the market the moment they sell. This is public information on most blockchain explorers, and it takes about two minutes to check.
6. Copied or plagiarized materials
It's common for rug pull teams to copy whitepapers, roadmaps, and even website code from legitimate projects. Running a quick plagiarism check or simply Googling key phrases from the whitepaper can surface this quickly.
7. Pressure to act fast
Scarcity tactics, countdown timers, and warnings about "missing your chance" are sales techniques designed to bypass your judgment. Legitimate projects don't need you to panic-buy. If you feel rushed, that's the point.
Real-world examples worth knowing
Understanding how rug pulls look in practice makes the red flags easier to recognize.
Frosties (2022) was an NFT project that raised roughly $1.3 million before the developers deleted their Discord, took the money, and vanished overnight. What made it notable: the team had maintained active community communication right up until they disappeared. The US Department of Justice later arrested two individuals connected to the scam, one of the first federal NFT fraud prosecutions in the US.
Evolved Apes (2021) is another clear example. Investors paid for 10,000 NFTs tied to a promised fighting game. The developer, known only as "Evil Ape," disappeared with around $2.7 million after the mint. No game was ever built.
Both cases followed the same pattern: active communities, active promotion, and no meaningful accountability for the people running the project.
How to protect yourself before you spend anything
The checks that protect you aren't complicated. They just require slowing down before you commit.
- Verify the team's identity. Search their names, usernames, and wallet addresses. Look for consistent presence across platforms over time, not just recent activity tied to this project.
- Read the smart contract audit. If there isn't one, treat the investment as unverified. If there is one, check that the auditing firm is real and that the audit is recent.
- Check liquidity lock details. Platforms like DexTools or Token Sniffer let you verify whether liquidity is locked, for how long, and with which provider.
- Look at wallet distribution. Use a blockchain explorer to see what percentage of the token supply sits in the top 10 wallets. Anything above 50% concentrated in a handful of addresses is worth scrutinizing.
- Search for project coverage outside the project's own channels. If the only positive coverage comes from the project's Discord and paid influencers, that's different from coverage in neutral publications or security-focused communities.
- Trust your instincts about urgency. If a project is genuinely worth buying, it will still be worth buying tomorrow. Take the time you need.
Beyond individual research, having real-time protection matters, on both your computer and your phone. Guardio detects and blocks phishing sites and malicious links that often serve as the entry points to these scams, before you ever get to the point of connecting your wallet.
What the scale of this problem actually looks like
Rug pulls aren't occasional one-offs. They're now a structured, recurring part of the digital asset fraud ecosystem.
CoinLaw puts the average amount stolen per rug pull at around $510,000, with individual victims losing roughly $9,800 on average. Victims over 65 lost an average of $45,000 each. And more than 60% of new meme coins launched in 2025 were flagged as potential rug pulls within 30 days of launch.
CoinLedger's 2025 Crypto Crime Report found that scam addresses pulled in an estimated $12 billion in 2024 alone. Rug pulls have become more targeted and more technically sophisticated over time, even as the underlying playbook remains the same: hype, collect, disappear.
The good news is that most rug pulls are detectable before they happen. The patterns are consistent. The red flags are visible. The research takes minutes, not hours. What scammers rely on isn't technical complexity. It's your FOMO.
Conclusion
NFT scams and rug pulls are a real and growing problem, but they're not invisible. The warning signs are usually there: the team is anonymous, the contract is unaudited, the hype is outsized relative to the substance. What scammers count on is that you won't take the time to look.
Take the time. Check the audit. Verify the liquidity lock. Look up the wallets. And if something feels off, trust that instinct.
Guardio works in real time across your browser and your phone, detecting and blocking the phishing sites and malicious links that scammers use to lure people into connecting their wallets. It's one of the simplest steps you can take before you ever hit mint.
See what's at risk. Get a free Guardio scan.
FAQs
What is an NFT rug pull?
An NFT rug pull is a scam where developers promote a project, collect money from buyers, and then disappear with the funds. The NFTs become worthless and the project goes dark. It's one of the most common forms of fraud in the digital asset space.
How can I tell if an NFT project is a scam?
Key warning signs include an anonymous or unverifiable team, no smart contract audit, unlocked liquidity, and heavy pressure to buy quickly. If a project can't answer basic questions about what it's building, that's a red flag worth taking seriously.
What's the difference between a hard rug pull and a soft rug pull?
A hard rug pull uses malicious code embedded in the smart contract to steal funds or prevent selling. A soft rug pull is when the team simply dumps their tokens and walks away, crashing the value. Both result in the same outcome for buyers.
Is it possible to get money back after a rug pull?
In most cases, no. The funds are typically moved quickly through multiple wallets and converted. Some high-profile cases have led to arrests, as with Frosties in 2022, but most rug pull victims don't recover their money.
What does 'unlocked liquidity' mean and why does it matter?
Liquidity pools hold the funds that make it possible to buy and sell a token. When liquidity is unlocked, the developers can withdraw it at any time, instantly making the token unsellable. Locked liquidity means those funds are held by a third-party time-lock contract for a set period.
Do NFT rug pulls only happen on small projects?
They're most common in smaller, newer projects where there's less scrutiny. But the mechanics can apply to any project where developers control liquidity or hold large amounts of the token supply.
How does Guardio help protect against NFT scams?
Guardio detects and blocks phishing sites and malicious links that are often used to lure people into connecting their wallets to fraudulent projects. It works in real time, across your browser and your phone, so you're warned before you reach the point of exposure.
