A rug pull is a plan that the deployer sets in motion before the token ever trades rather than a market accident, and the warning signs are usually visible on chain before the price collapses. Detecting a rug pull before investing comes down to four checks: the deployer, the deployer's funding source, the liquidity source, and the top holder list. You do not need to be a security researcher to run them. You need the right questions and the right tool. The checks below are the exact steps a deployer is betting you will skip.
Check the Deployer, Not Just the Chart
A green price chart tells you what buyers are doing right now. It does not tell you who created the token, where their funding came from, or who would profit from a sudden sell. Most rug pulls share the same anatomy. The deployer pre-mints or accumulates a concentrated holding, manufactures fake liquidity so the chart looks alive, and then sells everything into that liquidity the moment enough retail buyers arrive.
A chart cannot show intent. It only shows price and volume, and both of those are easy to manufacture for a short window. A deployer who controls the supply and the pool can paint whatever chart they want until the exit happens. The questions that actually matter, deployer identity, funding origin, and holder concentration, are all answered on chain rather than on the chart. That is why the first reflex should be to open the token on an investigation platform and look at who created it. Price tells you what happened. The deployer graph tells you what was planned.
The Red Flags of a Potential Rug Pull
Three signals show up again and again before a rug pull. None of them requires advanced analysis, and each one is visible before the price collapses. Regulators watch for these patterns too. The FATF red flag indicators list warning signs such as unusual transaction patterns, hidden sender profiles, and unexplained sources of funds.
The first signal is the deployer's funding source. A high-risk signal is a deployer whose funding came from a mixing service or an instant swap that requires no identity check. That is the path someone takes when they do not want the wallet connected to a real identity. A legitimate founder rarely hides the origin of their own starting funds. A mixing service or an identity-free swap is a fast way to fund a wallet that no one can tie back to a person.
The second signal is the liquidity source. Another high-risk signal is liquidity manufactured by a large number of dispersed addresses buying at the same time. That pattern makes a thin pool look deep. A pool funded by dozens of synchronized accounts is a stage built for a single exit, not a genuine market. The synchronized accounts do not reflect demand. They simulate it long enough to attract real buyers.
The third signal is the holder structure. A third high-risk signal is a top holder whose position rivals the liquidity pool and traces back to the deployer address. That is the exact position a rug pull dumps from. When the largest holder outside the pool is the same entity that launched the token, the exit is already positioned.
The Four-Step Due Diligence Workflow
The workflow below turns the same signals into steps, in the order that catches the most common rugs first. Each step is one graph action in an investigation platform.
Step one is the deployer. You enter the token contract address and open the contract creation edge to locate the deployer address. The deployer is the wallet that created the contract, and it is the single most important node in the whole story.
Step two is the deployer's funding. You follow the deployer's inbound transfers back to their origin. A funding trail that ends at a mixing service or an identity-free swap is the red flag described above.
Step three is the liquidity. You read the addresses that funded the pool, watching for the synchronized cluster described above, and you confirm the pool's tokens are actually locked. The SEC has charged an engineer who kept liquidity pool tokens unlocked and drained the pool, a case the agency described as a rug pull.
Step four is the holders. You read the top holder list and compare the biggest positions against the liquidity pool. A top holder that matches the pool size, and that connects back to the deployer, is the exit position waiting to happen.
How MetaSleuth Makes Due Diligence Concrete
The four checks sound simple until you try to run them by hand across a token with hundreds of holders and thousands of transfers. This is what MetaSleuth turns from a checklist into a concrete workflow. You paste the contract address, and the platform surfaces the deployer, the funding trail, and the top holder list as a connected graph you can read at a glance. The liquidity check becomes reading the pool's funding addresses on that same graph. Instead of trusting a claim in a project's announcement, you read the graph and let the addresses answer for themselves.
MetaSleuth's published analysis of the SHAR dump, a Solana token that launched in October 2024, shows the pattern after the fact. A cluster of funded addresses bought within two minutes of launch, spread the holding across fresh addresses, and sold about half the supply in a single minute. The realistic pre-investment signals are the ones above, checked before you buy, not the hindsight graph. The same case is walked step by step in How to Trace a Crypto Wallet Address.
The next time you look at a token, run the four steps before you buy. Paste the contract address, check the deployer, trace the funding, and read the holders. Check a token with MetaSleuth and walk the workflow on the projects you are about to back. To read fund flows the way this workflow assumes, see How to Visualize Crypto Money Flows. The goal is to remove the blind spots that a rug pull depends on, not to eliminate risk.
