A Telegram group with a few thousand members can go silent in the space of a minute. It usually happens right after someone posts, in lowercase and without much explanation, that their sell order keeps failing. By the next morning the group is gone, so is the website, so are the admins, and what stays behind in your wallet is a token showing a pleasant number on screen and no buyer on the other side of it.
That gap, between the figure on the screen and the money you can actually withdraw, is the whole story. A rug pull is not an investment that went badly. It is a structure built as a trap from the first line of code. Someone mints a token, pairs it on a decentralised exchange with something of real value, pulls in buyers, then takes the valuable half out of the box and disappears.
The Carpet That Gets Pulled From Under the Market
The phrase borrows from silent comedy, the bit where someone yanks the rug and you land flat on your back. In crypto the rug is liquidity, meaning the pool of real money your sell orders get paid from. When it leaves, the price does not drift downward. It vanishes in a single transaction.
On a chart, a rug pull and an ordinary market collapse look nearly identical, and the difference shows up somewhere else entirely, in the wallets that sold and in the contract sitting behind the token.
Telling a Loss Apart From a Theft
Someone who bought Ethereum at the top and exited forty percent down lost money honestly. Liquidity stayed where it was, and the exit was available at any point.
In a rug pull that option never existed. Either the liquidity pool was drained, or the contract blocked selling outright, or the team held such a large share of supply that their exit flattened the price on its own. The distinction matters legally as much as economically, because one is called market risk and the other is called fraud.
What Happens Inside a Liquidity Pool
On a decentralised exchange there is no human counterparty waiting to take the other side of your trade. There is a shared pool holding two assets. You put one in, you take the other out, and the price adjusts on its own. Whoever deposits liquidity first receives tokens certifying their share of that pool, and can withdraw it whenever they choose.
That is the knot. If the founder keeps control of those certificates, he holds a key to the back door, and the classic version of this takes under a minute, just long enough to pull the ETH or SOL out of the pool.
The LIBRA episode from February 2025 showed the mechanism at a scale few people thought possible. Lookonchain traced at least eight wallets connected to the project that drained roughly 107 million dollars, while Bubblemaps had flagged before launch that 82 percent of supply sat unlocked. Buyer losses are estimated at around 251 million dollars, spread across some 114,000 wallets.
The full breakdown of this fraud pattern, with every reference case and the Romanian legal framework attached, was published by Cryptology.ro, the Romanian-language crypto news and analysis outlet that tracks on-chain security closely and keeps a current cryptocurrency list for readers following the local market.
Contracts Built So You Cannot Sell
The second family of traps has nothing to do with liquidity at all. These are tokens where the sell function is disabled from the start for everyone except a handful of privileged addresses. You buy, you watch the number climb, you hit sell, and the transaction fails. That contract is called a honeypot.
Variants run from ninety nine percent sell taxes through to functions that let the founder freeze your address on command. All of it is visible in verified code, and some of it shows up directly in the reports free scanners generate.
The Cases That Shaped the Vocabulary
SQUID remains the textbook example. Launched on PancakeSwap in October 2021 around the story of a play to earn game inspired by a Netflix series, it climbed from 628 dollars to over 2,850 in roughly ten minutes on 1 November, then collapsed to a fraction of a cent. Only the creators could sell, and everyone else found that out at the moment they tried to leave.
AnubisDAO raised the equivalent of about 60 million dollars on 28 October 2021. Roughly twenty hours after the sale opened, liquidity moved to an unknown address, and the keys had been sitting with one person rather than in a multi signature wallet.
The Frosties collection, 8,888 NFTs that sold out in January 2022, disappeared within hours along with about 1.1 million dollars. The ending here is different, because Ethan Nguyen and Andre Llacuna were arrested two months later, according to the United States Department of Justice.
Thodex shifts the conversation from token level to platform level. The Turkish exchange froze withdrawals abruptly in April 2021 and its founder fled to Albania, with crypto assets Chainalysis valued at 2.6 billion dollars. No amount of contract checking helps if your savings sit on a platform that cannot prove client assets are held separately, and the difference between a crypto wallet and a fiat wallet becomes very concrete at that point.
The grey zone completes the picture. Mantra’s OM token collapsed in April 2025, wiping out more than 5 billion dollars in market capitalisation, and the explanations stayed contradictory throughout. For the small investor the money disappears at the same speed whether bad faith or incompetence sat at the other end of the wire.
Why Capable People Still Walk Into It
Engineers and accountants have bought into these projects. They were not naive, only in a hurry. The pressure not to miss out works better than any technical argument.
The 2026 Chainalysis report estimates roughly 17 billion dollars stolen through crypto fraud during 2025, with rug pull schemes accounting for somewhere between 1.8 and 2.8 billion of that. Around 62 percent of memecoins launched last year were flagged as probable fraud within their first thirty days, and the production rate now exceeds 5,000 new tokens a day. Deepfakes generated with artificial intelligence fuelled another 4.6 billion dollars in losses, which means a video of a recognisable person endorsing a project proves nothing anymore.
The Checks That Fit Into Ten Minutes
Etherscan, BscScan and Solscan cost nothing and will tell you whether the contract code is publicly verified, when it was created, and how supply is distributed. Look for the functions that can hurt you, mint, blacklist, pause, or taxes that can be changed after launch.
Check next whether liquidity is locked and, more importantly, for how long, because a thirty day lock is effectively an announcement that the exit is already scheduled. Even then a lock covers one type of attack only, since the team can still be holding half the supply.
The last check concerns holders. Tools like Bubblemaps reveal whether dozens of seemingly unrelated addresses were funded from the same source. Look at the top twenty holders, ignoring exchange contracts and the liquidity pool, and if a handful of wallets control the majority, no further information is needed. An audit verifies code vulnerabilities at one moment in time, not the intentions of the founders.
Mihai Popa, analyst and journalist at Cryptology.ro, keeps returning to a detail almost everyone skips, the age of the contract, since projects with a lifespan shorter than six months account for a large share of documented fraud. Waiting a few weeks removes a substantial slice of risk and costs nothing.
What European Regulation Changes and What It Leaves Untouched
Romania offers a useful snapshot of how fast retail participation has grown. As of 31 March 2026, roughly 600,000 Romanians held crypto, close to double the total number of investors registered with the Bucharest Stock Exchange.
Emergency Ordinance 10/2025 transposed MiCA into Romanian law and named the Financial Supervisory Authority as lead regulator, with the transition period closing on 30 June 2026. Domestic implementation lagged behind, so the larger platforms serve local users through European passporting from another member state.
What MiCA does not touch is precisely where most of this fraud originates. A token launched anonymously on a decentralised exchange has no identifiable issuer, files no prospectus and answers no letters. Understanding how decentralised applications work or what a DAO is helps very little if the ownership structure of the token remains unverified.
What to Do the Morning After
The first move is technical rather than emotional. If you signed approvals for that contract, it may still hold permission to move other tokens out of your wallet, so open revoke.cash or your wallet’s own approval manager and cut every permission tied to it.
Then gather evidence while it still exists, meaning screenshots, transaction hashes, dates and exact amounts at the rate that applied on the day. In Romania the path runs through a criminal complaint with the cybercrime units of the police, a referral to DIICOT for serious cases, and a report to the National Cyber Security Directorate through pnrisc.dnsc.ro or the 1911 line. Most jurisdictions have equivalents, and the sequence matters more than the specific institution.
In the majority of cases the money does not come back, because blockchain transactions are irreversible and the perpetrators usually sit in another jurisdiction. The European Securities and Markets Authority warns about a second wave of scammers who claim to represent a public institution and offer to recover lost funds for a fee. Tax authorities offer no comfort either, since gains are taxed while losses from crypto trades are generally not deductible, which is worth knowing before you file. Romanian readers can see what documents the tax authority expects if they traded during the year.
The Discipline That Outlasts Any Checklist
What protects you is not tooling but position size in something you do not fully understand. In a new token you put in exactly what you could lose without changing your month. If the thought tightens your stomach, the amount is too large, not the project too good.
The second rule concerns time, because urgency is the scammer’s working instrument rather than a feature of the market. The third concerns wallet hygiene, meaning a separate wallet for experiments and serious savings on a hardware device.
This market sells you real things and forged versions of them in the same feed, whether you are looking at a fresh token or at the CeDeFi model. What separates the two is a handful of minutes nobody will spend on your behalf. Open the block explorer before you open your wallet.
