How to Spot Solana Rug Pulls Before They Happen in 2026

In the first half of 2025 alone, researchers identified 76,469 rug-pull tokens out of 100,063 newly issued on Solana's three largest DEXs — that is a 76% scam rate (Sun Yat-sen University, arXiv 2026). The median lifecycle of these fraudulent tokens? Less than one hour. The 75th percentile does not even reach five hours. By the time most traders realise they have been rugged, the creator has already drained the pool, laundered the proceeds through a mixer, and launched the next token under a fresh wallet.

If you trade newly launched Solana tokens, the odds are overwhelmingly stacked against you. But "overwhelmingly" is not "inevitably." With the right checklist, tools, and discipline, you can filter out the vast majority of scams before you connect your wallet — and protect your capital for the opportunities that are legitimate.

This guide gives you the complete framework: the three types of Solana rug pulls and why they differ from Ethereum, the exact on-chain red flags to check, the free tools that automate detection, and a step-by-step safety routine you can run in under 90 seconds per token. Already holding a position you are unsure about? Run the numbers through the free crypto profit/loss calculator to see where you actually stand, or use the position size calculator to ensure you are never overexposed on a single trade.

Yes — but not with 100% certainty, and not by checking a single metric. Rug-pull detection works by layering multiple on-chain signals together. No single check is foolproof (scammers evolve), but combining five to seven checks eliminates the vast majority of scams before they can take your money.

Total time per token: under 90 seconds. That 90-second routine can save you from a loss that happens in under 60 minutes. The rest of this guide explains exactly how to perform each check and which free tools to use.

Unlike Ethereum, where rug pulls often exploit malicious smart-contract logic — hidden mint functions, sell-blocking code, honeypot modifiers — Solana tokens all run on the unified SPL Token program. Creators cannot inject custom backdoor functions into the token code itself. This means Solana rug pulls rely entirely on on-chain behavioral manipulation rather than contract-level exploits.

Academic research from Sun Yat-sen University (2026) categorises the 76,469 confirmed Solana rug pulls into three distinct types:

Type 1: Freeze Authority Abuse (461 tokens — 0.6%)

The creator retains the SPL Token freeze authority after launch. Once victims buy the token, the scammer executes a FreezeAccount instruction on their wallets — locking them so they physically cannot sell. Meanwhile, insider wallets remain unfrozen and freely dump their holdings. The token appears tradeable on DEX Screener (price exists, chart exists, buy transactions go through), but selling is impossible. A small percentage of total rug pulls, but devastating for victims because there is zero exit. On DEX Screener, these tokens show a tell-tale pattern: dozens or hundreds of buys with zero or near-zero sells.

Type 2: Liquidity Withdrawal (15,606 tokens — 20.4%)

The most "classic" rug pull. The creator seeds a Raydium, Orca, or Meteora pool with initial liquidity (SOL + the new token), promotes the token to attract buyers, then withdraws the LP tokens — which they never locked or burned — draining the pool entirely. Price goes to zero instantly because there is no liquidity left to sell into. This is the easiest type to prevent: if LP tokens are burned or permanently locked in a third-party vault, this attack is structurally impossible. One check eliminates 20% of all rug pulls.

Type 3: Pump-and-Dump (60,402 tokens — 79%)

The most common type by far. The creator may voluntarily revoke both mint and freeze authorities and even burn LP tokens — appearing completely legitimate on automated scanners. But they hold a massive pre-allocated token supply spread across multiple wallets (often created via bundled launch transactions). After promotion drives the price up, they execute a coordinated sell-off across all wallets simultaneously. Because supply is distributed across many seemingly independent addresses, it looks organic on a flat holder list. Detection requires checking wallet clustering (Bubblemaps) and bundled-launch data (Solana Tracker) — tools that go beyond basic authority checks.

Understanding which type you are facing determines which checks matter most. Freeze Authority Abuse is caught by checking authorities. Liquidity Withdrawal is caught by checking LP lock status. Pump-and-Dump — the 79% majority — requires deeper holder analysis and bundled-wallet detection that most traders skip.

Before you buy any newly launched Solana token, run through these seven checks in order. Each one is a binary pass/fail — if a token fails any single check, skip it. There are always more tokens tomorrow.

Check 1 — Mint Authority (must be revoked)

If mint authority is active, the creator can print unlimited new tokens and dump them on you, diluting your position to zero. Check on RugCheck.xyz (paste the mint address — it flags this automatically), Solscan (click the token address, then the "Authority" tab), or Helius Explorer for technical-level verification. A token with active mint authority is a hard pass — no exceptions, no matter how good the chart looks.

Check 2 — Freeze Authority (must be revoked)

If freeze authority is active, the creator can lock your wallet so you physically cannot sell. This is the honeypot mechanism on Solana. Same checking tools as above — RugCheck flags it, Solscan shows it. Revoked freeze authority means the creator cannot trap you. Active freeze authority means they can. Walk away.

Check 3 — Liquidity Pool (must be burned or locked)

Check whether the LP tokens for the main trading pool (Raydium, Orca, Meteora) have been sent to a burn address (e.g., 1111111111111111111111111111111111) or locked in a time-lock vault (Smithii, Raydium Lock). If LP tokens sit in the creator's regular wallet, they can pull all liquidity in a single transaction. Verify on Solscan by navigating to the LP token's "Holders" tab. If the creator's wallet still holds them — hard pass. This single check eliminates 20% of all rug pulls.

Check 4 — Top-Holder Concentration (no single wallet above 10–15%)

Excluding the liquidity pool address, burn addresses, and known protocol treasuries, no individual wallet should hold more than 10–15% of circulating supply. If the top 10 non-LP wallets collectively hold more than 40% of supply, the token is highly vulnerable to a coordinated dump. Check on Solscan's "Holders" tab or Birdeye's token page. A healthy Solana token has broad distribution across hundreds or thousands of wallets.

Check 5 — Bundled-Launch Detection (were insiders in the first block?)

A "bundled launch" means the creator bought tokens in the same transaction — or same block — as the pool creation, secretly accumulating supply at the absolute lowest price before any public buyer could act. They then distribute across multiple wallets to fake healthy distribution. The Solana Tracker API has a dedicated sniper and bundler detection endpoint. RugCheck also flags bundled activity. If bundled insiders hold more than 20% of supply, the distribution is artificial.

Check 6 — Creator Wallet Behavior (is it already selling?)

Find the wallet that deployed the token (visible on Solscan — it is the first address in the token's transaction history). Check its recent transactions. If it has already started selling or transferring tokens to multiple fresh wallets, the dump is in progress or being staged. A legitimate creator accumulates or holds — they do not distribute to 15 new wallets within hours of launch.

Check 7 — Smart-Money Presence (are experienced wallets in?)

Use Solana Tracker's wallet-tracking features, Nansen's Solana wallet labels, or Wallet Master to check whether wallets with profitable track records hold the token. If zero experienced wallets are present and the buyer base is entirely fresh (zero-history) wallets, you are likely looking at manufactured demand where the only real participants are the scammers themselves.

You do not need paid subscriptions to run the safety checklist above. Here are the specific tools, what each does, and when to use it:

RugCheck.xyz

The fastest single-scan tool available. Paste a mint address and get an instant composite risk report covering: mint authority, freeze authority, top holders, liquidity locks, metadata mutability, bundled launches, and creator behavior. RugCheck reads public Solana data and turns it into simple risk flags and a rating. A "Good" rating means no known flags were detected — but a pass does not guarantee safety. Insiders can still dump via pre-distributed supply that RugCheck cannot always detect. Use it as your first 5-second screen, then verify flagged items manually.

Solscan (solscan.io)

Solana's most detailed block explorer and your ground-truth verification tool. Use the "Authorities" tab to verify mint and freeze status, the "Holders" tab to see exact distribution percentages, and the "Transactions" tab to trace creator-wallet behavior. When RugCheck or any other scanner flags something ambiguous, Solscan shows you the raw on-chain data to confirm.

Bubblemaps (bubblemaps.io)

A visual wallet-clustering tool that catches what flat holder lists cannot. Paste a token address and see the top 150 holders represented as bubbles, with lines connecting wallets that have transacted with each other. If large clusters of connected wallets hold significant supply, those are likely insider wallets disguised as independent holders. A pump-and-dump where the creator distributed supply across 20 wallets looks "healthy" on Solscan's holder list — but on Bubblemaps, those 20 wallets light up as a single connected cluster. Takes 20 seconds to visually assess.

Birdeye (birdeye.so)

Real-time token data including price chart, volume, holder count, top holders, and liquidity depth. Use it to check whether trading volume is organic (many different wallet sizes and timings) or artificial (a few wallets ping-ponging identical amounts at regular intervals). Also shows holder-count trends over time — a healthy token gains holders steadily; a pump-and-dump token's holder count plateaus or drops after the initial spike while volume remains high.

DEX Screener (dexscreener.com)

Aggregates all Solana DEX pairs with real-time data. The "Txns" column is particularly useful for honeypot detection — extreme buy dominance (90%+ buys, near-zero sells) often indicates freeze-authority abuse where people are buying but cannot sell. Cross-reference any suspicious buy/sell ratio with RugCheck immediately.

Solana Tracker (solanatracker.io)

Tracks over 1.5 million wallets across the Solana ecosystem. Its sniper and bundler detection API identifies wallets that bought in the same block as pool creation — the definitive test for whether a token's distribution is genuine or manufactured. Also provides wallet-profitability scores so you can check whether "smart money" is present in a token's holder base or absent entirely.

Helius Explorer

Developer-grade Solana explorer from Helius (RPC provider). Best for checking token authorities and account states at a technical level when you want absolute certainty. Particularly useful for distinguishing between an authority that has been truly revoked versus one that has been transferred to another address — a subtle difference that simpler scanners can miss.

Academic research and community experience have identified consistent on-chain patterns that precede rug pulls. Knowing what these look like in practice — not just in theory — is the difference between spotting a scam and becoming its victim.

The lifecycle is measured in minutes, not days. The median Solana rug-pull token lives less than one hour. If a token launched 30 minutes ago and is already up 500%, that price action was almost certainly manufactured by insider wallets buying from themselves. The real exit — where insiders dump on latecomers — happens within the next 30 minutes. By the time it appears on a "trending" list, the rug is already in progress.

The token name exploits whatever is trending right now. Researchers catalogued rug-pull tokens that systematically copy the names of trending memes, celebrities, or news events — mashups like "OfficialTrumpMelaniaBarron47MAGA" or tokens with symbols like "ETH" or "USDC" designed to confuse scanners and attract clicks. Any token whose name is a mashup of trending keywords and celebrity names deserves maximum scepticism.

The buy/sell ratio is impossibly lopsided. On DEX Screener, a token showing 200+ buys and 0–3 sells in its first hour is almost certainly a honeypot — freeze authority is active and buyers literally cannot sell. Real tokens always have sellers. People take profits, bots arbitrage, impatient traders exit. Zero sells is not bullish sentiment — it is a structural trap.

The LP is "locked" for suspiciously short periods. A 7-day or 30-day liquidity lock on a project claiming to be long-term is meaningless window-dressing. It only prevents the rug for that period and signals the creator already plans to exit once the lock expires. Legitimate projects lock for 6–12 months minimum, or burn LP entirely. Short locks exist to pass automated scanners while preserving the exit option.

Volume is high but holder count is flat. Real demand brings new holders. If a token shows $500k in 24-hour volume but the holder count has not grown, the volume is almost certainly wash trading — the same wallets buying and selling to manufacture the appearance of activity and attract attention from aggregator trending lists.

The deployer wallet is brand new. Check the token creator's wallet age and history on Solscan. Scam creators fund a fresh wallet with SOL from a mixer or exchange withdrawal, launch the token, execute the rug, then abandon the wallet. If the deployer wallet is less than a week old and has no transaction history beyond this single token — maximum caution.

If you have already been caught in a rug pull, use the rug pull survival calculator to plan your DCA recovery roadmap with realistic timelines.

RugCheck is the best free first-screen tool available for Solana tokens, but the community has documented consistent limitations. A Reddit thread titled "rugcheck.xyz is usually a miss" describes multiple cases where tokens received clean ratings and then rugged. Understanding why — and what to do about it — is essential.

Scammers revoke authorities but pre-distribute supply. A creator can revoke both mint and freeze authority before launch, giving a perfectly clean RugCheck score. But they hold 40% of supply spread across 20 wallets created via a bundled launch transaction. Authorities were never the risk vector — hidden supply distribution was. RugCheck catches authority-based attacks (Types 1 and 2); Bubblemaps catches distribution-based attacks (Type 3, the 79% majority). You need both tools.

Sophisticated LP token laundering. Instead of holding LP tokens in the deployer wallet (which RugCheck flags), some scammers transfer LP tokens to a second wallet that appears unrelated. RugCheck may not detect the connection between the deployer and the wallet now holding LP tokens. Manual verification on Solscan — checking where LP tokens actually sit and whether that receiving wallet has any prior connection to the deployer — closes this gap.

Time-delayed execution. Some rug pulls are designed to pass all automated scans at launch, build a community over 2–7 days, then execute when the token has accumulated more retail capital. The average "soft rug" lasts about 8 months (CoinLaw 2026), though most Solana-specific rugs are much faster. Your initial scan was accurate at that moment — but conditions change. If you hold a token for more than 24 hours, re-scan before adding to your position. Authorities can be re-enabled, LP locks can expire, and holder distribution can shift.

Metadata manipulation after launch. If a token's metadata is set to "mutable," the name, symbol, and image can be changed after launch. A scammer could launch a generic meme token, let it pass scanners, then change the name to impersonate a trending token to attract new victims. RugCheck flags mutable metadata — but only if you actually read the full report rather than just the headline rating. Always verify you are looking at the correct token by confirming the mint address, not the ticker symbol.

The lesson: no single tool provides complete protection. Layer RugCheck (automated composite scan) + Bubblemaps (wallet clustering) + Solscan (manual ground-truth verification) + creator-wallet review + test transaction. Each layer catches scams that the others miss.

Here is the exact sequence to follow before buying any newly launched Solana token. Bookmark it, print it, and never skip a step — even when the chart looks like it is about to leave without you.

Step 1: Copy the token's mint address. Not the ticker symbol — tickers can be duplicated across dozens of scam tokens. The mint address is the unique identifier.

Step 2: Paste into RugCheck.xyz. Read the full report — not just the headline "Good" or "Danger" rating. Check every individual flag. If it shows active mint authority, active freeze authority, or unlocked LP → stop here. Do not buy.

Step 3: Open Solscan. Navigate to the token page. Click the "Holders" tab. Check the top 10 non-LP wallets. If any single wallet holds more than 15% of supply, or the top 10 collectively hold more than 40% → stop here.

Step 4: Open Bubblemaps. Paste the token address. Look for large clusters of connected wallets among the top holders. If you see 5 or more connected wallets that together hold more than 20% of supply → stop here. This catches pump-and-dump distribution that looks clean on a flat holder list.

Step 5: Check bundled-launch status via Solana Tracker or RugCheck's bundler flag. If more than 20% of supply was acquired in the launch transaction block → stop here. The distribution is artificial.

Step 6: Check DEX Screener for the buy/sell transaction ratio. If you see 100+ buys and fewer than 5 sells → likely honeypot. Stop here.

Step 7: Determine your position size using the position size calculator. Never risk more than 1–2% of your portfolio on a single new token. Set a stop-loss or mental exit point before entering.

Step 8: Execute a test transaction. Buy a tiny amount ($1–5) and immediately try to sell it. If the sell fails, returns significantly less than expected, or takes unusually long to execute → honeypot or hidden tax function. Exit immediately and do not return.

If a token passes all eight steps, it has cleared the most common rug-pull patterns. This does not guarantee profit — it only means the structural scam indicators are absent. The token can still drop 90% from hype fading, whale selling, or simply being worthless. Risk management — position sizing and stop-losses — remains essential regardless of how clean the on-chain data looks.