MEMECOINS

Anatomy of a Rug Pull: The On-Chain Fingerprints Nobody Shows You

Rugs leave evidence on-chain before the chart breaks. Here's what to check and where the footprints show up.

· 6 min read · Blackhat Empire

The Rug Is Usually Signed Before the Chart Moves

Most rugs don't happen in one second. They get built over hours or days, and the construction work leaves marks on-chain. The candle is just the last act.

This is a breakdown of the common rug patterns and the fingerprints each one leaves. It is education, not advice. Memecoins are extremely high risk, and the base rate is brutal: most of them go to zero. The goal here is not to help you pick winners. It is to help you stop being the exit liquidity.

Pattern 1: The LP Pull

The classic. Liquidity gets added, the token gets attention, then the LP is removed and the pool drains.

Fingerprints:

  • LP not burned and not locked, or "locked" through a contract the deployer still controls. Check the lock terms, not the badge.
  • LP unlock timing set suspiciously close to a marketing push or a space.
  • A large LP position withdrawn in one transaction, often to a fresh wallet, then routed out through an intermediary.

If liquidity can leave, assume it eventually will. Treat unlocked LP as a countdown, not a detail.

Pattern 2: The Slow Bleed

No single dramatic event. The dev wallet, insider wallets, or early sniper wallets sell into every green candle.

Fingerprints:

  • Clustered wallets funded from the same source before launch, selling in similar sizes at similar intervals.
  • Consistent sell pressure on strength, with the price unable to hold a bid even when volume looks healthy.
  • Holder count rising while price falls. New buyers replacing old ones at lower prices is distribution, not adoption.

This is the most common rug and the easiest to miss, because there is no headline moment. Just a slow transfer of your money to someone else's wallet.

Pattern 3: The Mint and Dump

A hidden mint function, or an owner key that can mint, lets the deployer create supply out of nothing and dump it.

Fingerprints:

  • Supply that does not match the launch, visible when total supply changes after the token is live.
  • Owner privileges still active: mint, blacklist, pause, fee changes, or transfer restrictions.
  • A contract that was not renounced, or renounced through a proxy that can be upgraded back.

"Renounced" means nothing if the contract can be changed later. Read the actual functions, not the checkbox on a scanner.

Pattern 4: The Tax Switch

Sell taxes that start reasonable and get raised after buyers are in.

Fingerprints:

  • Mutable tax or fee parameters in the contract, with no timelock.
  • A wallet that can change those parameters still holding tokens and active.
  • Test sells from insider wallets at low tax before the switch.

If the rules can change after you buy, you are not buying a token. You are buying an option the dev holds against you.

The Fingerprints That Show Up Every Time

Across all four patterns, the same on-chain signals keep appearing. Build a checklist and run it before you size in:

  • Wallet clustering. Who funded the early buyers? Same source wallet is the tell.
  • Deployer history. Has this wallet launched before? What happened to those tokens? A dev with three dead launches is not unlucky.
  • Holder concentration. Top holders plus insider clusters, not just the top ten shown by default.
  • Liquidity ownership and lock status. Who can pull it, and when.
  • Contract privileges. What can still be changed, and by whom.
  • Sell behavior of insiders. Are they selling into strength while posting?

For the specific metrics to check and how to read them, see our reference on /v2/dyor/reference.html#metrics. The rules we hold ourselves to when we talk about any token are at /v2/dyor/reference.html#rules.

Why Alerts Are Not a Substitute for Checks

Real-time alerts help you see flow: fresh buys, smart money entries and exits, volume surges, near-graduation prints, KOL clusters. That is useful context. It is not a safety layer.

An alert tells you money moved. It does not tell you whether the LP is locked, whether the contract can mint, or whether the wallets buying are all funded by the same address. Those are your checks, and they take minutes. Skipping them because the alert looked clean is how people get rinsed.

If you want to watch flow in real time, the alert channels are listed at /v2/dyor/reference.html#alerts, and the full public directory is at blackhat.finance/channels.html. Charting and execution happen on GMGN at gmgn.uk, with the mirror at gmgn.fr.

Where to Ask

If you want a second set of eyes on a contract before you touch it, the chat is the place: BH GMGN CHAT at @gmgnx_chat. Chain-specific rooms if you trade one ecosystem more than others:

You can also fold the main channels into one list with the Telegram folder: t.me/addlist/1VUQZMhux_JhMzJk.

The Ground Truth

A rug is not bad luck. It is a set of decisions made by someone with control, and those decisions leave traces. The traces are public. You just have to look before you buy instead of after.

None of this makes a memecoin safe. Most go to zero, including ones that pass every check. The point is to stop paying for other people's exits. Check the contract, check the wallets, check the liquidity, and size like the downside is real. Because it is.

Community

Stay connected across the chains:

Charts and on-chain research: https://gmgn.uk.