MEMECOINS

Anatomy of a Rug Pull: The On-Chain Fingerprints That Give It Away

A rug has a shape. Learn the on-chain traces it leaves before the liquidity vanishes and the chart goes vertical the wrong way.

· 7 min read · Blackhat Empire

A rug is not random. It is a sequence.

Most people get rugged because they only look at the chart and the vibe. Both are lagging indicators. The chart is a picture of what already happened; the vibe is a picture of what someone wants you to feel.

The wallet data is the leading indicator. Every rug is a sequence of moves made by wallets that were set up long before anyone in the chat heard the ticker. Learn the sequence and you stop being the exit liquidity. This is education and risk-awareness, not a promise you can catch everything. Memecoins are extremely high risk and most of them go to zero. A rug is just the fastest version of that.

Stage 1: The wallet that was born for this

Before there is a token, there is a deployer wallet. Look at its history. A wallet with a long, quiet trail of tiny transactions and a handful of prior tokens that all died is a serial deployer.

The fingerprints:

  • Fresh wallet funded from a bridge, a mixer-style hop, or a chain of throwaway addresses
  • Prior tokens on the same address, most of them with liquidity pulled or one-sided
  • Funding patterns that trace back to one origin wallet across several "different" launches

A deployer with no history is not automatically bad. A deployer with a graveyard is a signal. Look at the funding trail, not just the token.

Stage 2: The supply was already spoken for

Before the token hits a public buy, check who holds it. The classic setup is the bundled launch: the deployer and a handful of wallets buy in the same block or the seconds around it.

The fingerprints:

  • Many top holders funded from the same source wallet on the same day
  • Holder count that jumps in clusters rather than gradually
  • A top-10 that is a tight group of wallets with similar balances, similar timing, and no other activity
  • A dev wallet holding just under the threshold people are told to watch

This is the part where supply is quietly concentrated so it can be sold into your buy. It looks like an organic early crowd until you check the funding graph.

Stage 3: Liquidity with an exit built in

Liquidity is where the rug actually happens. Watch how the pool was created and who controls it.

The fingerprints:

  • LP tokens held by the deployer or a wallet tied to them instead of locked or burned
  • A pool that was created and funded in one move, with no gradual additions
  • Liquidity that gets quietly trimmed in small pieces while price holds steady
  • Mint authority or freeze authority still live when the chart says the token is "done"

A pool with a live exit is not a market. It is a countdown with a chart attached.

Stage 4: The quiet sell into the noise

The exit rarely starts with a crash. It starts with a few sells into a wall of hype, timed to the moment the chart looks strongest.

The fingerprints:

  • Early wallets selling in pieces while volume looks healthy
  • Sell transactions that split across many small amounts to stay under alert thresholds
  • Smart-money exits that show up before the visible dump
  • A sudden widening of the spread as the last of the real bids get taken out

By the time the chart breaks, the exit already happened. The lesson is to watch the wallets while the chart is boring.

Stage 5: The soft rug nobody names

Not every rug pulls the pool. Some of the worst ones keep the pool and just drain the room. Dev sells into early buyers. Insiders distribute over days. Liquidity stays on screen while the actual value leaves through the top.

That is still a rug. It is just slower, and it is harder to see if you only check for a pulled pool. The wallet trail is the same story told at a lower speed.

Building the habit

You do not need to memorize every trick. You need a repeatable check before you buy, and a habit of running it every time.

  • Who deployed it, and what did that wallet do before?
  • Who funded the top holders, and when?
  • Who controls liquidity, and is that exit live?
  • Are authorities renounced, or just described as renounced?
  • Are early wallets selling while the crowd is still buying?

The full checklist lives in the metrics reference, and the ground rules for reading data instead of vibes are in the rules. If you want to see how alerts are organized so you can actually act on wallet data, the alerts page lays it out.

Where to look and who to talk to

Run the wallet and holder checks on GMGN at gmgn.uk, with gmgn.fr as the mirror. Pull the deployer, the top holders, and the liquidity owner before you size a position you cannot afford to lose.

If you want to talk through a suspicious launch with people who read the same data, the chat is BH GMGN CHAT. Chain-specific rooms: SOL, BSC, ROBINHOOD, ETH, BASE. The full alert directory is at blackhat.finance/channels.html.

A rug is a sequence of wallet moves. Learn the sequence and you stop being surprised. Nothing here is financial advice, no one can predict a chart, and most memecoins go to zero whether or not anyone is out to get you.

Community

Stay connected across the chains:

Charts and on-chain research: https://gmgn.uk.