Avoid Scams

Meme Coin Pump-and-Dump and Rug Pulls: How to Spot a Party Already Engineered to End at Zero

2026-05-29 · 链上迷雾

It’s 2 a.m. and a group drops a screenshot: a token named after a frog, a dog, an alien, up 1000% in 24 hours. The link is a Pump.fun page, candles stacking on top of each other, comments shouting “ape in,” “next 100x.” Market cap is 800k, so the “100x room” looks plausible. As your cursor hovers over “buy,” it probably doesn’t cross your mind that the ending of this curve was written the second somebody drew its first candle.

This piece dissects the two main extraction patterns: pump and dump and rug pull. They’re an assembly line with fixed scripts, fixed tools, and fixed talking points.

The script behind that screenshot

A Meme coin can be created and shipped to your screen in under ten minutes. On Solana, platforms like Pump.fun let anyone mint a new token in a few dollars and zero lines of code, automatically pairing it with a bonding-curve liquidity pool. In the first few minutes, price gets pushed up along that curve — because the launcher has prepared 20 to 50 fresh wallets to buy in waves.

This step is called “painting the chart.” You move money from your left hand to your right, sculpt the price into a clean uptrend, and dress the volume up to look like frenzied demand. Once the on-chain data looks tempting enough, screenshots and the contract address get blasted across Telegram, Discord, and X burner accounts. What they’re really waiting for isn’t a price target — it’s you, a wave of retail who never check on-chain data and only see screenshots.

Then comes the offloading. The early “house” sells in tranches at the exact same moment you buy. The bonding curve steepens as price climbs, so newcomers eat all the slippage of the highest stretch. When the retail bid weakens, the operators dump the remaining bag in one shot. The candle prints a long lower wick and slams to the ankles. The “rally” you saw existed only so the exit could happen.

(/uploads/20260529/1780055246627-17696.png)

The common shapes of a rug pull

Pump and dump is the “softer” variant — it at least leaves you a tradeable market. A rug pull is more thorough: it pulls the market away entirely and leaves you holding a string of characters nobody will ever buy.

Variant one: liquidity rug. The most primitive version. The team creates a DEX pair, seeds liquidity, lets retail pour stablecoins into the pool, then withdraws the LP tokens they originally deposited, draining the SOL or USDC. The token instantly goes to zero because no buyer remains.

Variant two: contract backdoor. A hidden function like setBlacklist, disableTransfer, or onlyOwnerCanSell lets you buy and the chart rip, but reverts your “sell” — only the deployer can sell. Crypto calls this a “honeypot.”

Variant three: hidden mint. The mint() has no cap. Early supply looks fine, retail pushes price up, and one day the deployer mints hundreds of millions, dumps, and walks.

Variant four: upgradeable proxy. The contract is built as an upgradeable proxy. The initial implementation may pass audits, but the deployer’s admin key can swap the logic for a backdoored version at any time. This is the high-end rug, hidden in Meme coins dressed up to look “more serious.”

Variant five: social plus liquidity exit. The team rugs while deleting Telegram, Discord, X, the website, and source code. By the time you look up, the funds are already bridged and mixed, often paired with a follow-on fake support scam.

These five aren’t mutually exclusive. A single Meme coin can carry both a backdoor and a hidden mint, stacking the no-exit options on top of each other.

Tools and red flags

Tools can’t tell you whether a token will go up. They can tell you whether it can be sold. That second question matters more.

On-chain scanners. RugCheck and DexScreener for Solana, Token Sniffer, GoPlus, and Honeypot.is for EVM chains. They check the source for blacklisting, mint, transfer-pause, and revert-on-sell functions, and they tell you how much of the supply the deployer holds. If one address holds more than 50%, the price can be flattened by a single click.

LP locks. Healthy projects lock LP tokens in a timelock and publish the duration. An unlocked LP is a fuse that can be lit at any time. But “locked” does not equal “safe” — a short remaining lock or a lock covering only a fraction of the LP is still high risk.

Deployer history. The same wallet creating short-lived tokens and rugging each time leaves a public trail on chain. When a deployer carries a “previously rugged” label, scroll past — don’t bet that this time is different.

Red flag Why it’s dangerous
Deployer holds more than 20% of supply One wallet can flatten the price
LP unlocked or about to unlock Liquidity can vanish at any time
Contract source not verified Backdoors cannot be audited
Contract has mint, blacklist, setTax Deployer can change the rules unilaterally
Group grew from 0 to tens of thousands in 2 days Almost certainly bot-bought members
100x to 1000x in 24 hours Not opportunity — pre-exit markup
Group admins urge “buy now or miss it” Manufactured urgency is the dump signature

The job is the same family of skill as spotting a fake token contract, only Meme coins are sneakier — they don’t pretend to be another project, they pretend to be “the next 100x.”

(/uploads/20260529/1780055283533-16983.png)

The voices in the group pushing you to ape in

Meme coins keep working because they dress financial decisions up as collective euphoria. What you see isn’t probability — it’s hundreds of voices shouting “send it.” Anyone calm gets labeled “doesn’t get it”; anyone careful gets mocked for “missing 100x.”

That pressure is worse than any chart. See how to spot Telegram group scams. Shortest version: any room that pushes “buy now or lose forever” is an inverse signal — the more frantic the chat, the more frantic the operators are to exit.

One more thing: many people use “I got lucky once” as proof they’ll get lucky again. The few early winners win not because they’re smarter but because the visible jackpot exists to draw the rest of you in.

There are no experts in a casino, only people who left first

Look again at that 2 a.m. screenshot. The 1000% number isn’t proof the move isn’t over — it’s the signal the exit is loaded. Nothing in the Meme world rewards “I researched it thoroughly” because the counterparty controls the contract, the pool, and asymmetric information you don’t.

If you really want to play, three rules: only deploy money you’re willing to lose entirely, sized using the logic in position sizing and loss limits; scan the contract before every buy, a 30-second step that filters out 80% of the traps; set a mechanical exit rule, like pulling out your principal at 1x regardless of where the chart is going.

Final line: there are no experts in a casino, only people who left first. The ones who repeatedly walk away with money aren’t the sharpest readers — they’re the fastest, calmest, earliest to take the word “principal” off the table.

This article is for education only and is not financial advice. Crypto is volatile and risky — only ever risk what you can afford to lose.

Latest

Myths

Why Nine Out of Ten 'Insider Tips' Are Traps

"I have insider info" is the cheapest and most common opening line in crypto. Strip away the packaging and the real structure is almost never sharing — it's a carefully designed exit-liquidity funnel.

Exchange Safety

Why Is Storing Crypto Long-Term on an Exchange So Risky? Lessons Before the Next Blow-Up

Leaving coins on an exchange is convenient and looks normal. But "long-term" on an exchange is a thing that has blown up repeatedly in this industry. This article lays out why it remains unsafe.

Mindset & FOMO

Why You Should Not Flex Your PnL in Telegram Groups, and What It Actually Costs You?

Posting a PnL screenshot in a TG group feels like 5 seconds of pride, then 5 minutes of peer attention, then potentially 5 months of being targeted, copied, or kidnap-budgeted. This piece splits "why not to flex" into four layers — security, mindset, social, execution — and shows the bill on each.

Asset Security

What the $284M Trezor Phishing Wave Teaches Hardware Wallet Users

The early-2026 Trezor phishing wave drained roughly $284M without breaking a single chip. It stole something simpler — users' trust in "official" email. Here is how the chain worked and what to do about it.

Asset Security

Is My Wallet Actually Safe? How to Run a Thorough Self-Audit on Your Own

Most people only feel their wallet is "probably fine" and never sit down to verify. This article walks through a self-audit you can run alone — covering seed phrases, approvals, signatures, devices and asset distribution.

Asset Security

Your Exchange KYC Data Got Leaked — Now What?

You wake up to find you're on yet another exchange KYC leak list. What to do in the first hours, what defenses to build long-term? This piece is an ordered checklist focused on "protect assets first, identity next, habits last."