Understanding how rugs happen — mechanically, on-chain, in real-time — is the fastest way to build the instincts that keep your SOL safe. These are five patterns we see repeatedly in our scan data, with the market signals that appeared right before the collapse.
Pattern 1: The "Community Token" Dev Dump
The Setup
Token launches with a clean narrative — a Solana-ecosystem mascot, a meme tied to a current event, a "fair launch" with no presale. The Telegram fills with real-sounding community members (often the dev's own accounts or paid shills). Chart shows consistent buying for 15–30 minutes. Everything looks organic.
The Collapse
At some point between 15 minutes and 2 hours in, the dev wallet (which held 8–15% of supply bought via bundler at launch) executes a market sell. Liquidity drops 60–80% instantly. Token goes from 500K mcap to 50K mcap in under 30 seconds. The "community" evaporates from TG.
What the Data Showed
In tokens that fit this pattern, we typically see: liquidity between $8–25K (real enough to seem legitimate, small enough to drain quickly), 24h volume 15–30x liquidity (high churn), buy/sell transaction ratio heavily skewed to buys (90%+) suggesting pre-dump accumulation phase. The model catches the volume-to-liquidity anomaly and flags these HIGH risk roughly 75% of the time before the dump executes.
Pattern 2: The Slow Bleed (20 SOL Over 3 Hours)
The Setup
This is the sophisticated version. Dev holds 20–30% of supply split across many wallets. Instead of one big dump, they sell 1–2% every time the chart pumps. The price rises, they sell a little, price consolidates, they wait for the next pump, sell a little more. From the outside it looks like healthy price action with some profit-taking.
The Collapse
There is no single collapse moment — that's what makes it dangerous. The chart bleeds slowly. Volume thins over time. One day you look at your 0.3 SOL position and it's worth 0.04 SOL and you have no idea when it happened. The dev has quietly exited over days while you held, thinking it was just consolidating.
What the Data Showed
Slow bleeds are harder for any automated system to catch early because the early-stage data looks normal. The signals that emerge over time: steadily decreasing liquidity despite ongoing volume (LP being slowly drained), sell transaction count rising relative to buys over 6h windows, wallet-level analysis showing the same wallet cluster selling small amounts repeatedly. RugPullShield's 5-minute volume trend is specifically useful here — if 5m volume is declining while 24h volume is still high, the buying is drying up.
Pattern 3: The "CTer Call" Setup
The Setup
A paid or compromised crypto Twitter account with 50K–200K followers posts about the token. Not an obvious shill — a nuanced post like "not financial advice but keeping an eye on $XXXXX, interesting narrative." The account's followers, who trust the CT persona, buy in. This creates real organic buying pressure on top of whatever the dev holds.
The Collapse
The CT account's post comes after the dev (who paid the CT account or is the CT account) has already accumulated. Once the call drives enough buying to create exit liquidity, the dev dumps. The CT account deletes the tweet or posts a vague "DYOR always" follow-up. The influencer got paid. The dev got out. Followers lost money.
What the Data Showed
These tokens often have the best-looking data right before collapse — real volume, genuine buy pressure, growing liquidity. This is a case where the on-chain data is genuinely misleading and the model will sometimes rate these LOW risk right up until the dump. The tell that no automated system catches well: the timing of the CT call relative to token launch. If a big account posts about a token that's under 30 minutes old, that's a coordination red flag — legitimate discoveries take longer to propagate.
Pattern 4: The Fake Migration
The Setup
A pump.fun token gets traction, hits the graduation threshold, and gets announced as "migrating to Raydium." The dev then announces a "v2" token or "official Raydium launch" in the TG — a new CA is posted, supposedly the "real" Raydium version. Some people migrate. Others are confused. A subset of holders buys the "v2" thinking it's the continuation of something legitimate.
The Collapse
There is no v2. The "new CA" is a fresh rug. The confusion is intentional — while people are figuring out which is the real token, the dev is selling both. The original token's community is fragmented, the new token's liquidity is thin, and both go to zero within hours.
What the Data Showed
The "v2" token in these scenarios almost always shows extreme data anomalies: launching to $50–200K mcap in under 5 minutes (the dev is buying their own token to create perceived legitimacy), near-zero sell activity in the first 10 minutes (no one who bought at launch has had time to sell yet — artificial), and liquidity that's disproportionately low for the mcap (thin pool = easy to drain). These are some of the clearest HIGH-risk signals in our data.
Pattern 5: The Honeypot with a Time Lock
The Setup
Less common on Solana than EVM chains, but it happens. The token contract has a hidden condition: wallets that buy in the first N minutes or first N transactions are blocked from selling. The dev has a whitelist of wallets (their own) that can always sell. Retail holders can buy, watch the price go up, but cannot execute a sell.
The Collapse
Once enough retail is locked in and the price is high enough, the dev's whitelisted wallets sell everything. Price collapses to zero. Locked wallets can never sell. This is the most malicious pattern because there's genuinely nothing the victim could have done differently at the point of the buy — the rug was baked into the contract.
What the Data Showed
Honeypots have a distinctive market signature: volume that consists almost entirely of buys with almost no sells, even over extended periods. The buy/sell ratio is 95%+ buys because selling is structurally impossible for most wallets. RugPullShield catches this pattern with high reliability because that ratio is a major model feature — real organic tokens always have meaningful sell pressure even during pumps. When almost no one can sell, the data screams it.
The Common Thread
Across all five patterns, the common element is information asymmetry. The dev knows what you don't: whether there's a time lock, whether the "v2" is a scam, whether the CT caller is paid, whether they're about to dump. Your only defense is reducing that asymmetry — on-chain data, automated scanning, and pattern recognition built from seeing thousands of outcomes.
None of these patterns are new. Rug pull mechanics evolve slowly because they don't need to evolve — retail traders keep falling for the same patterns. The goal is to not be in that group.