By GraphDex Research · Reviewed for accuracy May 2026
Quick Answer
To spot a Solana rug pull before it happens, check these on-chain red flags:
- Mint authority active — the creator can print unlimited tokens and dump them (should be revoked)
- Freeze authority active — the creator can freeze your wallet, preventing you from selling (honeypot risk; should be revoked)
- Holder concentration — if the top 10 wallets hold more than 30% (excluding liquidity pools), dump risk is high
- Connected wallet clusters — multiple "separate" holders funded from one source signal disguised concentration (visible on bubble maps)
- Unlocked liquidity — if liquidity isn't locked or burned, the developer can drain it instantly
- Bundled launches — many wallets buying in the same block signal coordinated insider control
The key tools: Holder concentration analysis and bubble maps (visualizing wallet connections) reveal disguised insider control that standard explorers miss. Combine on-chain safety checks with cluster analysis before every trade.
The honest limit: No check guarantees safety — new tricks emerge, and even "clean" tokens can fail. But these checks catch the vast majority of rug pulls. Never invest more than you can afford to lose.
Analyze token safety with Bubble Maps on GraphDex
Key Takeaways
- Rug pulls cost traders $2.8 billion in 2025; most leave visible on-chain traces before striking.
- Key red flags: active mint/freeze authority, holder concentration >30%, connected wallet clusters, unlocked liquidity.
- Bubble maps visualize wallet connections, revealing disguised insider control that explorers miss.
- No check guarantees safety, but combining them catches the vast majority of rugs.
What Is a Rug Pull?
A rug pull is a crypto scam where developers create a token, attract buyers to pump the price, then drain the liquidity or dump their holdings — leaving investors with worthless tokens. The name comes from "pulling the rug out" from under investors.
The main types:
Hard rug (liquidity removal). The developer withdraws all liquidity from the pool instantly. The chart goes to zero, and the team vanishes. This is the most common mechanic — liquidity removal accounts for the majority of DeFi rug pulls.
Dump rug (insider selling). Insiders holding large portions of supply sell all at once, crashing the price. Retail buyers absorb the loss.
Honeypot. The token lets you buy but prevents selling (via freeze authority or contract tricks). You're trapped holding tokens you can't exit.
Soft rug (gradual). Instead of a single event, insiders slowly sell over time — small enough to avoid panic, large enough to drain the price gradually.
The scale of the problem: In 2025, rug pulls cost traders approximately $2.8 billion across all chains. Rug pulls account for roughly 35% of all crypto scam losses. Solana and BSC see the majority, because deployment costs are lowest — anyone can launch a token for under $1, including scammers.
The good news: Most rug pulls follow predictable patterns and leave visible on-chain traces. By checking a few key signals before you buy, you can avoid the vast majority. This guide shows you how.
Red Flag 1: Active Mint Authority
The single most important check on any Solana token.
What it is: Mint authority is a permission on the SPL token that allows the holder to create (mint) new tokens. If active, the creator can mint unlimited tokens at any moment — instantly diluting every existing holder to near-zero.
Why it's dangerous: A creator with active mint authority can print infinite tokens and dump them on the market, crashing the price while cashing out. Your holdings become worthless through dilution.
What to check: A legitimate token should have its mint authority revoked (permanently disabled). This is irreversible — once revoked, no one can ever mint more tokens.
How to check: Rug-check tools and token analyzers show mint authority status. On a Solana explorer (Solscan), you can verify whether mint authority is revoked.
The verdict: Active mint authority is a critical red flag. For any legitimate token, mint authority should be revoked. If it's active, the creator can dilute you to zero at will — avoid.
Red Flag 2: Active Freeze Authority
The honeypot enabler.
What it is: Freeze authority allows the token creator to freeze any wallet's token balance — preventing that wallet from trading or selling.
Why it's dangerous: With active freeze authority, a creator can freeze your wallet, trapping your tokens so you can't sell. This is the mechanism behind many "honeypot" scams — tokens you can buy but never sell.
What to check: Like mint authority, freeze authority should be revoked for any legitimate token. Revoked freeze authority means the creator can't freeze your ability to sell.
How to check: Token analyzers and rug-check tools show freeze authority status, verifiable on Solscan.
The verdict: Active freeze authority is a critical red flag — it enables honeypots where you can't sell. For legitimate tokens, freeze authority should be revoked.
Red Flag 3: Holder Concentration
The dump-risk indicator.
What it is: Holder concentration measures how much of the token supply is held by the top wallets. When a few wallets control most of the supply, they can crash the price by selling.
The threshold: A common rule: if the top 10 holders hold more than 30% of supply (excluding known liquidity pools and program addresses), concentration risk is high. Some traders use 30-40% as the danger line. A single wallet holding more than 20% outside the liquidity pool is a serious warning.
Why it matters: Concentrated holders can dump at any time, crashing the price on everyone else. The WOLF token on Solana is a textbook case — over 82% of supply sat in insider wallets at launch; after buying pressure pushed the price up, insiders drained liquidity and caused a 99% collapse.
What to check:
- Top 10 holder percentage (aim for well-distributed, under 30%)
- Whether any single wallet holds an outsized share (>20% outside the LP)
- The overall distribution fairness
How to check: Holder concentration tools and analyzers show top holder percentages. But there's a catch — sophisticated scammers disguise concentration by splitting across many wallets. That's where bubble maps come in.
Red Flag 4: Connected Wallet Clusters (Bubble Maps)
The sophisticated-scammer detector.
The problem: Smart scammers know that obvious concentration (one wallet holding 60%) triggers alerts. So they split holdings across dozens or hundreds of wallets, making the supply appear decentralized when it's actually controlled by one entity. Standard holder lists miss this.
How bubble maps solve it: Bubble maps visualize token holder networks — showing wallets as bubbles and their connections as lines. This reveals patterns invisible on standard explorers:
- Connected clusters: Multiple "separate" wallets funded from the same source appear as a linked cluster, exposing the true concentration
- Sybil splitting: One entity creating many wallets (e.g., 50-100 wallets each holding 1% from the same deployer) shows up as bubbles all connected to one source
- Liquidity ownership: If the liquidity pool wallet is connected to a large holder cluster, the team can drain it — a major red flag
- Pre-dump setups: Deployer wallets distributing to a network of addresses before a coordinated dump
What to look for on a bubble map:
- Many medium bubbles all connected to a central deployer (Sybil attack — artificial distribution)
- Distribution transfers happening in the same block (artificially created decentralization)
- The liquidity pool bubble thickly connected to the deployer or team (drain risk)
- Clusters of connected wallets redistributing internally before selling (obscuring origin)
Why it's powerful: Bubble maps expose disguised insider control that raw holder percentages miss. A token showing "200 holders" might actually be one entity across 200 connected wallets — obvious on a bubble map, invisible on a holder list.
The cross-reference trick: If a token claims 50,000 holders but a bubble map shows 200 connected bubbles, the holder count is likely fabricated. Cross-referencing exposes the manipulation.
Visualize holder clusters with Bubble Maps on GraphDex
Red Flag 5: Unlocked Liquidity
The instant-drain enabler.
What it is: Liquidity in the trading pool lets people buy and sell. If that liquidity isn't locked or burned, the developer can withdraw it at any moment — the most common rug mechanic.
Why it's dangerous: When a developer pulls unlocked liquidity, your tokens remain in your wallet but with nothing to sell them into — instantly worthless. Liquidity removal accounts for the majority of DeFi rug pulls.
What "locked" means: A liquidity lock sends the LP tokens to a time-locked contract, so the developer physically can't withdraw before the lock expires. Some Solana projects burn LP tokens (send them to a dead address) — even more secure than locking, as they can never be withdrawn.
What to check:
- Is liquidity locked or burned? (Locked/burned is safer)
- If locked, for how long? Locks under 30 days are a warning; legitimate projects often lock 6-12 months minimum
- Beware short locks (7-14 days) — some scammers rug immediately after the lock expires
The verdict: Unlocked liquidity is a major red flag — the developer can drain it anytime. Prefer locked or burned liquidity, and check the lock duration.
Red Flag 6: Bundled Launches & Sniper Activity
The Solana-specific launch trap.
What it is: "Bundling" means a deployer buys their own token across many wallets in the same launch block — creating artificial early distribution and letting insiders accumulate before retail. Sniper bots also snipe launches in the first block.
Why it matters on Solana: Solana's low fees and high-frequency bots make launch-block sniping and bundling endemic. A token bundled at launch has insiders holding large hidden positions ready to dump.
What to check:
- Bundle detection (whether many wallets bought in the launch block)
- Whether early distribution was organic or bundled
- Sniper wallet activity at launch
How to check: Advanced analyzers detect bundle activity, and bubble maps reveal wallets that received tokens in the same block. Bundle checking is especially critical on Solana memecoins.
The verdict: Heavy bundling at launch signals coordinated insider control — a rug risk. Organic distribution is safer.
The Rug Pull Detection Checklist
| Check | Safe Sign | Red Flag |
|---|---|---|
| Mint authority | Revoked | Active |
| Freeze authority | Revoked | Active |
| Top 10 holders | Under 30% | Over 30% |
| Wallet clusters (bubble map) | Distributed, unconnected | Connected clusters/Sybil |
| Liquidity | Locked or burned | Unlocked or short lock |
| Launch distribution | Organic | Bundled/sniped |
| Developer history | Clean | Past rugs |
Check every new token against these before buying. Multiple red flags = walk away.
How to Put It All Together
An effective rug-detection workflow combines checks:
1. Run automated safety checks. Use rug-check tools to instantly verify mint authority, freeze authority, liquidity status, and holder concentration. This catches the obvious red flags in seconds.
2. Analyze holder distribution. Check the top 10 holder percentage. If over 30% (excluding LPs), be cautious.
3. Visualize with bubble maps. This is the crucial step most traders skip. Bubble maps reveal connected clusters, Sybil splitting, and liquidity ownership that raw percentages miss. A token that looks distributed on a holder list may be one entity on a bubble map.
4. Check liquidity locks. Verify liquidity is locked or burned, and check the duration.
5. Assess launch and developer history. Look for bundling at launch and whether the deployer has a history of rugs.
6. Watch over time (for soft rugs). For held positions, monitor whether concentration is increasing or top wallets are steadily selling — signs of a slow rug.
7. Decide. If checks pass (revoked authorities, distributed holders, locked liquidity, clean clusters), it may be tradeable. If any critical check fails, avoid.
The time investment: This process takes a few minutes and would have caught the vast majority of rug pulls. The opportunity cost of missing a good token is far lower than the loss of a full rug.
The honest limit: No tool guarantees 100% detection — new techniques emerge, and even tokens passing all checks can fail. These checks dramatically reduce risk but don't eliminate it. Always do your own research and never invest more than you can afford to lose.
How GraphDex Helps You Avoid Rugs
GraphDex integrates rug-detection tools directly into the trading terminal — so you can vet tokens before trading, without juggling separate tools.
For rug detection:
- Bubble Maps — visualize holder concentration and wallet clusters, revealing disguised insider control and Sybil splitting
- Holder analysis — see top holder concentration at a glance
- Integrated safety — vet tokens within the terminal before trading
- Pulse feed — discover new tokens with safety context across all launchpads
- MEV protection — execute safely on vetted tokens without getting sandwiched
- Non-custodial — your funds stay in your own wallet (Privy), sign in with Twitter, email, or Telegram
The value: Rug detection requires combining holder concentration analysis with cluster visualization (bubble maps) — the crucial step that reveals disguised insider control. GraphDex integrates Bubble Maps and holder analysis directly into the terminal, so you vet tokens and trade in one place, rather than switching between a rug checker, a bubble map tool, and a DEX.
Remember: no tool guarantees safety. GraphDex's Bubble Maps and analysis dramatically improve your ability to spot rugs, but always do your own research and never invest more than you can afford to lose.
Vet tokens with integrated Bubble Maps on GraphDex
Frequently Asked Questions
How do I spot a rug pull on Solana? Check key on-chain red flags: active mint authority (creator can print tokens), active freeze authority (honeypot risk), holder concentration over 30% in the top 10 wallets, connected wallet clusters (visible on bubble maps), unlocked liquidity, and bundled launches. Use rug-check tools for automated checks and bubble maps to visualize disguised insider control. Multiple red flags mean walk away. No check guarantees safety, but combining them catches most rugs.
What is the biggest red flag for a rug pull? Active mint authority is often cited as the single most important check — it lets the creator mint unlimited tokens and dump them, diluting you to zero. Close behind: extreme holder concentration (a single wallet over 20%, or top 10 over 30%) and unlocked liquidity (the developer can drain it instantly). Connected wallet clusters on bubble maps reveal disguised concentration that raw numbers miss.
What are bubble maps and how do they detect rugs? Bubble maps visualize token holder networks — wallets as bubbles, connections as lines. They reveal patterns invisible on standard explorers: connected wallet clusters (one entity split across many wallets), Sybil splitting (many wallets funded from one source in the same block), and liquidity pool ownership by the team. A token that looks distributed on a holder list may be one entity controlling everything — obvious on a bubble map.
What percentage of holders is a rug pull risk? A common threshold: if the top 10 holders control more than 30% of supply (excluding liquidity pools and known program addresses), concentration risk is high. Some traders use 30-40% as the danger line. A single wallet holding over 20% outside the LP is a serious warning. But sophisticated scammers disguise concentration across many connected wallets — which is why bubble maps (showing connections) matter alongside raw percentages.
Can liquidity locks be trusted? Locked liquidity is safer than unlocked, but not a guarantee. Some scammers use short locks (7-14 days) and rug immediately after they expire. Legitimate projects often lock for 6-12 months minimum, or burn LP tokens entirely (even safer, as they can never be withdrawn). Check both whether liquidity is locked/burned AND the lock duration. Locks under 30 days are a warning sign.
What is a honeypot token? A honeypot is a token you can buy but can't sell — trapping your funds. It's often enabled by active freeze authority (the creator freezes your wallet) or contract tricks that block selling. A classic signature: only green (buy) candles with no red (sell) candles on the chart. Before buying, verify freeze authority is revoked and, ideally, that selling is possible. Honeypots are a common rug variant.
Do rug-check tools guarantee a token is safe? No. Rug-check tools and bubble maps dramatically reduce risk by catching common red flags, but no tool guarantees 100% detection. New scam techniques emerge, and some legitimate tokens score poorly due to unusual configurations while some scams pass initial checks. Use multiple tools, combine automated checks with bubble map analysis, do your own research, and never invest more than you can afford to lose.
About This Guide
This guide is published by the GraphDex Research team — analysts and traders building the infrastructure for digital asset trading on Solana. Our content is based on direct experience, on-chain data, and 2026 market developments.
Sources & data: Detection methods, thresholds, and the $2.8B figure reflect publicly available information as of 2026 and may change. No detection method guarantees safety — new scam techniques emerge, and even tokens passing all checks can fail. Memecoin trading carries extreme risk including total loss of capital. This guide is educational and not financial advice — always do your own research.
GraphDex is the infrastructure for digital asset trading — trade, predict, and earn in one place. Learn more at graphdex.io.
Last reviewed: May 2026 · GraphDex Research
The infrastructure for digital asset trading. Trade, predict, stake, repeat. graphdex.io
