How to spot a rug pull before it happens
A rug pull is the removal of liquidity or the exit of a deployer after collecting deposits. The shocking part: in most cases, the behavioral warning signs existed in public data for weeks before the exit.
The deployer wallet tells the story
The single most informative address in any token launch is the deployer. Watch it, and you watch the whole game:
- Funding source — where did the deployer's first money come from? Fresh wallets funded in one shot from an exchange, then immediately launching a token, are a classic pattern.
- Custody pattern — does a large fraction of the supply sit in one or two addresses controlled by the deployer? Concentration is the fuel of a rug.
- Early accumulation — do insider wallets buy before the public launch, then get funded after? The timing of insider wallets is a strong signal.
Wash trading as the tell
Fake volume is how a rug pull looks legitimate before the exit. Wash trading — the same wallet trading against itself in a loop — is visible in the data as:
- Self-interaction — an address sending to itself through a smart contract.
- Circular counterparty rings — a closed loop of wallets trading the same token among themselves.
- Volume without holders — huge reported volume but a flat holder count.
SIGBOT flags these patterns directly: circular counterparty graphs and self-transfers are part of the behavioral fingerprint.
The exit signature
The final exit has its own signature: rapid sequential drains of token liquidity or staking, often in a tight time window, to a single exchange deposit address. After the drain, the deployer wallet often goes quiet or starts moving funds through mixers.
Not a crystal ball
None of this proves a rug pull. Behavior is probabilistic evidence. But when a deployer shows concentrated supply, wash-traded volume, insider accumulation, and a single-way funding pattern, the risk profile is objectively high.