NFT and crypto token rug pulls

What it is

A rug pull is a cryptocurrency or NFT project that takes investors’ money once, through a token sale or an NFT mint, and never delivers anything after. The team builds a website, a roadmap and a following, collects payment through a real blockchain transaction, and then — sometimes within hours — drains the project’s wallet or liquidity pool and disappears. The purchase itself is completely real. Everything the project promised to do with the money is not.

The scale is not small. Chainalysis counted $2.8 billion in rug pull losses in 2021 alone, up from just 1% of crypto scam revenue the year before to 37% — a single year in which this mechanism went from a minor category to the dominant one in crypto fraud. The Justice Department has since prosecuted it as ordinary wire fraud and money laundering, in cases running from a $1.1 million Ethereum NFT collection to a $2.6 million rug pull whose operator has never been apprehended.

How it actually works

1. The pitch

   A website, a roadmap and a Discord or X following build around promises of future value: a game, staking rewards, a broader community with ongoing benefits — none of which exist yet.

2. The mint or sale

   Buyers send ETH, SOL or another cryptocurrency into a smart contract or liquidity pool in exchange for NFTs or tokens. The transaction itself executes exactly as advertised; only what happens to the money afterward is in question.

3. A team that was never verifiable

   No independent code audit, a pseudonymous or unverifiable team, and a “locked liquidity” claim nobody outside the project can actually check.

   Where it could have stopped

   In the SEC’s case against Eric Zhu, Game Coin publicly claimed its liquidity was “locked” against insider withdrawal — while the engineer responsible for it secretly kept the control that made the claim true or false. A locking claim only means something if a buyer can verify it themselves on the blockchain; taking the team’s word for it is not verification.

4. The pull

   Funds are transferred out of the project wallet or liquidity pool to the operators’ own addresses — often within hours of the sale finishing. Frosties’ 8,888-NFT mint and Baller Ape Club’s public sale were both drained on the same day they launched.

5. Going dark

   The Discord server, website and social accounts are deleted or abandoned. Buyers are left holding NFTs or tokens with no project behind them and no one left to answer questions.

6. Laundering the proceeds

   Stolen crypto moves through mixing services like Tornado Cash and “chain-hopping” — converting funds across multiple blockchains — to break the trail between the theft and any eventual cash-out.

7. The trail investigators actually follow

   Blockchain analysis firms and federal investigators trace wallet activity across the mixing and chain-hopping steps, then use subpoenas to exchanges’ know-your-customer records to connect a pseudonymous wallet to a real identity.

8. Wildly uneven outcomes, years later

   One defendant on this page received five years of probation after a guilty plea. A co-defendant was convicted by a jury and faced a federal prison sentence. Another, believed to be overseas, remains charged with no reported arrest years later. A fourth settled a civil case with the SEC without admitting wrongdoing. The same underlying scheme produced four different endings.

Why it works

Everything about the transaction is technically real. The blockchain record, the smart contract, the NFT or token landing in a buyer’s wallet — none of it is faked. Only the team’s follow-through is. That makes a rug pull far harder to spot in the moment than a scheme built on outright fabricated evidence.

Pseudonymity is normal, so it doesn’t read as a warning sign. Anonymous or pseudonymous founders are an accepted part of crypto culture, which means the one trait every rug pull operator on this page shared — nobody could verify who they really were before sending money — did not, by itself, stand out.

Hype compresses the time to decide. Discord raids, influencer promotion and a ticking mint clock are built to make buying feel urgent, leaving little time to check whether an audit actually happened or a liquidity lock is actually enforced on-chain.

The theft can happen faster than anyone can react. Frosties and Baller Ape Club were both drained within hours or a single day of their public sale. By the time buyers realized something was wrong, the money — and often the team — was already gone.

Crypto transactions do not reverse. There is no chargeback, no bank to call, no payment processor to dispute the charge with. Once funds leave a buyer’s wallet, getting them back depends entirely on identifying and prosecuting whoever took them.

Where it comes from

A mix of domestic and international operators, prosecuted under two different legal tracks.

Some of the documented operators are unremarkable Americans, not offshore criminal syndicates. The Frosties and UndeadApes cases on this page involve defendants in their early twenties, arrested in Los Angeles or living ordinary lives in Florida and Alabama — one an active-duty US Air Force member — rather than anyone operating from a scam compound.

Others are believed to be outside US jurisdiction entirely. The Baller Ape Club case names a defendant charged with a $2.6 million rug pull whose arrest, as far as the sources for this page show, has never been reported — the more common real-world ending for an international case, even once investigators can name a suspect.

Enforcement runs through both criminal and civil courts. The Justice Department has charged rug pull operators with conspiracy to commit wire fraud and money laundering, carrying decades of potential prison time; the SEC has separately pursued rug pulls as securities fraud, seeking civil disgorgement and penalties rather than prison. Both tracks appear among this page’s cases.

The boom tracks the DeFi and NFT markets themselves. Chainalysis found rug pulls made up only 1% of crypto scam revenue in 2020, then 37% in 2021 — growth that tracks the same period NFT trading volume and new token launches exploded, not a change in the technique itself.

Real cases

Red flags

• Anonymous or pseudonymous founders with no verifiable real-world identity — not disqualifying on its own, but combined with the flags below, it is the pattern every case on this page shares.
• No independent code or smart-contract audit, or an audit claim you cannot find published anywhere.
• A “locked liquidity” claim you cannot verify yourself on a blockchain explorer — the SEC’s case against Eric Zhu shows exactly how a false version of this claim looks from the outside.
• A roadmap promising a game, token utility or staking rewards with no working product yet.
• Manufactured urgency — a countdown to mint, claims of an imminent sellout, or pressure to buy before missing “the next” price jump.
• Aggressive Discord and X hype, giveaways, and “verified” partnership claims that cannot be confirmed independently.
• A team that goes silent, deletes channels, or stops answering questions right after a sale completes — the point at which every documented case on this page turned.

If it’s happening to you

1. Stop sending funds immediately if the project is still actively soliciting money.
2. Check a blockchain explorer yourself for the project’s wallet or liquidity pool — you can often see directly whether it has already been emptied.
3. Save everything before it disappears: screenshots, transaction hashes, wallet addresses, and the project’s own claims about audits or locked liquidity.
4. Report it to the FBI’s Internet Crime Complaint Center at ic3.gov, and to the SEC or CFTC if the project was marketed as an investment. See where to report for other countries.
5. Report the project to the marketplace or platform it launched on, so the collection or token can be flagged for other buyers.
6. Be wary of anyone who contacts you afterward offering to recover your funds for an upfront fee — that is a separate, documented scheme; see this site’s page on crypto recovery scams.

Where the money goes

Straight out of the project’s own wallet or liquidity pool, then through the same laundering steps in case after case: a mixing service, followed by movement across multiple blockchains, followed by conversion into ordinary currency.

Tornado Cash and chain-hopping appear in more than one case on this page. The UndeadApes operators used both — mixing the crypto, then converting it between Solana and Ethereum — before the proceeds became US dollars in a bank account. The goal in every documented case is the same: break the visible link between the wallet that took the money and whoever eventually spends it.

Recovery is rare and depends entirely on enforcement. Of the four cases on this page, only one — the SEC’s civil settlement with Eric Zhu — recovered any money at all, and only because Zhu agreed to pay disgorgement after being caught. The other three show money that, as far as these sources report, was never returned to investors.

By the numbers

No published dataset breaks this scheme out as its own category yet, so there is no chart to show. The data page explains which agency categories exist and why some schemes are invisible in official statistics.