A rug pull is a scam where a cryptocurrency or NFT developer hypes a project to attract investor money, only to suddenly shut down or disappear, taking investor assets with them. The name comes from the idiom “to pull the rug out” from under someone, leaving the victim off-balance and scrambling.
Rug pulls have increased as decentralized finance (DeFi) attracts more investors to the crypto space. In the first six weeks of 2023, there were at least 11 rug pulls, resulting in the theft of a combined total of more than $14 million, according to Comparitech’s crypto scam database.
We’ll cover the types of rug pulls, real-life examples and how to avoid falling for one yourself.
Rug pulls can be considered either hard or soft. A hard rug pull is when a developer has no intention of ever completing a project and intends to scam investors from the start, such as “hardwiring” a project’s code to leave an avenue open for theft. In contrast, a soft rug pull typically doesn’t have code-level fraud. Instead, soft pulls tend to rely on marketing hype to falsely inflate a project’s value, and then the project’s founders shut it down and run away with the money. Regardless, the result of either type is investor losses.
Rug pulls generally fall into the following categories:
This type of soft rug pull is similar to penny stock pump-and-dump schemes. The developers of a project hype it up to draw investors and encourage trading activity, using marketing tools such as social media, sweepstakes and other incentives as well as private servers such as Discord to make a community around the project. After inflating a coin or NFT’s value, the developers rapidly sell off their own supply, tanking the token’s value. Investors are then stuck with mostly worthless assets. Dumping schemes can span hours or years depending on the developers, and can sometimes look like normal market volatility rather than deliberate scams.
Projects hosted on a DeFi trading platform typically require a pool of crypto tokens for trades and loans. These tokens are ostensibly secured with smart contracts, but developers can build loopholes into the contracts allowing them to steal the pool of tokens from their investors. This is considered a hard rug pull, as the developers created the project with malicious intent baked in.
Another example of a hard rug pull, this scheme relies on a project’s developer including restrictions on selling in their tokens’ code. While investors can keep buying, they can’t sell unless a developer allows it. Scammers then dump their tokens when they want, leaving investors in the lurch and stuck with eventually worthless assets.
The short answer: It depends. Crypto fraud regulation is not yet consistent nationally or internationally. In the U.S., for instance, regulation has been spotty, as it’s not yet clear what the SEC considers under its purview. For instance, the SEC doesn’t consider Bitcoin a security, yet it filed a lawsuit against Ripple Labs for selling its XRP digital token. Ripple is fighting the charge, arguing that crypto tokens should not be treated as a security.
If you’re confused, you’re not alone — ironing out what counts as an investment contract (a security) or not is tricky in the crypto space. However, the SEC does have a guiding principle for defining what’s a security. It’s called the Howey Test, and states that “an ‘investment contract’ exists when there is the investment of money in a common enterprise with a reasonable expectation of profits to be derived from the efforts of others.” Some pundits believe that blockchain projects, including initial coin offerings (ICOs), should be treated as securities, while the tokens themselves, such as bitcoins and ether, should not.
While hard rug pulls are typically illegal, since it’s usually clear the developer has stolen investor funds with no intention of completing the project, soft rug pulls may not be technically illegal, though highly unethical. Because a soft rug pull can take years to occur, it can seem as if the developers are still actively working on the project, and they may be.
However, some states are stepping up efforts to combat crypto fraud, even for scammers playing the long game. New York state, for instance, has proposed a bill that would penalize developers who own more than 10 percent of their virtual token supply and sell more than 10 percent of the total supply within a five-year period from the last sale of the tokens.
Crypto scams are big business, with an estimated $25 billion lost to cryptocurrency and NFT scams so far, and no signs of slowing. And with over $2.8 billion lost to rug pulls in 2021 and more than 280 rug pulls executed in 2022 alone, there’s no shortage of examples to pull from.
Here are a few rug pulls that stood out in recent years.
Faruk Fatih Ozer, the founder of Thodex, formerly one of Turkey’s largest crypto exchanges, fled to Albania in 2021 after allegedly defrauding his platform users of $2.7 billion in funds. Before fleeing Turkey, Ozer’s company offered new registrants millions of free dogecoins, which many users say they never received.
In 2022 Ozer made the news again when he was arrested in Albania and extradited to Turkey. Turkey’s government has stated they’re seeking a 40,000-year-plus sentence against Thodex’s founders and co-conspirators.
In a prime example of a liquidity pooling scheme, AnubisDAO’s anonymous developers defrauded investors of about $60 million. The developers, who had no website or white paper, proposed a decentralized currency backed by a basket of assets. After receiving an outpouring of investor support, the developers drained the AnubisDAO liquidity pool 20 hours into the sale.
In the fall of 2021, an anonymous developer known as Evil Ape disappeared after taking $2.7 million of investor funds. Investors had fallen for a bogus NFT project called Evolved Apes, a collection of 10,000 cartoon apes that was supposed to include a fighting game. While the game was never developed, the NFTs exist and can still be found on OpenSea, an NFT marketplace.
Ethan Nguyen and Andre Llacuna made the news in 2022 when they were charged with conspiring to commit wire fraud and money laundering in one of the first rug pull crackdowns in the U.S. The duo had created an NFT project called Frosties, which they advertised as coming with rewards, giveaways and exclusive opportunities. Hours after selling around $1.1 million of Frosties, Nguyen and Llacuna shut down the project and absconded with investor funds.
Most rug pulls come from new projects that might seem like exciting investments. With widespread fraud in the crypto world, extra scrutiny is called for before you invest your money.
While not foolproof, these tips can help you sidestep a scam.
A healthy dose of skepticism is useful when sorting through crypto hype. Not every new cryptocurrency or NFT will be the next big thing. In fact, most of them will not, as demonstrated by money pooled in the most popular cryptocurrencies. Bitcoin and Ethereum still dominate the market, with the third largest coin not even half of Ethereum’s market cap.
As many crypto experts say, don’t invest money you can’t afford to lose.
One of the tried-and-true ways scammers push sales is through creating a sense of urgency or scarcity. In other words, fear of missing out, or FOMO. If you feel like this is an opportunity you absolutely cannot pass up and that you have to invest immediately – before having time to research – take a time out. It’s probably wise to take a step back and assess what’s creating the feeling. Is there a legitimate time crunch or is it a manufactured feeding frenzy?
Unlike some other industries, crypto doesn’t have a built-in cooling-off period, meaning you can’t cancel or back out of a funds transfer, in most cases. Taking your time may mean missing out on an opportunity now and again, but it may save you even more.
The crypto world is full of anonymity and aliases, which is part of the reason fraud is so common in the space. However, you should still gather as much information about the project as you can. This could include the developers’ backgrounds, including past projects and experience. For those with coding and blockchain experience, look into the project specs. And if the project has a white paper, you’ll want to give it a read.
If the investment opportunity comes with disclosures, be sure to read them. The SEC has fined crypto companies for not providing necessary information to investors and potential investors. The regulator has stated that if crypto companies offer investment contracts (i.e., securities) in exchange for tokens, they must register and comply with SEC regulations.
“We are not concerned with the labels put on offerings, but on their economic realities,” said Gurbir S. Grewal, Director of the SEC’s Division of Enforcement. “And part of that reality is that crypto assets are not exempt from the federal securities laws.”
If a digital asset offering doesn’t have a disclosure, but seems to fit the description of a security, beware.
Before investing, make sure you do your due diligence. While you’re not guaranteed to catch every scam, you’ll have a much better shot at avoiding bad deals if you take your time and research thoroughly. If you’re putting your hard-earned money into a risky crypto project, it’s vital to understand what you’re buying and why you think it will go up in price.
