| Method | What is done | Visible beforehand? |
|---|---|---|
| Liquidity removal the classic hard rug | The creators withdraw the pooled funds that make the token tradeable. There is nothing left to sell into, and the price goes to effectively zero in one transaction | Yes — whether liquidity is locked, and for how long, is public |
| Sell restriction honeypot | The token's code permits buying but blocks selling for everyone except addresses the creators control. Buyers watch the price rise and cannot exit | Yes — the restriction is in the contract from deployment |
| Unlimited minting | The contract lets the creators issue new supply at will. They mint, sell into the buyers' money, and the value of everyone else's holding evaporates | Yes — mint permissions are readable in the contract |
| Slow exit soft rug | No single dramatic act. The team sells its own holdings gradually, development stops, and the project is left to die while the announcements continue | Partly — large insider holdings are visible, intent is not |
Why "it was in the contract" matters to your case. Where a rug pull was built into the code, the fraud was planned before any money arrived. That is a meaningful difference for a police report and for a court: it is not a project that failed, it is an instrument built to take deposits. The contract is permanent and public, so this can be demonstrated long afterwards — one of the few things working in a victim's favour here.
Decentralised exchanges and bridges have no operator to send a freeze request to and no account holder to identify. There is nobody to ask.
Unlike a theft from an exchange account, there was never a verified identity anywhere in the chain.
The proceeds are split and bridged deliberately, and quickly.
Where the opening is. Stolen value is only useful once it becomes ordinary money — and that almost always means a centralised exchange, which does have a compliance team and a customer behind the address. The realistic path in a rug pull case is: trace the proceeds through the dispersal, identify where they consolidate, and get them flagged and frozen at the point they touch a service that screens deposits. We flag stolen transactions to AML providers within four hours of intake, and an exchange freeze request takes 2–4 days once filed. Whether the funds arrive there before they are cashed out is what decides the case — and it is not something anyone can promise you in advance.
Recovery, if it comes, comes on the same timescale as everything else: 6–9 months from an exchange, 6–36 months for complex or multi-jurisdictional cases. A freeze is measured in days; being repaid is not. The full timings are on our data page.
What we will tell you on the free call. For many rug pulls the answer is that there is no realistic prospect of recovery — the proceeds went straight through a mixer, or were cashed out long ago, or the sum does not justify a multi-jurisdictional case. We decline those rather than accept them. Our published figure is 68% success rate on accepted cases · measured over the past 24 months, and it is accepted that keeps it honest.
The FBI's Internet Crime Complaint Center has issued repeated advisories about fictitious law firms contacting crypto scam victims and offering to recover funds for an up-front fee. Between February 2023 and February 2024 alone, victims re-targeted this way reported losses of more than $9.9 million. Both advisories are public: PSA240624 and PSA250813.
The rule that protects you. Being approached is the warning sign — not the offer's contents. We do not cold-message victims, we are not affiliated with any government agency, and no agency refers cases to us. If someone approaches you in our name, it is not us; report it to IC3. Before engaging anyone, run the ten-point check on our verification page — our own registry entries are published in full on credentials.
Not advice on what to buy — we are investigators, not advisers. These are simply the things that were readable in the contract in cases we have looked at.
, or locked only briefly. If it can be withdrawn, at some point it can be withdrawn.
that let the creators issue more supply after launch.
that apply to everyone except a small set of addresses.
— a large share of supply in a handful of wallets connected to the deployer.
than the one actually deployed, or an auditor that cannot be found independently.
— the same test we ask you to apply to recovery firms, including ours.
Nobody can. What can happen is a freeze after the funds reach a service with an operator.
It cannot be traced, so we decline rather than bill the attempt.
Outside what we can work effectively.
Non-negotiable.
— which, in this category, is many of them. Declined on the first call.
Forensics and the evidence base are ours; police reports, freeze filings and court applications are carried out by partner law firms in the relevant jurisdiction.
Recovery is decided by courts, exchanges and token issuers.
Related: all six types of crypto theft and their recoverability · wallet drainers · how our investigations work · what happens in the first four hours.
A rug pull is a fraud in which the people behind a crypto token or project take the money invested in it and abandon it. The most common method is removing the liquidity that allows the token to be traded: the price collapses to nothing and holders are left with an asset they cannot sell. The name comes from having the rug pulled out from under you — the asset still exists in your wallet, but there is no longer anyone on the other side of a sale.
Response within two business hours. Confidential. Success-fee terms on recovery work.