Rug Pulls Dominate Crypto Scams, Accounting for 54% of Threats

Hidden permissions in smart contracts can allow creators to remove liquidity or block token sales without warning.

Rug pulls made up over 54% of all newly detected crypto scams, according to the latest data from the on-chain security analysis platform Web3 Antivirus.

The findings suggest that while scam tactics are still evolving, many attackers continue to rely on token projects that appear legitimate at first before contract controls are used to trap investors or drain liquidity.

Rug Pulls Are the Biggest Threat

In a June 9 breakdown on X, Web3 Antivirus also noted that honeypots, a different but related trick, came in second at around 22%, followed by fake tokens at roughly 12% and scam airdrops at just under 12%.

The mechanics behind rug pulls are what make these schemes so effective. As the security firm reported, they are created in such a way that, in their initial phases, they resemble normal market activity with increasing prices, trade volumes, and high activity in online forums.

The risk only becomes visible when the contract owners exercise hidden permissions that either prevent users from selling, remove liquidity, or otherwise lock funds.

“A token can look alive with the chart moving up and the community getting louder, but one owner-side action can change everything in secs,” wrote Web3 Antivirus. “The same contract controls that were invisible during the pump can suddenly become the reason users cannot exit, liquidity disappears and the chart collapses.”

Honeypots work on the same basic principle. Bad actors create a fake token and push it to the public with convincing marketing as a big investment opportunity. They even artificially push up the token’s value by making transactions themselves to create an illusion of high demand to attract unwitting investors.

However, as soon as people buy in, often at inflated prices, the underlying contract prevents any sale, with the scammers withdrawing the profits and exiting. Web3 Antivirus’s latest Scam Pulse data shows more than 425,000 rug pulls detected alongside 172,000 honeypots and over 94,000 scam airdrops.

You may also like:

In addition, of more than 100 million contracts the platform has analyzed, it has flagged almost 4 million as scams, with at least 3.1 million of those appearing within the last 30 days alone.

There has also been an uptick in the impersonation of token contracts, as seen in the security firm’s weekly leaderboard showing Ethereum leading with 291 fake token detections. Tether followed close behind at 270, and USDC at 225, with activity up across nearly every tracked asset compared to the previous week.

Delivery Methods Are Getting Harder to Spot

Beyond the on-chain mechanics, Web3 Antivirus also pointed out that AI is changing how scams are reaching users in the first place. The technology, according to them, now makes phishing emails, fake support chats, and fraudulent social media posts look polished enough to pass a quick visual check.

Per their data, emails are the most common delivery channel at 53%, followed by SMS at 10%, social media at 9%, and online ads at 8%. And there are examples across the industry, including an incident in May, where a fake Uniswap website drained at least $400,000 from users before the alarm was raised.

That same month, Ripple CTO Emeritus David Schwartz issued a warning to XRP investors about a fake airdrop and giveaway campaign targeting XRPL users.

And not long ago, Web3 Antivirus identified a phishing account posing as the Canton Network, complete with the project’s branding, that was using a supposedly official announcement post to redirect unsuspecting users to a scam URL.