The three families of scam
Almost every loss fits one of three patterns. A rug pull is a project that removes liquidity or dumps a hidden supply. A honeypot is a contract you can buy but not sell. A social scam never touches the contract at all — it convinces you to sign, send or reveal.
Contract checks before you buy
On Solana, verify that mint authority and freeze authority are revoked; if mint authority is live, the deployer can print unlimited supply. On EVM chains, read the contract for transfer taxes, blacklists, max-transaction limits and owner-only functions that can pause selling.
- Is liquidity locked or burned, and for how long?
- How much supply sits in the top ten wallets, excluding known pool and burn addresses?
- Is the contract verified and does its source match what the project claims?
- Do sells actually work? A tiny test sell right after buying answers this instantly.
Reading the chart and the volume
Wash trading fakes activity: volume explodes while unique traders and holder count barely move, buys and sells alternate in identical sizes, and the price grinds up in a suspiciously straight line. Real discovery is messy — irregular candle sizes, growing holder counts and rising liquidity.
A chart that only goes up with no retrace, in a token nobody had heard of yesterday, is a distribution pattern, not an opportunity.
Social engineering red flags
Guaranteed returns. Countdown pressure. A team that exists only as anime avatars. Paid influencer waves that all post within the same hour. Airdrop claim sites that require a signature to 'verify' your wallet. A support agent in your DMs. Every single one of these is the same trick wearing a different mask.
The strongest defence is boredom: if you cannot explain in one sentence where the return comes from, walk away and let it moon without you.