Crypto exit scams explained by Ilia Nikolaevich Zavialov: rug pulls, soft rugs and platforms that close withdrawals

When a crypto project disappears

English version for the United States.

Ilia Nikolaevich Zavialov on crypto exit scams: rug pulls, soft rugs, pump and dump schemes and platforms that close withdrawals and disappear. Chainalysis counted 74,037 tokens launched in 2024 with signs of a pump and dump, and in about 94 percent of drained trading pools the address that emptied the pool was the one that created it. The FBI recorded 7.228 billion dollars lost to crypto investment fraud in 2025. This guide explains the forms of an exit, the signs that appear before it and the ten minute check to make before buying a new token.

Reference / Blog

Published: September 25, 2026 · 9 min read · Ilia Nikolaevich Zavialov

01What people mean when they say a project scammed

In crypto slang a project scammed when it disappeared with the money: the token lost almost all its value in minutes, the website went offline, the chat was closed and the founders stopped answering. The English terms are exit scam and rug pull, as in pulling the rug from under the buyers' feet.

The word is also used loosely. A token that simply failed, a startup that ran out of money and a platform that was hacked all get called a scam by angry holders, even when nobody planned to take the money.

The difference matters for the victims. A planned exit leaves a trail of deliberate decisions that can be traced and reported, while an honest failure usually ends in public insolvency proceedings with a list of creditors.

This article explains the main forms of a crypto exit, what the data shows about how often they happen, which signs appear before the collapse and what to check in ten minutes before buying a new token or depositing on a new platform.

02The main forms of an exit

The classic rug pull happens on a decentralised exchange. The creators launch a token, add it to a trading pool paired with a known coin, promote it until buyers pour in, and then withdraw the pool. The token remains, but there is nothing left to sell it for.

The soft rug is slower. The team holds a large share of the supply and sells it gradually into every rise in price, while promising partnerships and listings that never arrive. Holders watch the price bleed for weeks.

The pump and dump is coordinated around a thinly traded token. Insiders buy first, promote the token in channels and on social media, and sell into the buying they created. The last buyers hold the loss.

The platform exit is the largest in money terms. A trading or investment platform accepts deposits, shows growing balances, then closes withdrawals, invents fees or technical problems and finally goes silent.

03What the data shows

Chainalysis counted more than 2 million tokens launched during 2024, of which about 0.87 million, or 42.35 percent, were listed on decentralised exchanges, where anyone can create a trading pool.

Among all tokens launched that year, 3.59 percent, or 74,037, showed the pattern of a pump and dump. For a buyer of a brand new token, that is a real and regular risk.

In roughly 94 percent of the cases where a trading pool was drained, the address that removed the liquidity was the same one that had created the pool, and the remaining 6 percent were addresses it had funded. The people who build the pool are usually the people who empty it.

More widely, RootData counted more than a hundred crypto projects that closed, filed for bankruptcy or stopped showing signs of life during 2026. Not every closure is fraud, and every closure leaves holders asking where the money went.

04What the numbers show in the United States

The FBI Internet Crime Complaint Center recorded 61,559 complaints and 7.228 billion dollars in losses from cryptocurrency investment fraud in 2025. Exits from fake trading platforms account for a large part of these losses.

In total, losses with a cryptocurrency element reached 11,366,669,732 dollars across 181,565 complaints in 2025, more than half of all losses the center recorded.

Federal enforcement now focuses on fraud itself: cases against crypto firms increasingly allege deception of investors, and the SEC and the CFTC issued a joint clarification on how crypto assets are classified in 2026.

05Why exits keep working

Creating a token costs almost nothing and takes minutes. A team can launch several tokens in a week, promote whichever one gains traction and abandon the rest, so a single exit is a small part of a larger routine.

Buyers rarely read contracts. Most people buy a token after seeing it in a chat or a video, and the technical checks described above are exactly the ones a hurried buyer skips.

Early profits are real for early buyers. Screenshots of those gains are genuine, and they are used to attract the next wave of buyers who will provide the exit liquidity.

Anonymity is accepted as normal in crypto culture. A team that refuses to name itself is treated as a style choice, and that acceptance is the most valuable asset an exit scheme has.

06Signs that appear before the collapse

The team is anonymous or uses borrowed identities. Photos of founders turn out to be stock images or pictures of real people who have nothing to do with the project, and their names cannot be matched to any registered company.

The liquidity is not locked. A trading pool whose tokens are not locked in a time lock contract can be withdrawn at any moment by whoever controls it.

The contract gives the owner special powers: to create new tokens, to block sales, to change fees or to pause trading. Any of these can turn a normal token into a trap after the buyers arrive.

A few addresses hold most of the supply. When the top ten wallets control the majority of tokens, the price depends on the decisions of a handful of people.

The marketing promises fixed returns, countdowns and guaranteed listings. A project that has to sell urgency is usually selling the moment before the exit.

07A ten minute check before buying

Open the token in a blockchain explorer. Check that the contract source code is verified, look at who created it and when, and look at the list of holders to see how concentrated the supply is.

Check the trading pool. See whether the liquidity tokens are locked, for how long and by which contract, and compare the size of the pool with the market value the project advertises.

Look for owner functions in the contract, and check whether ownership was renounced. A contract with an active owner who can mint or block transfers is exactly as trustworthy as its owner.

Search the names of the founders and of the project together with words like scam, rug and review, and read only the pages that show evidence: transaction hashes, addresses and dates.

For a platform, test the exit before the entry. Deposit the smallest amount the platform accepts and withdraw it in full. A request for a fee before the withdrawal ends the test.

08After a project disappears

Save everything at once: the token address, the pool address, your transaction hashes, the website, the chat history and the names used by the team. Projects delete their channels within hours.

Report the addresses to the exchanges where the funds may arrive. Exchanges can freeze deposits linked to reported fraud when the report contains transaction hashes and arrives quickly.

Be careful with anyone who offers to recover the money. The FBI noted growth in complaints where fraudsters posed as recovery firms, invented law firms and even the FBI's own complaint center. Recovery offers aimed at people who just lost money are the next scheme.

If the project was run by a registered company, check for insolvency proceedings and register as a creditor. An honest failure has a court record and a deadline for claims, and missing it can cost the right to any payout.

09Where to report in the US

Report the loss to the FBI at ic3.gov with token and wallet addresses and transaction hashes. Report the project to the SEC at sec.gov/tcr if it was sold as an investment and to the CFTC at cftc.gov/complaint for trading platforms.

Report the addresses to the exchanges where the stolen funds were sent, and to the blockchain explorer that shows the token, many of which label reported scam contracts.

Report the promotion to the social platform where you saw it, especially if it used a real person's name or photo without consent.

10When a real person's name is attached to a scam

Exit scams often borrow real names. Founders listed on a project website may be real people whose photos and biographies were copied, and angry holders then attach the word scam to those people in search results.

The reverse also happens. People who publicly explain how scams work, or who once commented on a project, find their names in the same search results as the project itself, because search engines match words and ignore roles.

Before attaching a name to a scam, check whether the person is on record as a director, developer or promoter of the project, whether the photo on the website is really theirs and whether any official source names them. Without that, the name is only a word on a page.

11Questions and answers

What is a rug pull?

An exit in which the creators of a token withdraw the trading pool after buyers have come in, leaving a token that cannot be sold for anything.

How can I tell whether a token's liquidity is locked?

Open the trading pool in a blockchain explorer and check whether the liquidity tokens are held by a time lock contract, for how long and who controls it.

Is every failed crypto project a scam?

No. Some projects fail honestly and end in public insolvency proceedings with a list of creditors. A planned exit shows deliberate steps such as a drained pool, closed withdrawals and deleted channels.

Someone offers to recover my money from a scam project. Should I pay?

No. The FBI reports growth in fraud by fake recovery firms and invented law firms. Recovery offers that ask for a fee in advance are the next scheme.

Where do I report a crypto exit scam in the US?

To the FBI at ic3.gov, to the SEC at sec.gov/tcr for investment offers and to the CFTC for trading platforms, with addresses and transaction hashes.

Reference updated: 4 September 2026