> ## Content Index > Fetch the complete content index at: https://altcoininvestor.com/llms.txt > Use this file to discover other available public pages before exploring further. # On-Chain Signals That Distinguish Launchpad Winners From Rugs - URL: https://altcoininvestor.com/spot-rug-pull-on-chain-2/ - Published: 2026-09-18T17:03:44.000Z - Updated: 2026-09-18T17:03:45.000Z - Description: Wallet patterns, LP behavior, and holder concentration reveal rug pulls before launch. A 15-minute on-chain framework to filter out exits and preserve capital. - Author: Lana Sparrow - Tags: Blockchain Analysis, Altcoin Investing, Project Funding & Launches, Intermediate ## The Question That Matters Before You Buy ![Transaction flow diagram showing 15-minute token deployment timeline with liquidity markers](https://cdn.getmidnight.com/13448471d89a9cd8d7f71026a0334ec8/2026/09/on-chain-rug-pull-detection-analysis-after-h2-1.webp) Over 5,000 new tokens launch every single day across Ethereum, Solana, Base, and BSC in 2026\. Most of them exist to extract money from you. Rug pulls accounted for 37% of all DeFi-related losses in 2026, totaling $2.8 billion across 1,247 individual incidents. On PancakeSwap V2 alone, $569.4 million was extracted through 103,695 separate rug pulls in the first 20 weeks of 2026\. That is not noise. That is the dominant outcome. The question is not whether you will encounter rug pulls. The question is whether you will catch them before you commit capital. The blockchain shows you what the team is actually doing, not what the marketing says. The signals are there. You just need to know where to look. ## The 15-Minute On-Chain Framework ![Token holder distribution analysis showing concentration metrics and liquidity pool verification on screen](https://cdn.getmidnight.com/13448471d89a9cd8d7f71026a0334ec8/2026/09/on-chain-rug-pull-detection-analysis-after-h2-2.webp) This is not comprehensive due diligence. This is a triage protocol designed to filter out obvious exits before you spend time reading whitepapers. Four checks, 15 minutes, reproducible on every chain. ### Creator Wallet Scoring (3 Minutes) The deployer wallet tells you more than the website does. Fresh wallets created days before token deployment, with no prior DeFi activity beyond the deployment itself, are the single strongest rug pull predictor. ChainAware's Rug Pull Detector V3 reports 90.1% accuracy when factoring creator behavior into its model, up from 68% when relying on behavioral analysis alone. Go to the blockchain explorer for the chain your token deployed on. Find the token contract address. Look at the deployer address. Check three things: - **Wallet age:** When was the deployer address first funded? If it was created within 7 days of token launch, flag it. - **Transaction history:** Does the deployer have diverse DeFi activity before this launch? Swaps, liquidity adds, staking, governance votes across multiple protocols indicate an actual participant. A wallet with one inbound transfer and one contract deployment indicates a burner. - **Funding source:** Where did the deployer get its initial ETH or SOL? If the deployer was funded by a wallet tied to prior rug pulls, you have a feeder-chain risk signal. This catches the "clean wallet, dirty money" pattern that sophisticated operators use. A deployer with years of on-chain history, multiple protocol interactions, and funding from a known entity (a CEX withdrawal, a multisig treasury, a DAO) passes the first filter. A deployer created three days ago and funded by Tornado Cash does not. ### Team Allocation Pattern Analysis (4 Minutes) Centralized token supply is the mechanical prerequisite for every rug pull. If the team does not control enough tokens to crash the price when they sell, they cannot rug. The question is whether that control is visible on-chain or hidden. In a study of verified rug pulls, 91% had at least one wallet controlling more than 15% of total tokens. The threshold that separates healthy projects from problematic ones is clear: any single wallet with 20% or more of supply is a red flag. Go to the token's holder page on a blockchain explorer or analytics tool like DEXTools. Check the top 10 wallets. Calculate what percentage of circulating supply they control. Healthy tokens show top 10 holders controlling under 40% of supply, with gradual distribution among hundreds of addresses. Red flags include: - A single wallet holding 20% or more - Top 3 wallets holding 50% or more combined - Top 10 wallets holding 70% or more combined Sophisticated rug pullers distribute tokens across dozens of wallets to obscure concentration. To detect this, check if multiple top holders were funded from the same source wallet. Use [Bubblemaps for visual cluster analysis](https://nansen.ai/post/solana-token-analysis-complete-framework-for-evaluating-tokens-in-2026). If 15 wallets in the top 50 all trace back to the same funding address, that is not decentralization. That is a single entity with good OpSec. One edge case: vesting contracts. If 40% of supply sits in a team vesting contract that unlocks over four years, the current circulating concentration might be acceptable even though long-term dilution risk is real. Verify that the vesting contract is (1) on-chain and audited, (2) has a meaningful cliff period of at least six months, and (3) actually holds the tokens it claims to hold. Do not trust the documentation. Check the contract balance yourself. ### LP Behavior Verification (4 Minutes) Liquidity is the exit door. If the team can remove liquidity at will, they will. Liquidity locking is the most basic and most violated safety standard in DeFi. Before buying any new token, verify that 100% of the liquidity pool's LP tokens are locked in a verifiable smart contract for a meaningful duration. At least three to six months. Ideally longer. In 2026, experienced DeFi traders check liquidity lock status before buying, and analytics platforms like DexScreener and DEXTools prominently display lock information. If the platform does not show a lock, assume there is none. Verify four things: - **Is the LP token contract the actual pool?** Scammers sometimes lock a fake pool while leaving the real liquidity unlocked. Cross-check the LP token address against the DEX's official factory contract. - **What percentage is locked?** Anything below 100% means developers can drain the unlocked portion. A project that locks 80% of liquidity can still rug with the other 20%. - **When does the lock expire?** A 24-hour lock is theater. A seven-day lock gives you no protection. Minimum acceptable duration is 90 days. Anything shorter suggests the team expects to exit soon. - **Is the lock verifiable on-chain?** You must be able to see the LP tokens sitting in the timelock contract yourself. Go to the locking contract address. Check the balance. If the documentation says the LP is locked but the contract shows zero balance, the lock does not exist. Keep in mind: liquidity locking reduces one rug pull path, but it does not make a token safe. Tokenomics, insider allocations, contract permissions, audits, market depth, demand, and team behavior still matter. Treat a liquidity lock as one risk-control signal, not proof that a project deserves trust. ### Initial Holder Distribution Shape (3 Minutes) A decentralized distribution across significant holder counts indicates a healthier ecosystem and stability. A high number of holders suggests growing adoption and resistance to market manipulation. The inverse is also true. Check holder count at launch, then recheck 24 hours later, 72 hours later, and one week later. You are looking for two patterns: - **Increasing unique holders over time:** This signals genuine adoption. New wallets are entering. Distribution is widening. - **Stagnant or declining holders despite price increases:** This suggests wash trading. The same wallets are moving tokens between addresses to simulate volume while actual adoption is flat or negative. Cross-reference holder count with transaction volume. If a token shows 10,000 transactions but only 150 unique holders, those holders are trading back and forth to create the illusion of activity. Real adoption produces a higher ratio of holders to transactions because most buyers hold rather than flip immediately. One more check: look at the distribution curve. A healthy token shows a long tail of small holders. If the holder list shows 500 addresses but 90% of them hold fewer than $5 worth of tokens, that is Sybil behavior. Someone created hundreds of wallets to inflate the holder count. Actual organic distribution produces a bell curve, not a cliff. ## What Rug Pulls Look Like On-Chain ![Smart contract code showing hidden mint functions and ownership backdoors in rug pull patterns](https://cdn.getmidnight.com/13448471d89a9cd8d7f71026a0334ec8/2026/09/on-chain-rug-pull-detection-analysis-after-h2-3.webp) Rug pulls follow recognizable mechanical patterns. The timeline varies, but the wallet behavior is consistent. ### Hard Rug Pulls (Under 24 Hours) The developer removes all liquidity in one or two transactions, crashes the price to zero, and disappears. This is the most visible pattern. 83% of rug pulls in 2026 followed this liquidity removal pattern, with an average lifespan of 3.7 days from launch to exit. On-chain, it looks like this: LP tokens move from the locking contract (or directly from the deployer if there was never a lock) to a DEX, where they are burned in exchange for the underlying assets. The pool disappears. The token becomes untradeable. The whole sequence takes two to five minutes. If you are monitoring a new token and you see the LP token balance drop suddenly, you have seconds to exit before the price collapses. Set up wallet alerts on the LP holding address. When it moves, you move. ### Soft Rug Pulls (Weeks to Months) The developer sells tokens gradually to avoid detection, slowly draining liquidity while maintaining the appearance of normal activity. 14% of 2026 rug pulls took 60 or more days to execute. The average duration of a soft rug pull is eight months, compared to less than 24 hours for hard rug pulls. On-chain, it looks like this: one or more team-controlled wallets sell small amounts regularly into the liquidity pool. Price declines slowly. Volume appears organic. New buyers replace exiting team members. The team extracts value over time rather than all at once. This pattern is harder to catch in real time, but the setup is visible at launch. If the top wallets are unidentified, have no public association with the team, and start selling within the first week, you are watching a slow exit. Track the balance of the top 10 holders daily. If their holdings decline consistently while the price is flat or rising slightly, that is distribution under cover of organic activity. ### Honeypot Scams (Immediate) The token contract includes code that prevents anyone except the deployer from selling. You can buy, but you cannot sell. The scam is mechanical, not behavioral. In 2026 data, honeypots dominated scam deployments, with 98,442 tokens flagged, showing that trapping users into non-sellable tokens remains the most common exploit tactic. On-chain detection requires either contract analysis or a test transaction. Use GoPlus Security API or Honeypot.is to simulate a sell transaction before you buy. If the simulation fails, the contract does not allow sells. Do not buy. ## When the Signals Fail This framework filters out the majority of obvious rug pulls, but it is not foolproof. Three scenarios where legitimate projects trigger false positives: **Scenario one:** A team launches with a multisig that holds 30% of supply for ecosystem development, with public documentation and on-chain verification. The concentration is real, but the intent is not malicious. The framework flags it as a risk, which it is. Concentration is always risk. The question is whether the offsetting factors (reputation, audit, vesting, transparency) justify that risk. The on-chain data does not answer that question. It just shows you the risk exists. **Scenario two:** A deployer wallet is brand new because the team used a fresh multisig for operational security. The wallet has no prior history because it was created specifically for this launch. The framework flags it as a risk. In this case, verify the multisig signers. If they are doxxed, have public reputations, and the multisig setup is transparent, the risk is lower. If the signers are anonymous and the multisig was created the same day as the token, the risk remains high. **Scenario three:** Liquidity is unlocked because the team is actively managing it across multiple pools and chains. Some legitimate projects do this, though it is not best practice. If liquidity is unlocked, the team should explain why in public documentation, commit to transparency about LP movements, and ideally use a timelock or multisig to prevent unilateral withdrawals. If they do none of these things, treat it as a red flag regardless of their stated reasons. ## What to Watch On-Chain Next If a token passes the 15-minute triage, monitor these on-chain behaviors over the first 30 days: - **Top holder balance trends:** Are the top 10 wallets accumulating, holding, or distributing? Consistent distribution from top holders is a red flag unless those holders are publicly identified as early investors with disclosed vesting terms. - **LP token movements:** Set up alerts on the LP holding address. Any movement should trigger immediate investigation. Legitimate teams announce LP changes in advance. - **Holder growth rate:** Is the holder count increasing faster than the price? This indicates organic adoption. Is the price increasing faster than the holder count? This indicates concentration or Sybil activity. - **Transaction clustering:** Are transactions evenly distributed across the day, or do they cluster around specific times? Clustering suggests bot activity or coordinated behavior rather than organic trading. For tokens that are [launching through established launchpad ecosystems](https://altcoininvestor.com/asian-latam-launchpads-crypto/), cross-check the launchpad's due diligence claims against on-chain reality. Many leading launchpads conduct reviews of development teams, tokenomics, smart contract audits, and business models. Verify that the team allocation, LP locking, and holder distribution match what the launchpad documentation claims. If they do not, the launchpad either lied or failed to verify. Either way, exit. ## The Takeaway You have 15 minutes to catch what 91% of rug pulls show you before launch. Creator wallet age and funding source. Team allocation concentration above 20% in any single wallet. LP locking status, duration, and on-chain verification. Holder distribution shape and growth trajectory. These signals do not require insider information. They do not require paid tools. They require 15 minutes and a blockchain explorer. The data is public. The pattern is consistent. The choice is whether you look before you buy. 99% of Pump.fun tokens extract money from buyers. 95% of PancakeSwap pools end in rug pulls. The default outcome is loss. This framework moves you from default to informed. The wallets show you what the marketing hides. Read the wallets. ## Frequently Asked Questions ### What is the strongest single indicator of a rug pull before launch? Creator wallet age and history. Fresh wallets created within seven days of token deployment, with no prior DeFi activity beyond the deployment itself, are the single strongest rug pull predictor. ChainAware's Rug Pull Detector V3 reports 90.1% accuracy when factoring creator behavior into its model. If the deployer wallet was created specifically for this launch and has no transaction history, treat it as a red flag until proven otherwise. ### How much team allocation concentration is too much? Any single wallet holding 20% or more of total token supply is a red flag. In a study of verified rug pulls, 91% had at least one wallet controlling more than 15% of tokens. Healthy projects show top 10 holders controlling under 40% of supply with gradual distribution among hundreds of addresses. Sophisticated rug pullers distribute tokens across multiple wallets funded from the same source, so check funding patterns using tools like Bubblemaps to detect hidden concentration. ### Does liquidity locking guarantee a token is safe? No. Liquidity locking reduces one rug pull path by preventing the team from removing liquidity, but it does not make a token safe. Tokenomics, insider allocations, contract permissions, honeypot code, audits, market depth, and team behavior still matter. A project can lock liquidity and still rug through massive team token sales that crash the price. Treat liquidity locking as one necessary risk-control signal, not as proof of safety. Always verify lock duration, percentage locked, and on-chain verification. ### What holder distribution patterns indicate wash trading? Stagnant or declining holder counts despite rising price and volume indicate wash trading. If a token shows 10,000 transactions but only 150 unique holders, those holders are trading back and forth to simulate activity. Check the holder-to-transaction ratio and monitor holder growth over time. Real adoption produces increasing unique holders and a bell-curve distribution. If 90% of holders own less than five dollars of tokens, that is Sybil behavior indicating fake distribution. ### How quickly do most rug pulls happen after launch? 83% of rug pulls in 2026 followed a liquidity removal pattern with an average lifespan of 3.7 days from launch to exit. Hard rug pulls occur in under 24 hours. However, 14% of 2026 rug pulls took 60 or more days to execute as soft rugs, with an average duration of eight months. The timeline varies, but the on-chain setup is visible at launch. Fresh deployer wallets, high team concentration, and unlocked liquidity signal high risk regardless of how long the team waits to exit. The Weekly Yield Report You just learned to catch 91% of rug pulls in 15 minutes using four on-chain checks. Next week, new scams will use different wallets with the same patterns. Every Thursday: where crypto yield actually is - stablecoins, liquid staking and DeFi lending, with the risk named next to the rate and what changed since last week. [Get it free every Thursday](#/portal/signup) Free. No trade calls, no allocations, no hype. Unsubscribe in one click.