How pump.fun Rugs Work (and How to Spot Them)

Most people who lose money on pump.fun do not lose it competing with a sophisticated institutional trading software. They lose it to a system that was designed to scam you before the token ever existed, engineered to take your SOL and hand you a product that never held any value. The technology is not magic. It is predictable, repeatable, and visible on-chain if you know where to look.

At 0xhades we build infrastructure and investigate the network at the byte level. This guide is the consumer-facing version of what we see: how these tokens are deployed, how the exits are planned, and the warning signs a normal person can check in a couple of minutes. The goal is not to teach you to run a scam. It is to make sure you are never the liquidity for one.

What pump.fun is, and the bonding curve

pump.fun is a decentralized exchange on Solana that allows anyone to create a token in seconds for a tiny fee, with zero coding and no upfront liquidity. This simplicity is intentional, but also problematic.

Every new token launches onto a bonding curve. Think of the curve as an automated vending machine for the token. There is no traditional order book and no human market maker. Instead, a formula sets the price: the more tokens that are bought, the higher the price climbs for the next buyer. Early buyers pay less, later buyers pay more, and the price moves purely as a function of how much has been purchased.

When enough has been bought that the curve fills up, the token graduates: the collected SOL and a portion of the supply are deposited into a liquidity pool on a decentralized exchange, and the token starts trading "freely" on the open market. Graduation is marketed as a milestone. In practice it is also one of the most dangerous moments for a buyer, for reasons we will get to.

The anatomy of a rug

A "rug pull" is when the creator (or dev) behind a token extracts the value and leaves holders with something unsellable or worthless. On pump.fun this usually is not a single dramatic event. It is a sequence, often automated, and it comes in a few recognizable forms.

Bundled launches

A bundle is when the creator buys a large chunk of their own token in the very same block it launches, frequently across a myriad of wallets at once so it does not look like one person. Because Solana allows you to cram multiple transactions into one atomic bundle, the dev can create the token and snipe most of the early supply before any real outsider gets a chance.

The result: by the time the token shows up in your feed, the team may already control a huge share of it across wallets that look independent. They got in at the bottom of the curve, and every buyer after them is, by construction, pushing up the price the dev will eventually sell at. A bundled launch is not automatically a rug, but a heavily bundled one means the deck is stacked before you arrive.

Sniper bots

Even when the dev does not bundle, sniper bots typically do. These are essentially algorithms that listen for new pump.fun token launches and buy within milliseconds of creation, far faster than a human can. They are not investing, they are front-running you. Their plan is to buy in the first instants and sell into the wave of human buyers who arrive seconds to minutes later.

To a newcomer this feels like "the token is pumping, I should get in." What is actually happening is that bots who bought before you are distributing their bags to you at a markup.

Dev sells (the soft rug)

A hard rug is the obvious version: the dev pulls the liquidity or dumps everything at once and the chart goes to zero in one candle. Those still happen, but they are crude.

The more common and deceptive version is the soft rug: the dev sells gradually. They bleed their pre-bought supply into organic buying pressure over minutes or hours. The chart looks alive. Volume looks healthy. But net flow is uni-directional: their tokens out, your SOL in. By the time buying dries up, insiders have recovered far more than they put in, and holders are left with a dying asset and no one left to sell to.

Fake organic volume

A token with no real interest appears dead, and dead tokens do not attract buyers. So scammers manufacture life. Using many wallets, they trade the token back and forth, wash trading to inflate the volume numbers and keep the token climbing the "trending" and "recently active" lists where new buyers discover it.

This fake activity is the lure. It makes a coordinated exit look like a thriving market. The tell is that the volume is high but it is the same small cluster of wallets cycling SOL among themselves, with very few legitimate new participants. The crowd you think you are joining is often various wallets manipulated by one person, wearing trench coats.

Liquidity behavior at graduation

Graduation deserves special attention because it is often sold as a "safe" milestone but is frequently the opposite.

Once the token graduates to a real DEX pool, the brakes come off: deeper, more liquid markets allow large holders to sell large amounts quickly. A common pattern is insiders waiting for graduation, the hype peak, and the inrush of new buyers, then dumping their bundled supply into that fresh liquidity. The "graduation pump" can be the sound of the exit door opening, not a new beginning.

Red flags checklist

You can check most of these in two minutes using a Solana block explorer (such as Solscan) or a chart tool with holder data (such as a DEX screener). You do not need to be technical. You are just looking for who owns it and who is moving it.

• Holder concentration. Look at the top holders. If a small number of wallets hold a dominant share of supply, those wallets decide your fate. Concentration in a handful of wallets is the single loudest warning sign.
• Bundle percentage at launch. Many pump.fun analytics tools now show what percent of supply was bought in the launch block (the "bundle"). A high bundle percentage means insiders front-loaded the supply and are positioned to dump on you.
• Dev wallet history. Click into the creator wallet. Has this wallet launched many tokens before? Do those previous tokens all sit at zero? A graveyard of dead launches behind one wallet is a pattern, not bad luck. Serial deployers are serial sellers.
• Connected wallets and funding. See whether the top holders were all funded from the same source wallet shortly before launch. Common funding means coordinated control wearing a costume.
• Liquidity status. Is liquidity locked or burned, or can it be pulled? On pump.fun the curve handles this until graduation, but post-graduation you want to know nobody can yank the pool. Unlocked liquidity controlled by the dev is an open trapdoor.
• Social fraudulence. Tens of thousands of followers on an account created last week, comment sections full of artificial replies, a website with no real product, a "team" with no faces. Manufactured social proof is cheap. Treat sudden, shallow hype as a cost the scammer paid to reach you.
• Sell pressure that never stops. Watch the trade feed. If one cluster of wallets is consistently on the sell side while retail is on the buy side, you are watching distribution in real time.

No single flag is proof. But two or three together is a pattern, and patterns on pump.fun are usually concluded the same way.

How to protect yourself

• Assume you are late. By the time a token reaches you, bots and insiders almost certainly got in first. Price your decision as if you are the last buyer, because you might be.
• Check before you click, not after. The two-minute holder-and-dev check above is worth more than any amount of chart-staring. Do it before you buy, every time.
• Size like it can go to zero. Treat every pump.fun buy as money you are fully prepared to lose, because the rate of these tokens getting rugged is exorbitantly high.
• Distrust urgency. "Now or never," "last chance," "about to graduate" are not information. They are impulse triggers that will likely cost you money.
• Take profit on the way up, not at the top. If you are up, the rational move is to recover your principal early. The people who lose are the ones holding for the top that the insiders are selling into. Get in quick, get out quicker.
• Walk away from anything you cannot verify. If you cannot see who holds it or there is any ambiguity, you are gambling.

Securing the unseen

The hard truth is that most pump.fun tokens are not investments with bad outcomes. They are exit-liquidity mechanisms with a UI, and the math is decided before you arrive. The good news is that the same on-chain transparency that scammers exploit also exposes them. The wallets, the bundles, the funding trails, the distribution, it is all written to a public ledger. The edge is simply knowing where to look and being willing to look before you buy instead of after.