Crypto Rug Pull: What to Do When a Project Disappears

You invested in a project. The team seemed legitimate. The roadmap looked real. Then one day the website is gone, the Telegram is deleted, the developers have vanished, and your investment is worth nothing or close to it.

This is a rug pull. It is one of the most common forms of crypto fraud, and it is far more traceable than most victims realize.

What Is a Rug Pull?

A rug pull occurs when the creators of a cryptocurrency project (a token, an NFT collection, a DeFi protocol, or a liquidity pool) deliberately abandon the project and abscond with investor funds.

There are two main types:

Hard rug pull. The developers drain the liquidity pool or smart contract treasury in a single transaction, convert the funds to ETH or another liquid asset, and disappear. This happens fast, sometimes within hours of a project launch. Victims are left holding a token that is now worthless because all liquidity has been removed.

Soft rug pull (slow rug). The team gradually sells their token allocation over time (often while continuing to post updates and maintain the appearance of legitimacy) until they've exited their position. The token price collapses slowly. By the time victims recognize what happened, the developers are long gone with their profits.

Both are fraud. Both leave a forensic trail on the blockchain.

Can a Crypto Rug Pull Be Traced?

A rug pull requires the developers to move money. That movement is recorded permanently on the blockchain.

When a developer drains a liquidity pool, the funds move from the pool contract to a developer wallet. From there, they typically get converted to ETH or a stablecoin, bridged to another chain, and eventually routed toward a centralized exchange for cash-out. Every one of those steps is a transaction, and every transaction is traceable.

What forensic tracing looks for in a rug pull case:

Developer wallet identification. The deployer address of the project's smart contract is public. All transactions from that address (including the rug itself) are visible on the blockchain.
Liquidity drain transactions. The exact transaction that removed liquidity from the pool is documented, timestamped, and linked to the receiving wallet.
Fund flow post-drain. Where did the money go after the rug? Which wallets, which bridges, which exchanges?
Exchange deposit identification. If the funds reached a centralized exchange, that's the most actionable finding; it opens the door to a freeze request and, with legal process, identity disclosure.
Premeditation evidence. Forensic analysis of the smart contract code and transaction patterns often reveals whether the rug was planned from the start (honeypot mechanics, hidden admin functions, pre-minted developer allocations), all of which strengthen a fraud case.

1Document Before the Trail Cools

The first thing to do after recognizing a rug pull is document everything, immediately.

Save the following:

The token contract address: find it on the DEX where you bought the token (Uniswap, PancakeSwap, etc.) or on the block explorer
The project's original website URL: even if it's now offline, the URL itself is evidence. Check archive.org (the Wayback Machine) to capture archived versions of the site before they're gone
The liquidity drain transaction hash: find it by looking at the token contract address on the block explorer and identifying the transaction that removed liquidity
The developer wallet address: the address that deployed the contract and/or received the drained funds
Screenshots of the project's social media, Telegram, Discord, and any communications with the team; save these before accounts are deleted
Your purchase transaction hash: proof that you invested
The dollar value of your investment at time of purchase

The Wayback Machine at archive.org can retrieve cached versions of websites that have since been taken down. Do this immediately; the cache may disappear.

2Identify Whether This Is a Coordinated Fraud

Rug pulls are rarely isolated incidents. Most serial rug pullers operate multiple projects, often in rapid succession, using the same developer wallets, the same contract templates, and the same playbook.

A forensic trace of the developer wallet often reveals prior rugs: the same address that drained your project may have drained three others in the preceding months. This cross-case evidence is powerful for law enforcement because it establishes a pattern of criminal conduct rather than a single incident.

If you can identify other victims of the same developer (through crypto fraud communities on Reddit, X, or Telegram), coordinate with them. Multiple victims filing IC3 reports that reference the same wallet address makes it easier for investigators to connect the reports.

3File with the FBI IC3

Go to ic3.gov and file a complaint. Include:

The token name and contract address
The developer wallet address
The liquidity drain transaction hash
The dollar value of your loss at time of investment
A description of the project and how you came to invest
Screenshots of any communications with the team
Your purchase transaction hash

Be specific. A report that includes contract addresses and transaction hashes is dramatically more useful than one that says "I invested in a token and lost money."

If you know of other victims, mention it in your report and encourage them to file separately, each referencing the same developer wallet address.

4Report to the Platform Where You Bought

If you purchased the token on a centralized exchange, report the fraud to that exchange's compliance team. Most major exchanges have processes for flagging fraudulent tokens and can freeze associated accounts if they receive documented reports quickly enough.

If you bought on a DEX like Uniswap or PancakeSwap, report the fraudulent token to the DEX interface team; most have a token flagging mechanism. While DEXes can't freeze funds, flagging the token prevents future victims and creates a record.

Also report to:

CoinGecko and CoinMarketCap: both have fraud reporting mechanisms and can flag or delist fraudulent tokens
The blockchain's native security team: Ethereum, BNB Chain, and others have security contacts for reporting fraud
Your state attorney general: many states have financial fraud divisions that handle crypto cases

5Get a Forensic Trace

A forensic trace of a rug pull follows the developer wallet from the drain transaction through every subsequent hop, identifying where the money ended up and whether it reached a traceable exchange.

This is what converts your IC3 report from a complaint into an actionable case file. When law enforcement has a complete forensic trace documenting the drain, the laundering path, and the exchange destination (along with evidence of prior rugs by the same developer), a case can move.

ChainWatch forensic tracing

ChainWatch provides forensic tracing for victims. We analyze the developer wallet, document the complete fund flow post-rug, identify exchange deposits, and deliver a law enforcement referral package ready for IC3 submission.

Request a case review

Can You Get Your Money Back After a Rug Pull?

Realistic expectations matter.

Most likely outcome with no action: The developer moves on to the next rug, your funds are laundered through an exchange and cashed out, the case goes cold.

Most likely outcome with documented action: Your IC3 report and forensic trace go into the federal database. If the developer runs future rugs, the pattern connects to your case. When law enforcement identifies a suspect (often through an exchange account disclosure), your case may be included in a prosecution with restitution proceedings.

Best-case outcome: The forensic trace identifies that funds are still sitting at a centralized exchange deposit address, a freeze request is honored, and law enforcement secures a court order. This happens, not in every case, but in documented cases where victims acted quickly and had forensic documentation.

The key variable is whether you filed a specific, documented report and got a forensic trace before the developer moved everything to a non-custodial wallet or cashed out. Speed matters.

How to Spot a Rug Pull Before You Invest

Before investing in any new crypto project:

Check the contract. Tools like Token Sniffer, Honeypot.is, and De.Fi Scanner analyze smart contract code for rug pull mechanics: hidden mint functions, blacklisting, liquidity lock bypasses. Run any new token through at least one of these before investing.

Check the liquidity lock. Legitimate projects lock their liquidity for a defined period using a third-party locker like Unicrypt or Team.Finance. Unlocked liquidity means the developer can drain the pool at any time.

Check the developer wallet history. Search the deployer address on Etherscan or BscScan. Has this wallet deployed other tokens? What happened to them? A developer who has deployed and abandoned multiple tokens is a major red flag.

Verify the team. Anonymous teams are not automatically fraudulent, but they are higher risk. Look for verifiable identities, prior project history, and credible advisors.

Be skeptical of influencer promotion. Paid promotion of low-cap tokens is endemic to the rug pull ecosystem. If a project is being heavily promoted by crypto influencers on X or YouTube, that is a signal to do more due diligence, not less.

Rug pulls: common questions

How do I know if a project has rug pulled?

The usual signs are a website that has disappeared, deleted Telegram or Discord channels, developers who have gone silent, and a token that can no longer be sold because its liquidity was removed. On the block explorer, look up the token contract for a transaction that removed liquidity or large sales from the developer wallet.

The developers were anonymous. Can they be identified?

The wallet that deployed the project’s contract is public, and so is every transaction from it, including the drain. If the drained funds reached a centralized exchange, legal process can require that exchange to disclose the account holder.

Where do I report a rug pull?

File with the FBI at ic3.gov, including the token contract address, the developer wallet and the drain transaction. Also report it to the exchange or DEX where you bought, to CoinGecko and CoinMarketCap, and to your state attorney general.

Other people lost money in the same project. Should we work together?

Yes. Encourage each victim to file their own IC3 report that references the same developer wallet address, and mention the other victims in yours.

The Bottom Line

A rug pull is not the end of the road. The developers left a trail: the blockchain recorded every transaction from the drain to wherever the funds ended up. The question is whether someone follows that trail before it goes cold.

File with IC3. Get a forensic trace. Keep the case alive.