The Rug Pull Economy: Who Gets Paid When a Token Dies

On paper, Pump.fun is having one of its best months of the year. The Solana launchpad that lets anyone mint a token in seconds is booking roughly $14 million a week in fees, its highest run rate since February, and its PUMP token trades near $0.0049 for a market value close to $1.9 billion, according to CoinGecko. On that same platform, a Solidus Labs study still quoted throughout 2026 found that 98.6% of the tokens ever launched there ended as rug pulls or acts of fraud, as CoinDesk reported. Both numbers are true at the same moment, and the distance between them is the whole subject of this piece.

A rug pull used to be a lonely act: one anonymous developer, one liquidity pool, one midnight withdrawal, one deleted Telegram group. In 2026 it looks more like a supply chain. The wallet that drains the pool is only the last link. Ahead of it sits a launchpad that manufactured the token, a bundler that seeded the opening wallets, a marketing shop that rented an audience, a market maker that faked the volume, and a mixer that will wash the exit. Follow the money out of a dead token and you rarely find a single villain. You find a small economy.

Earlier coverage in this series walked through how a rug is built and what the chain reveals afterward. This piece asks a different question: who gets paid when a memecoin dies, and why has that roster of paid enablers proven so much harder to shut down than any single scammer? The short answer is that the enablers are legal, visible and diversified, while the person who pushes the final button is anonymous, offshore and already gone.

From Lone Developer to Managed Service

The mental image most people carry of a rug pull is a garage operation: a coder who spins up a token, hypes it on social media, waits for buyers, then yanks the liquidity and vanishes. That version still exists, and it still accounts for most of the raw count. What has changed is that each step in the sequence now has a vendor. You no longer need to write the contract, because a launchpad ships an audited-looking template. You no longer need an audience, because promotion is a rentable service. You no longer need real buyers to create the look of momentum, because volume can be manufactured. And you no longer need to figure out how to cash out cleanly, because laundering has its own tooling.

That division of labor matters because it changes who is exposed when things go wrong. The deployer is a throwaway wallet funded through a mixer. The enablers, by contrast, are businesses: a launchpad with a public token and a revenue dashboard, a marketing firm with a client list, a market maker with a Singapore office. When prosecutors and plaintiffs finally started making progress in 2026, they did not do it by unmasking anonymous devs. They did it by going after the visible middle of the supply chain. Hold that thought; it becomes the through-line of everything below.

The rest of this article walks the chain from the top down: the launchpad that mints the token, the services that lend it fake credibility and fake demand, the exit and the wash, and finally the two places where the money and the law now collide.

Rug Pull, Hack, or Just a Bad Bet? The Definitions That Matter

Precision here is not pedantry; it decides who is liable and whether a loss is even recoverable. A rug pull is a betrayal by insiders who control the token or its liquidity. A hard rug is the fast version: the team pulls the pooled liquidity in a single transaction, or the contract quietly mints new supply, or the code blocks selling so buyers can enter but never exit. A soft rug is the slow version: insiders who hold most of the supply bleed it into the market over days or weeks while promising a roadmap that never ships.

A hack is different. There, the attacker has no insider control; they exploit a bug, a leaked key, or a manipulated price feed. That distinction is why a price-oracle drain, the subject of our report on oracle manipulation on trial, is prosecuted as a market-manipulation or computer-fraud case rather than as fraud by a promoter. A wallet drainer that phishes an approval, covered in our look at crypto phishing in 2026, is theft from an outsider, not an inside job. And a plain collapse, a token that simply falls because nobody wants it, is not a rug at all, however much it feels like one. The gray zone between a rug and a collapse is real, and one of the biggest cases of 2025 sits squarely inside it, as we will see.

Why belabor this? Because the services economy exploits the confusion. If an operator can dress an exit up as a market accident, a forced liquidation, an unlucky bug, then no single actor is clearly a fraudster, and the enablers keep their deniability. The taxonomy is the first line of defense.

The Scale, and the One Number Everyone Repeats Wrong

If you search for the cost of rug pulls, you will keep hitting one figure: that Chainalysis found $2.8 billion in rug pulls in 2025. It is worth stating plainly that this number does not appear in any primary Chainalysis report. The firm’s 2026 crime report puts total crypto scams and fraud at about $17 billion for 2025, with roughly $14 billion confirmed on-chain, up from $9.9 billion a year earlier, and it never breaks out a rug-pull-specific line item. The famous $2.8 billion is almost certainly a garbled retelling of a much smaller and much sharper statistic: Solidus Labs measured a median rug value of about $2,800 per Solana token. Somewhere in the retelling, $2.8 thousand became $2.8 billion.

The corrected picture is actually more useful for understanding the economy. Most rugs are tiny. The damage comes from volume, millions of disposable tokens, plus the rare mega-rug that erases billions in a day. Chainalysis also reports that the average scam payment tripled, from $782 in 2024 to $2,764 in 2025, and that impersonation scams jumped roughly 1,400% while artificial-intelligence-assisted operations proved about 4.5 times more profitable than traditional ones. None of those headline numbers isolates rug pulls, which is exactly the point: rugs hide inside the aggregates, and the tiny ones that do get counted are dwarfed by the millions that never surface at all.

They hide in the hack reports too. Security firms tally what is technically a breach: an exploited bug, a leaked key, a phishing sweep. A rug is none of those. It is a business decision by the people who were supposed to be trustworthy, so it never earns its own line in a breach report. That is why the true rug total is unknowable, and why anyone quoting a tidy billion-dollar figure to two decimal places is guessing.

The Factory Floor: Launchpads and the Cross-Chain Spread

Every supply chain starts with manufacturing, and the factory floor is the launchpad. Pump.fun set the template on Solana: mint a token for a fraction of a cent, trade it on a bonding curve, and once it reaches a liquidity threshold it graduates to a decentralized exchange, historically Raydium and now the platform’s own PumpSwap, as Coin Bureau documents. The genius, and the danger, is the same feature: zero friction. A token exists in under a minute, with no code written and no cost that would deter a scammer running a thousand attempts.

The model did not stay on Solana. It has spread to wherever deployment is cheap and retail liquidity is deep. On BNB Chain, Four.meme runs the same bonding-curve-to-graduation playbook, with tokens migrating toward PancakeSwap. On Coinbase’s Base network, Zora reframes the whole thing as creator coins and content coins that settle into Uniswap liquidity, a framing that deliberately blurs the line between launching a token and abandoning one. Solana alone hosts Pump.fun, BONK.fun and Bags. The rug is now chain-agnostic; it follows the cheapest mint and the largest crowd.

The cross-chain data backs this up. On BNB Chain, the analytics vendor ChainAware claims its rug-pull detector logged $569,388,384 extracted across 103,695 distinct rug events on PancakeSwap version 2 in just the first 20 weeks of 2026, per its own writeup. Treat that as a vendor figure rather than a neutral audit, but the order of magnitude tells you the Solana story is not unique. The table below maps the terrain.

The launchpads themselves are not accused of pulling rugs. They are accused, in court, of building the machine that makes rugs frictionless and profitable, and of taking a cut of every trade in between. That distinction is where the legal fight is now being waged.

Credibility for Hire: Fake Audits and Rented Reach

A fresh token has no history, so operators buy the two things that substitute for it: proof and attention. Both are for sale.

Proof usually takes the form of an audit badge. A real audit is a time-boxed review that says a specific version of a contract was inspected for specific issues; it never certifies that the team is honest or that the token will not be dumped. Scammers exploit the gap between what a badge implies and what an audit actually promises. They fabricate reports, reuse logos from firms that never touched the code, or commission a genuine but superficial review and then change the contract afterward. The Hypervault case, discussed below, is a clean example: coverage noted the project leaned on audits later characterized as incomplete, exactly the kind of paper shield that reads as safety to a hurried buyer. If you want to know what a real review can and cannot tell you, that is a subject worth studying before you trust any badge.

Attention is the second purchase. Promotion networks of paid influencers, often called key opinion leaders, will post a token to primed audiences for a fee, sometimes disclosed as a partnership and often not. This is not a fringe accusation. The expanded class action against Pump.fun and Solana names 25 anonymous influencer defendants alongside the platforms, alleging a coordinated machine for funneling retail buyers into tokens designed to fail, as Decrypt reported. Rented reach is not a garnish on a rug; on the biggest cases it is the entire delivery mechanism.

The Illusion of Demand: Wash-Trading Market Makers

A token can have a badge and an audience and still look dead if nobody is trading it. So operators buy the last missing ingredient: volume. This is where the market-maker layer of the economy comes in, and it is the layer that United States prosecutors hit hardest in 2026.

On 30 March 2026, the Department of Justice unveiled Operation Token Mirrors, an undercover sting in which federal agents created their own token to catch the services that manufacture fake markets. Prosecutors charged ten foreign nationals across four market-making firms, Gotbit, Vortex, Antier and Contrarian, with running bots that wash-traded tokens between linked wallets to fabricate the appearance of demand, according to TRM Labs. The scheme touched more than 60 different cryptocurrencies and led to seizures topping $25 million, with some defendants pleading guilty and others extradited from Singapore. In the Gotbit sampling, the overwhelming majority of trades were self-dealing between the firm’s own wallets, sold to clients for a monthly retainer.

Wash trading is the connective tissue of the rug economy. It makes a soft rug look like a rally, it lets promoters point at a chart, and it manufactures the exit liquidity that lets insiders sell into what looks like organic buying. It is also, unlike an anonymous liquidity pull, a service with an invoice, a client and a corporate address, which is precisely why it is prosecutable. Operation Token Mirrors did not catch the ghosts who deploy tokens. It caught the businesses that make those tokens look alive.

The Exit and the Wash: Pulling Liquidity, Then Hiding It

The mechanical exit is the least sophisticated part of the whole chain. Once a pool is fat enough, the operator removes the liquidity, dumps the insider bag into whatever demand the wash traders manufactured, or flips a hidden switch that disables selling for everyone else. On a bonding-curve launch it can be a single transaction. The chart goes vertical, then to zero, and the token is a husk.

The harder and more revealing part is what happens next: the wash. Proceeds have to move from a traceable pool to spendable cash without lighting up every blockchain analytics dashboard. The Hypervault case shows the template. In late September 2025, the Hyperliquid-based yield project drained about $3.6 million, then bridged the funds to Ethereum, converted roughly 752 ETH and pushed it through the Tornado Cash mixer, as The Block documented. The website went dark and the social accounts were deleted. PeckShield flagged the abnormal outflows but, tellingly, could not identify the wallets beyond the mixer deposit. Forensics nailed the what and the how, and lost the who at the mixer’s front door.

That vanishing point is the enabler economy’s real moat. Mixers, cross-chain bridges and a patchwork of offshore venues form a laundering layer that regulators are still struggling to reach, a gap we examined in our coverage of FATF guidance and its offshore blind spots. As long as the exit can be laundered, the deployer stays anonymous, and the pressure shifts, again, onto the visible enablers upstream.

Case File: LIBRA and the Rented Reach of a President

If you want to see the whole economy compressed into a single event, look at LIBRA. On 14 February 2025, Argentine President Javier Milei posted, then deleted, an endorsement of a token called LIBRA. The price spiked into the billions in market value within about an hour, and insiders cashed out tens of millions of dollars on the first day before the collapse. The alleged architects sat inside a small circle of operators around the launch. What made LIBRA devastating was not a clever contract. It was the reach: the single most powerful promotional endorsement imaginable, from a head of state, functioning as the delivery mechanism for a token engineered to be dumped.

The case has stayed alive into 2026 precisely because the enabler layer is where the evidence lives. In April 2026, CoinDesk reported that Milei’s call logs linked him more closely to the token’s operators, keeping criminal inquiries active across multiple jurisdictions, per its account of New York Times reporting. Argentina’s Anti-Corruption Office had earlier cleared Milei of violating public-ethics rules, and his government disbanded an investigative task force, yet criminal complaints and forensic analysis of the promoters’ communications have continued. The lesson generalizes: the deployer of a token is a ghost, but the promoter who lends it credibility leaves call logs, contracts and payments. That is where investigators go.

Case File: Mantra and the Rug-or-Collapse Problem

Not every catastrophic crash is a rug, and pretending otherwise weakens the word. Mantra’s OM token is the case that keeps that honesty in check. On 14 April 2025, OM fell more than 90% in about an hour, from north of $6 to well under $0.50, erasing billions in market value, CoinDesk reported. The team blamed reckless forced liquidations on centralized exchanges during thin Sunday-night liquidity. On-chain observers noted team-linked wallets moving OM to exchanges before the crash, which looks like a warning sign, but no investigation has proven an insider exit, the project stayed operational, and it announced a large token burn.

So was it a rug? The honest answer is that intent and control are hard to prove, and the services economy thrives in exactly that ambiguity. A well-run exit can be dressed as a liquidation cascade; a genuine liquidation cascade can look like an exit. This is why the legal system has largely given up trying to prove the deployer’s state of mind and has instead gone after conduct it can document: fabricated volume, unregistered securities sales, coordinated promotion. Mantra is the reminder that the chain shows you movements, not motives.

The Economics: Why the Whole Chain Keeps Getting Paid

Strip away the drama and the rug economy is a simple arbitrage: the inputs are cheap and the extraction can be large. A mint costs pennies. A promotion push costs a few hundred to a few thousand dollars. Manufactured volume, on the Gotbit model, ran on the order of a monthly retainer per client. A fabricated audit badge costs almost nothing. Against that, the median rug takes only about $2,800, but the tail is where the money is, and the launchpad at the top of the chain earns on every single attempt whether it rugs or not. Pump.fun’s roughly $14 million in weekly fees, per CoinGecko, is revenue that does not care which of its tokens survive.

That asymmetry is why the economy is resilient. The deployer might net a few thousand dollars and disappear. The enablers, meanwhile, run a volume business with recurring revenue and diversified clients. Shutting down one scammer changes nothing; the launchpad, the promoters and the market makers simply serve the next thousand. The table below is the enabler’s rough invoice, with dollar precision deliberately withheld where no authoritative figure exists.

Pump.fun rejects the framing that its business is fraud. Asked about the Solidus study, spokesperson Troy Gravitt dismissed it, telling CoinDesk that what Solidus Labs lacks is a basic understanding of memecoins, the industry’s stock defense that a token going to zero is a feature of speculative culture, not a crime. Whether a court agrees is now an open legal question rather than a rhetorical one.

The Tools That Catch Some of It

A real detection industry has grown up alongside the rug economy, and it is genuinely useful for the crude cases. RugCheck reads Solana tokens for liquidity locks, mint authority and clustered insider wallets. GoPlus scores contracts across dozens of chains for honeypots, hidden owners and active mint functions. Token Sniffer and De.Fi Scanner match bytecode against known scam templates and malicious-contract databases. Honeypot.is simulates a buy and a sell to see whether you could actually exit. Vendors such as ChainAware and QuillCheck layer machine-learning models on top, scoring a deployer’s history as well as the code.

The people building these tools are candid about where the ceiling sits. Scanners flag the mechanical tells: the unlocked liquidity, the active mint function, the disabled sell, the deployer wallet with ten prior rugs behind it. They are fast, cheap and genuinely worth the two minutes they take. What they cannot do is read intent, and intent is where the modern rug lives.

There is one thing none of these tools can catch, and it is the most important. A legal, pre-announced insider unlock is a rug in slow motion that every scanner rates as safe. When a team or its backers hold a large vested allocation with a public unlock date, they can sell into the market entirely within the rules, tanking the price for everyone else, and no honeypot simulator or clustering model will flag it because nothing about it is hidden or illegal. Pump.fun’s own PUMP token moved through exactly this dynamic in 2026, when large tranches of insider supply unlocked on a public, pre-announced schedule. The scanners saw a normal token. The disclosure documents told the real story. The tools read code; they do not read a cap table.

The Law Starts Suing the Enablers, Not the Ghosts

Here is where the through-line pays off. For years the enforcement story was hopeless, because catching an anonymous deployer who laundered through a mixer is nearly impossible. In 2026 the strategy inverted. Plaintiffs and prosecutors stopped chasing ghosts and started suing the visible businesses in the middle of the chain.

The centerpiece is the Aguilar class action, which by January 2026 had grown from a suit against Pump.fun into a sweeping racketeering complaint. The second amended complaint, filed in the Southern District of New York, names not just Pump.fun’s operator Baton Corporation and its founders but Solana Labs, the Solana Foundation, named Solana executives and 25 anonymous influencers, framing the whole arrangement as a coordinated enterprise, with a proposed class value around $5.5 billion, per Decrypt. It leans on more than 5,000 leaked internal chat messages. The case is still at the motion-to-dismiss stage and the allegations are unproven, but its theory is the story of this article in legal form: go after the infrastructure, not the ghost who pulls the trigger. Operation Token Mirrors did the same on the criminal side, indicting market makers rather than token deployers.

The counterweight is jurisdictional confusion at the top. In February 2025 the Securities and Exchange Commission’s staff said most memecoins are not securities, likening them to collectibles, and Commissioner Hester Peirce agreed that many memecoins probably do not have a home at the SEC under current rules. Commissioner Caroline Crenshaw dissented sharply, warning that the guidance reads at best like a roadmap for crypto enterprises looking to evade oversight by labeling themselves as a meme coin. That split, mirrored by the no-issuer gap in Europe’s MiCA regime, is why so much of the fight has moved to private RICO suits and to state law. The regulatory calendar that will decide which agency finally owns this problem is the subject of our crypto regulatory countdown.

Can the Enabler Economy Be Starved Out?

Engineering can raise the cost of a rug but cannot eliminate it. Locked liquidity, renounced ownership and timelocked contracts all help, and all have been evaded: liquidity can be locked for a week and pulled on day eight, ownership can be renounced in name only, and a timelock is worthless if the malicious function was baked in before it was set. Platform-level accountability, the theory the Aguilar suit is testing, may do more than any contract feature, because it attacks the revenue that keeps the whole chain fed. If launchpads, promoters and market makers face real liability for the tokens they usher to market, the economics that make the enabler economy resilient start to wobble.

Until then, the practical defense is to assume the whole supply chain is arrayed against you and to spend ten minutes before you spend a dollar. Check who holds the supply and whether large tranches unlock soon, because that is the one rug the scanners miss. Run the contract through a honeypot simulator and a scanner like RugCheck or GoPlus to catch the mechanical traps. Discount promotion entirely; rented reach is a cost line for the operator, not a signal for you. Treat a fresh audit badge as a claim to verify, not a guarantee. And favor assets that clear the higher bar of a regulated exchange listing, a filter we describe in our comparison of Coinbase, Binance, Kraken and OKX, over anything that appeared on a bonding curve an hour ago.

The uncomfortable truth is that the rug pull persists not because scammers are brilliant but because a market of legal-adjacent services keeps them supplied. The token is disposable by design. The economy around it is not. That is why 2026’s most important rug-pull news is not another dead memecoin; it is a courtroom in New York deciding whether the people who build the machine can be held responsible for what it produces.

Frequently Asked Questions

What is a rug pull in crypto?

A rug pull is a scam in which the insiders who control a token or its liquidity betray the people who bought it. In a hard rug they remove the pooled liquidity, mint hidden supply, or block selling, all in one move. In a soft rug they slowly dump a large insider allocation while promising a roadmap that never ships. The defining feature is inside control, which is what separates a rug from a hack (an outside attacker) or an ordinary price collapse (nobody wants the token).

How much money is lost to rug pulls each year?

Nobody knows precisely, and you should distrust anyone who quotes an exact billion-dollar figure. The widely repeated $2.8 billion is not in any primary report and is likely a garbled version of Solidus Labs’ finding that the median Solana rug takes about $2,800. Chainalysis puts all crypto scams and fraud at roughly $17 billion for 2025 without isolating rugs. Rug pulls hide inside those totals rather than getting their own reliable line.

Are rug pulls illegal, and can you get your money back?

A rug pull can be prosecuted as fraud, unregistered securities sales, or racketeering, but recovery is rare because the deployer is usually anonymous and the proceeds are laundered through mixers. The more promising route in 2026 targets the visible enablers: the Aguilar class action is suing launchpad and network operators under RICO, and the Department of Justice’s Operation Token Mirrors charged market makers for wash trading. Direct restitution to individual victims remains the exception, not the rule.

How can you tell if a token is a rug pull before you buy?

Spend ten minutes on four checks. Look at holder distribution and any upcoming insider unlocks, because a scheduled unlock is the one rug that automated scanners cannot flag. Run the contract through a honeypot simulator and a scanner such as RugCheck or GoPlus to catch disabled selling, hidden mint functions and unlocked liquidity. Ignore paid promotion, which is a service the operator bought. And treat any audit badge as a claim to verify rather than proof of safety.

Which blockchain has the most rug pulls?

Solana leads by raw volume because Pump.fun made minting almost free, and Solidus Labs found that 98.6% of tokens launched there ended as rugs or fraud. But the pattern has spread to wherever deployment is cheap and retail is deep. BNB Chain hosts heavy activity through Four.meme, where the vendor ChainAware claims hundreds of millions were extracted across more than 100,000 rug events in early 2026, and Base has its own creator-coin launches through Zora. The rug follows the cheapest mint and the largest crowd, not any single chain.

By Anneke de Vries, security and compliance desk, HOGE Wire.