Americans told the FBI they lost $11.37 billion to crypto-related fraud in 2025, spread across 181,565 complaints. Investment fraud alone accounted for $7.2 billion of that, the single largest loss category in the Bureau's 2025 Internet Crime Report. Very little of that money vanished through clever exploits. Most of it walked out the door because someone bought a token nobody had checked. Learning how to check a crypto token before buying takes about fifteen minutes, a browser, and a willingness to close the tab when the answers are bad.
Fifteen minutes. That is the whole cost.
Why you should check a crypto token before buying anything
The base rate is worse than most beginners assume. Solidus Labs examined more than 7 million tokens created on Solana's Pump.fun launchpad between January 2024 and March 2025. Roughly 98.6% collapsed into pump-and-dump patterns shortly after launch. Only about 97,000 held liquidity above $1,000. On Raydium, the firm looked at 388,000 liquidity pools and found that 93% showed "soft rug pull" behavior, meaning the creator yanked liquidity and left holders with nothing to sell into. The median rug pull was $2,832. Small, repeated, and relentless.
Pump.fun pushed back, arguing that memecoins are supposed to be volatile and that the report misunderstood the category. Volatility is a fair defense. It does not change the arithmetic for the person on the buy side. If 98 out of every 100 tokens on a venue end up worthless, your edge has to come from filtering, because it will not come from luck.
The problem is not confined to anonymous launches either. The LAPTOP token tied to Hunter Biden drew rug-pull accusations within days, and the dispute came down to who controlled liquidity and when it moved. Famous names change the marketing. They do not change what you need to verify.
Step 1: Read the contract before you read the chart
Start with the contract address, and get it from the project's official website or a pinned post on its verified account. Never from a reply, a DM, or a Telegram "admin" who messaged you first. Copycat tokens with identical names and logos are the oldest trick in the book, and they work because people search by ticker instead of address.
Paste the address into the block explorer for that chain: Etherscan for Ethereum, BscScan for BNB Chain, Basescan for Base, Solscan for Solana. Look for the verified source code marker. On EVM chains that is a green check on the Contract tab. Verification means the deployed bytecode matches published, readable code, which is what lets anyone audit it. Ethereum's own documentation explains the mechanism. If the code is unverified, you are being asked to trust a black box. Decline.
Once the code is visible, you are hunting for three kinds of power the deployer may have kept:
Mint authority. Can the owner create new tokens at will? Unlimited minting makes your bag dilutable to zero.
Blacklist, pause, or transfer limits. Functions that let an owner freeze specific wallets or halt trading. Sometimes legitimate for stablecoins. Rarely legitimate for a memecoin.
Adjustable taxes and proxy upgrades. A sell fee that can be raised to 99% after you buy is a rug with extra steps. A proxy contract means the logic itself can be swapped later, so "renounced ownership" on the token may mean little.
You do not need to read Solidity to catch these. GoPlus Security's free token scanner flags hidden mint functions, proxy patterns, blacklists, and modifiable fees in plain language. Token Sniffer scores EVM tokens and compares code against known scam templates. RugCheck does the same job for Solana, including whether the mint and freeze authorities have been revoked. Run two of them. They disagree often enough that one is not sufficient.
Then test for a honeypot, a contract that lets everyone buy and only the deployer sell. Honeypot.is simulates a buy and sell against the live contract. Take the result seriously but not as gospel: sellers of honeypot kits openly advertise that their newer builds pass automated scans. That is why the final check in this list involves your own wallet and a tiny amount of real money.
Step 2: Follow the liquidity, then follow the holders
Liquidity tells you whether you can leave. Open the token on DEXScreener or DEXTools and look at the pool size. A token with $30,000 in liquidity cannot absorb a $5,000 sell without cratering, no matter what the chart says. As a rough floor, under $50,000 in a single pool means you are trading against a puddle.
Next, ask who controls that liquidity. When a creator adds tokens and ETH or SOL to a pool, they receive LP tokens that represent the right to withdraw it all. If those LP tokens sit unlocked in the deployer's wallet, the pool can be drained in one transaction. That is the mechanical definition of a rug pull. Look for LP tokens sent to a burn address (permanent) or locked in a service like Team Finance or Unicrypt, and check the unlock date. A 30-day lock on a token being marketed as a long-term play is a timer, not a commitment.
Holder distribution comes next. The explorer's Holders tab lists the top wallets. Exclude the liquidity pool and any burn address, then add up the top ten. If they hold more than 30% to 40% of supply, a handful of wallets can dump on you at will. Watch for clusters: many wallets funded from the same source, created within minutes of each other, that all bought in the launch block. Pine Analytics documented deployer-funded, same-block sniping on Pump.fun, where the creator effectively buys their own launch through puppet wallets to simulate demand. Fifteen "early buyers" that share a funding parent are one buyer.
Finally, sanity-check the volume. Daily volume several times larger than liquidity, with uniform trade sizes bouncing back and forth, is wash trading. Real demand looks messy. Fake demand looks like a metronome.
Concentrated control is not only a small-cap problem. Cosmos Hub had to scramble when a governance attack on Neutron put millions in ATOM at risk. Whoever holds the keys, whether to a multisig, a governance quorum, or an LP position, holds the outcome.
Step 3: Check the people, then check yourself
Teams can be anonymous and honest. They can also be doxxed and crooked. What matters is whether the public record matches the pitch. Does the GitHub show real commits over months, or a fork pushed last Tuesday? Does the "audit" link lead to the auditor's own website, where you can confirm the report exists, or to a screenshot in Telegram? Unverifiable audits are decoration. Does the domain registration date line up with the project's claimed history? A WHOIS lookup takes ten seconds.
Look at the socials with a cynical eye. A hundred thousand followers and twelve replies per post is a purchased audience. Telegram groups with chat disabled exist to prevent questions. Promises of guaranteed returns, countdown timers, and "last chance" pricing are not marketing styles. They are the scripts fraud investigators see over and over in the complaints behind that $7.2 billion.
Now the part most guides skip: test with real money, in an amount you would not miss. Buy a small position. Wait a few minutes. Sell half of it. If the sell fails, reverts, or returns far less than the quoted price, you have your answer and you paid a few dollars for it. Then revoke the token approval you just granted to the router. Lingering approvals are how old positions turn into new losses, something Magic Eden users relearned when an exploit risk forced mass defensive transfers. Revoke.cash and the explorer's token-approval checker both handle this.
The checklist, condensed:
Contract address from an official source only.
Source code verified on the explorer.
No mint, blacklist, adjustable-tax, or proxy powers (or a clear, documented reason for them).
Two scanner results plus a honeypot simulation.
Liquidity above $50,000, LP burned or locked with a distant unlock.
Top ten holders under 30% to 40%, no same-block wallet clusters.
Volume that looks human.
Team, audit, and domain claims you can independently confirm.
A small test buy and a successful test sell.
Approvals revoked, position sized to survive a total loss.
Blockchain analytics firm Chainalysis tracked $154 billion in illicit crypto volume during 2025, with scam operators increasingly using AI-generated personas and deepfaked endorsements to look legitimate. The polish on the front end is getting better. The contract, the pool, and the holder list cannot be polished; they are what they are, on-chain, for anyone who bothers to look.
The next launch that lands in your feed will have a countdown timer on it. The timer is the first red flag. Run the list anyway, and notice how often you never make it past step two.
