This is the ChainAware Weekly Rug Pull Tracker — published every week, covering PancakeSwap V2 on BNB Chain. The numbers come from ChainAware’s on-chain analysis: every pool where a contract creator added liquidity and then removed more than they added. The difference is retail money. Gone.

Week-over-Week: The Biggest Single-Week Jump in 20 Weeks

Week 20 stands out sharply against the four weeks that preceded it. After a sustained low-activity period running from Week 16 through Week 19 — where weekly extraction averaged just $15M — Week 20 delivered a 191% spike. This is the largest week-over-week percentage increase in the entire 20-week dataset.

What the W20 Spike Tells Us

Four consecutive low weeks followed by a sharp resurgence is a recognizable pattern in this dataset. It appeared after the W4 peak ($53.4M) when extraction compressed through W8 before partially recovering. It appeared again after W13 when extraction declined through W19 before snapping back in W20.

The compression-then-spike pattern reflects the operational rhythm of professional rug pull operators. Low-sentiment periods reduce retail capital inflows into new pools — making large extractions less profitable. Operators compress their activity, reduce deployment volume, and wait. When market sentiment recovers and retail capital returns to speculative DeFi activity, operators re-accelerate. The W20 spike is not an anomaly. It is the beginning of a new extraction cycle.

Two data points support this reading. First, total pools created jumped from 9,777 in W19 to 10,752 in W20 — a 10% increase in deployment volume alongside the 191% increase in fraud value. Operators deployed more pools AND extracted more per pool simultaneously. Second, the ratio of removed-to-added liquidity widened sharply: W19 was 1.50x (removed/added), W20 was 1.79x. Operators are extracting a higher fraction of the available liquidity per pool — a signal of more aggressive execution.

RUG PULL DETECTOR V3 — FREE

Check Any Pool Before You Invest — 90.1% Accuracy

Behavioral analysis of contract creators + smart contract code inspection. Handles pools and individual tokens. No signup required. For businesses, subscribe to the API. For AI agents, X402 protocol is enabled.

→ Run a Free Check at chainaware.ai/rugpull

20-Week Running Total: $569M and Counting

Week 20 closes the first 20-week measurement period of 2026. The cumulative picture is stark:

The W20 spike pushes the 5-week trailing average (W16–W20) to $20.2M — below the 20-week mean of $28.5M, but trending sharply upward. If the W20 resurgence continues into W21, the trailing average will recover toward the historical mean within two weeks. For the full 20-week methodology and dataset, see our complete $569M PancakeSwap V2 rug pull analysis.

How to Protect Yourself

Every rug pull event in this dataset was preventable. Not by avoiding DeFi — but by checking before investing. ChainAware’s free tools take under two minutes per token:

• Rug Pull Detector V3 — paste any pool address or token contract. V3 runs behavioral analysis of the contract creator AND inspects the smart contract code. 90.1% prediction accuracy. Free, no signup.
• Fraud Detector — paste the deployer wallet address. Checks the full on-chain behavioral history of the person behind the contract. 98% accuracy.
• Wallet Auditor — for P2P transactions. Audit any receiving wallet before sending irreversible funds.

For DApps that need to screen wallets at connection automatically, ChainAware’s Transaction Monitoring Agent deploys via Google Tag Manager in 12 minutes with no code changes — screening every connecting wallet in real time and blocking bad actors before any transaction begins.

NEXT WEEK

Week 21 Data Published Every Monday

ChainAware publishes fresh PancakeSwap V2 rug pull data every week — pool creation, rug events, fraud value, and week-over-week analysis. Bookmark this page or follow ChainAware on X to get each week’s numbers as they drop.

→ Follow ChainAware at chainaware.ai

About This Tracker

The ChainAware Weekly Rug Pull Tracker measures the most basic, mathematically verifiable form of rug pull on PancakeSwap V2: a contract creator adds liquidity (Mint event), retail investors buy in, and the creator removes more than they added (Burn event). The difference is confirmed retail loss.

This definition is deliberately conservative — it excludes more complex extraction methods (LP token transfer rug pulls, unlocked token sell-offs, honeypot contracts, associated wallet extraction). The numbers reported here represent the confirmed floor. Real total losses are higher. For the complete methodology, see chainaware.ai/resources/rugpull-verification .

Coverage will expand to additional DEXes and chains in coming weeks. Follow the Rug Pull News archive for every weekly update.

The post $39.9M Extracted in Week 20 — PancakeSwap V2 Weekly Rug Pull Tracker first appeared on ChainAware.ai.

103,695 separate rug pull events. $1,947,176,810 in liquidity removed by contract creators. $1,377,788,426 added before removal. The difference — $569,388,384 — flowed directly out of retail wallets and into the pockets of fraudulent actors operating industrial-scale extraction infrastructure on one of the world’s largest decentralized exchanges. Every single week. Quietly. Without ceremony.

This is the rug pull industry. Not a bug. An industry.

Today, ChainAware.ai publishes this data for the first time — and simultaneously launches Rug Pull Detector V3, our most advanced version yet, with 90.1% prediction accuracy achieved by combining behavioral analysis of contract creators with full smart contract inspection. This is the complete picture: what the data shows, why nobody talks about it, how the extraction machinery works, and how to stop it.

In This Guide

• The $569M Dataset: What We Measured and How
• Week-by-Week Breakdown: 20 Weeks of Retail Extraction
• The Industry Silence Problem: Why Nobody Talks About Rug Pulls
• How Rug Pulls Work: The Mechanics of Liquidity Extraction
• Beyond Basic Rug Pulls: The More Complex Extraction Methods We Did Not Count
• Rug Pull Detector V3: From 68% to 90.1% Prediction Power
• How the V3 Algorithm Works: Behavioral + Smart Contract Analysis
• Algorithm Verification and Accuracy Methodology
• Who Uses Rug Pull Detector: Retail Investors, Businesses, and AI Agents
• Projection: How Many Rug Pulls in the Next 20 Weeks?
• The Complete Protection Stack for DApps and Retail Investors
• Frequently Asked Questions

The $569M Dataset: What We Measured and How

ChainAware analyzed every liquidity event on PancakeSwap V2 across weeks 1 through 20 of 2026. The methodology is deliberately conservative. We measured only the most basic, unambiguous form of rug pull: a contract creator adds liquidity to a pool, then removes more than they added. The difference between liquidity added and liquidity removed — when removal exceeds addition — constitutes the rug pull value we report.

This definition intentionally excludes more sophisticated extraction methods. Complex multi-step schemes involving LP token transfers, associated wallet sell-offs, and unlocked token dumps are not included in these numbers. The $569M figure represents the floor — the minimum provably fraudulent extraction we could measure with mathematical certainty from on-chain data alone.

The full dataset covers:

• Total rug pull events detected: 103,695
• Total liquidity added by creators (Mints): $1,377,788,426
• Total liquidity removed by creators (Burns): $1,947,176,810
• Net extraction (Burns minus Mints): $569,388,384
• Period: Week 1 through Week 20, 2026
• Exchange: PancakeSwap V2 (BNB Chain)

PancakeSwap V2 on BNB Chain is one of the highest-volume decentralized exchanges in the world. It is also, by our measurement, one of the largest venues for systematic retail investor fraud. The combination of low gas fees, high token creation velocity, and large retail liquidity makes BNB Chain the preferred operating environment for industrial-scale rug pull operations.

For context on just how large this ecosystem of fraud is: the Bybit hack in February 2025 — which generated enormous industry coverage, emergency response coordination, and weeks of Twitter discussion — extracted $1.46 billion. Our 20-week PancakeSwap V2 measurement represents 39% of that headline-grabbing figure. On one DEX. In one 20-week window. With virtually zero media coverage.

FREE TOOL

Check Any Token or Pool Before You Invest

ChainAware Rug Pull Detector V3 analyzes behavioral signals from contract creators and inspects smart contracts before you commit a single dollar. Free to use. No signup required.

→ Run a Free Rug Pull Check at chainaware.ai/rugpull

Week-by-Week Breakdown: 20 Weeks of Retail Extraction

The weekly data reveals patterns that any serious analyst of DeFi fraud should study carefully. Rug pull activity is not random noise. It follows detectable rhythms tied to market sentiment, BNB price movements, and the operational cadence of the fraud factories running these schemes.

What the Weekly Patterns Tell Us

Four distinct patterns emerge from careful analysis of this 20-week dataset. Each pattern carries significant implications for how rug pull operations are structured and how retail investors can protect themselves.

Pattern 1 — Early surge, then stabilization: Weeks 1 through 5 represent the highest-intensity period, with Week 4 peaking at $53.4M in a single week. This early-year surge correlates with January–February market optimism, when retail capital flows into DeFi most aggressively following holiday periods. Fraud operators know this and deploy capital accordingly.

Pattern 2 — Persistent baseline fraud: Even in quieter weeks (W8, W17, W18, W19), fraud never drops to zero. The range of $12.6M to $16.7M represents what we call the baseline rug pull floor — the irreducible minimum level of extraction that persists regardless of market conditions. These weeks demonstrate that rug pulls are not opportunistic responses to bull markets. They are a continuous, professionally operated business.

Pattern 3 — Pool creation velocity diverging from fraud events: Week 2 shows the highest pool creation (24,145 total pools) but does not produce the highest fraud value. Week 4 shows far fewer pools (17,984) but delivers the peak fraud extraction. This divergence suggests that fraud operators optimize for pool value, not pool volume — they are creating fewer but more lucrative pools rather than flooding the market with low-value scam tokens.

Pattern 4 — Week 20 resurgence: After a six-week decline from W14 through W19, Week 20 spikes back to $39.9M — the second-highest single-week figure in the dataset. This resurgence suggests cyclical fraud campaigns that compress activity during low-sentiment periods and re-accelerate when retail interest returns. The Week 20 data point is a leading indicator, not an anomaly.

The Industry Silence Problem: Why Nobody Talks About Rug Pulls

Here is a question worth sitting with: Why does a $1.46B exchange hack generate hundreds of articles, emergency response calls, and weeks of industry-wide discussion — while $569M in retail losses across 20 weeks generates almost no coverage at all?

The answer is structural. Exchange hacks are dramatic, concentrated, and attributable. They happen to institutions — Bybit, Binance, Euler Finance — that have PR teams, legal counsel, and market presence. Rug pulls happen to anonymous retail investors, dispersed across thousands of small transactions, with no single victim large enough to command media attention and no single perpetrator identifiable enough to pursue.

$53.4M stolen from a major exchange in a single transaction is a crisis. $53.4M stolen from 6,000 retail investors across thousands of micro-transactions in a single week is business as usual. The victims are too distributed to organize. The fraud is too normalized to shock. The perpetrators are too anonymous to name.

This structural invisibility benefits the rug pull industry enormously. Unlike hacks — which trigger security audits, insurance claims, regulatory investigations, and protocol upgrades — rug pulls operate in a consequence-free zone. The operators who ran this week’s $28M extraction will run next week’s extraction with identical infrastructure. Nothing stops them. Nobody is watching. The industry is busy discussing the latest Layer 2 throughput numbers.

The Chainalysis 2025 Crypto Crime Report documents $17 billion in total crypto scam losses — a figure that includes rug pulls, phishing, fake investments, and other fraud categories. Rug pulls constitute one of the largest subcategories within this total, yet they receive proportionally far less analytical attention than flash loan exploits, bridge hacks, and protocol vulnerabilities.

Part of the problem is that rug pulls do not fit the traditional Web3 security narrative. Security firms make revenue from smart contract audits, not from behavioral fraud detection. Media outlets generate traffic from dramatic hacks, not from steady-state extraction statistics. Influencers amplify projects that pay them, not warnings that might upset project teams with marketing budgets. The incentive structure of the crypto information ecosystem systematically underweights the most consistent form of retail harm.

ChainAware exists, in part, to change this. Publishing this data is the first step. Building tools that let retail investors and DApps verify tokens and pools before committing capital is the second. For a broader perspective on the comparison between rug pulls and pump-and-dump schemes and how each extracts value from retail investors, our dedicated guide covers the full mechanics of both fraud types.

How Rug Pulls Work: The Mechanics of Liquidity Extraction

Understanding rug pull mechanics is the foundation of avoiding them. The basic liquidity rug pull — the type we measured in this dataset — follows a repeatable, five-step operational sequence that any investor can learn to recognize.

Step 1: Token and Pool Creation

A fraudulent actor deploys a new ERC-20 or BEP-20 token contract. On BNB Chain, this costs a fraction of a dollar and takes minutes. The token contract typically includes mint functions (allowing the creator to generate unlimited supply), hidden transfer restrictions (preventing buyers from selling), and ownership functions that are often not renounced. The pool is created on PancakeSwap V2 by pairing the new token with BNB or USDT, establishing an initial price.

Step 2: Liquidity Seeding

The creator deposits initial liquidity — real BNB or USDT — into the pool alongside the worthless token they created. This establishes a tradeable pair and makes the token appear legitimate on DEX aggregators and portfolio trackers. The liquidity seed is the bait. It represents the money the fraudster is temporarily risking to attract retail capital.

Step 3: Marketing and Social Momentum

Telegram groups are created. Twitter accounts post about the new token. Sometimes influencers are paid to promote it. Bots generate artificial trading volume to make the token appear active. Retail investors see a token with real liquidity, active trading, and social proof — and buy in. Each purchase increases the price and deepens the liquidity pool with real capital.

Step 4: Liquidity Removal

Once sufficient retail capital has entered the pool, the creator burns their LP tokens — withdrawing all liquidity from the pool. This single transaction extracts all the BNB or USDT that retail investors deposited when they bought the token. The token price drops to zero instantly. Holders are left with worthless tokens that cannot be sold. The creator walks away with the full liquidity amount, minus their initial seed deposit. The difference is pure profit extracted from retail investors.

Step 5: Repeat

Professional rug pull operators do not run one scheme. They run dozens simultaneously, across multiple wallets, with industrialized tooling that automates contract deployment, social media posting, and liquidity management. The 103,695 rug pull events in our dataset represent the output of a mature industry with operational infrastructure comparable to a sophisticated affiliate marketing operation — except the product being sold is fraud.

FRAUD DETECTOR

Is This Wallet Behind Your Token Safe?

ChainAware Fraud Detector analyzes the behavioral history of any wallet address — including token creators — to predict fraudulent intent with 98% accuracy. Check any creator wallet before you buy.

→ Run a Free Fraud Check at chainaware.ai/fraud

Beyond Basic Rug Pulls: The More Complex Extraction Methods We Did Not Count

Our $569M figure covers only the most conservative, mathematically verifiable form of rug pull: direct liquidity removal exceeding direct liquidity addition, by the same contract creator. This definition was chosen deliberately — it produces numbers that cannot be disputed, because they are derived purely from on-chain transaction data with no inferential assumptions.

However, professional rug pull operators frequently use more sophisticated extraction methods that our current measurement excludes. Understanding these methods matters for two reasons: first, because they represent additional losses not captured in the $569M figure; second, because ChainAware’s Rug Pull Detector V3 is being extended to detect these more complex patterns in future iterations.

LP Token Transfer Rug Pulls

Instead of burning LP tokens directly, the creator transfers them to a secondary wallet before burning. This adds one intermediary step that breaks the direct creator-to-burn attribution our basic methodology requires. The economic outcome is identical — retail liquidity is extracted — but the attribution chain is one step longer. Detecting this pattern requires tracking LP token ownership across wallets, not just monitoring mint/burn events on the original creator address.

Unlocked Token Sell-Offs

Some rug pulls never involve liquidity removal at all. Instead, the creator holds a large pre-minted supply of unlocked tokens and sells them gradually into the market as retail buyers push the price up. This is the “slow rug” — a controlled sell-off that extracts value over days or weeks rather than in a single transaction. Detecting this requires monitoring creator wallet sell behavior relative to price action, not liquidity pool events.

Associated Party Extraction

Sophisticated operators fund multiple secondary wallets that receive token allocations at launch and sell into retail buying pressure. The creator’s primary wallet never transacts after the initial liquidity seed — only associated wallets do. Connecting these wallets to the creator requires graph analysis of funding transactions, not just monitoring of the deployer address.

Honeypot Contracts

A honeypot is a contract that allows buying but blocks selling. Transfer restrictions embedded in the contract — hidden from Etherscan views unless you know where to look — prevent token holders from executing sell transactions. Buyers accumulate tokens they cannot sell, while the creator sells their pre-minted allocation freely. GoPlus Security detected 67,241 honeypot tokens in Q4 2024 alone — a figure that underscores the scale of this specific fraud variant. For a full comparison of rug pull detection tools that cover honeypot analysis, see our guide to best Web3 rug pull detection tools in 2026.

The conservative $569M figure — our confirmed minimum — would be substantially higher if all these additional extraction methods were included. ChainAware’s V3 algorithm already incorporates smart contract analysis that can detect honeypot patterns and some forms of unlocked token sell-off risk. Future iterations will extend this coverage further.

Rug Pull Detector V3: From 68% to 90.1% Prediction Power

The previous version of ChainAware’s Rug Pull Detector operated at approximately 68% prediction accuracy. For retail investors, that accuracy level is better than nothing — significantly better than the zero-analysis approach most investors use. However, 68% means that roughly one in three high-risk pools would pass the detector without a warning, and some legitimate pools would trigger false positives.

Our customers asked directly: can we do better? The answer is V3 — and the answer is yes.

ChainAware Rug Pull Detector V3 achieves 90.1% prediction accuracy. This jump from 68% to 90.1% represents a 32.5% relative improvement in prediction power — the largest single-version upgrade in the detector’s history. The improvement comes from a fundamental architecture change: V2 relied exclusively on behavioral analysis of contract creators. V3 combines behavioral analysis with full smart contract inspection.

Why the V2 Accuracy Gap Existed

Behavioral analysis alone — examining the on-chain history of the wallet that deployed a contract — is a powerful signal, but it has a ceiling. Experienced fraud operators know that behavioral signals can be spoofed. They create fresh wallets with clean histories. They fund deployer wallets through legitimate channels. They space out deployments to avoid clustering signals that behavioral models flag.

A behavioral model trained purely on creator wallet history will inevitably miss sophisticated operators who invest in maintaining clean deployer identities. This is the category that the 32% gap in V2 accuracy primarily represented. The false negatives were concentrated in professional, well-organized fraud operations — precisely the operators responsible for the largest individual rug pull events.

What V3 Adds: Smart Contract Analysis

Smart contract analysis reads the code of the contract itself — not just the history of the wallet that deployed it. Regardless of how clean a deployer wallet’s history looks, a contract with hidden mint functions, owner-only transfer restrictions, or unchecked liquidity lock mechanisms will trigger V3’s contract analysis layer.

This combination closes the gap that sophisticated fraud operators had exploited in V2. A fraudster who maintains a clean wallet but deploys a honeypot contract now triggers the smart contract analysis layer even when the behavioral analysis layer returns a clean signal. Conversely, a wallet with minor behavioral flags but a fully transparent, auditable contract receives a more accurate risk assessment that prevents false positives on legitimate projects.

The 90.1% accuracy figure represents the combined performance of both layers together — it is the V3 ensemble model’s prediction power, not either layer in isolation. The algorithm remains under active development. We expect accuracy to continue improving as the training dataset expands and additional smart contract analysis patterns are incorporated.

RUG PULL DETECTOR V3

90.1% Prediction Accuracy — Free to Use

V3 combines behavioral analysis of contract creators with smart contract code inspection. Handles pools and individual tokens. No signup, no fee. For businesses, subscribe to the API. For AI agents, X402 micropayment protocol is enabled.

→ Try Rug Pull Detector V3 Free at chainaware.ai/rugpull

How the V3 Algorithm Works: Behavioral + Smart Contract Analysis

V3 runs two parallel analysis pipelines that produce independent risk scores, then combines them through an ensemble model trained on verified historical rug pull events. Both pipelines run in real time — the full analysis completes in under two seconds for any pool or token address submitted to the detector.

Pipeline 1: Creator Behavioral Analysis

The behavioral analysis pipeline examines the complete on-chain history of the wallet that deployed the contract. ChainAware’s 20M+ wallet persona database, trained across 8 blockchains, provides the foundation for this analysis. The pipeline evaluates multiple behavioral dimensions that collectively predict fraudulent intent:

• Deployment history: How many contracts has this wallet deployed? What is the historical fate of those contracts — did their pools maintain liquidity or were they rugged?
• Funding provenance: Where did the capital to seed liquidity originate? Wallets funded from known mixer outputs, fresh exchange withdrawals, or clusters of associated addresses receive elevated risk scores.
• Creator feeder analysis: Wallets that funded the deployer are also examined. A deployer wallet with a clean history but funded by a wallet with prior rug pull associations triggers a feeder-chain risk signal.
• Temporal patterns: How quickly after token deployment was liquidity removed in prior contracts from this wallet or associated wallets? Short hold periods are a strong predictor of rug pull intent.
• Wallet age and diversity: Fresh wallets with minimal on-chain history and a single purpose (token deployment and liquidity management) score significantly higher than wallets with years of diverse on-chain activity.

This behavioral layer is powered by the same predictive intelligence that drives ChainAware’s broader wallet analysis capabilities. For context on how the underlying wallet behavioral analysis works across other use cases, our guide to using the ChainAware Wallet Auditor covers the full 9-parameter profile in detail.

Pipeline 2: Smart Contract Analysis

The smart contract analysis pipeline inspects the deployed contract code directly. For verified contracts (where source code is published), the analysis performs AST (Abstract Syntax Tree) parsing — examining the structural logic of the contract to identify dangerous patterns. For unverified contracts, bytecode inspection is used to detect characteristic opcode sequences associated with honeypot restrictions and hidden mint functions.

The contract analysis examines specific risk patterns:

• Hidden transfer restrictions: Functions that block selling by non-owner addresses, often disguised within complex conditional logic that is not obvious from casual code review.
• Owner-privileged mint functions: Unrestricted mint capabilities controlled by the deployer allow infinite token supply expansion after retail investors have bought in.
• Ownership renouncement status: Contracts that have not renounced ownership retain the ability to modify transfer restrictions, fee structures, and other parameters after launch.
• Liquidity lock verification: Whether LP tokens are locked — and in what contract, with what unlock conditions — is a critical signal. Unlocked LP tokens in the deployer’s wallet represent immediate rug pull risk.
• Fee manipulation functions: Contracts with owner-callable functions to increase buy/sell taxes after launch can effectively trap investors by making selling economically unviable.

For additional context on how AI-powered smart contract analysis compares to traditional audit approaches, our guide to AI-powered blockchain analysis and machine learning for crypto security covers the broader landscape of ML-based fraud detection.

The Ensemble Model

Outputs from both pipelines feed into an ensemble model that produces a single composite risk score between 0 and 100. Scores above 75 trigger a high-risk warning. Scores between 50 and 75 generate a medium-risk flag with specific risk factors highlighted. Scores below 50 return a lower-risk assessment — though not a guarantee of legitimacy, since the algorithm continues to develop and some novel fraud patterns may not yet be captured.

The ensemble model is trained on a labeled dataset of confirmed rug pull events — including events from the 103,695 cases in our PancakeSwap V2 analysis — and updated continuously as new rug pull events are confirmed. This continuous retraining is what allows the algorithm to adapt to evolving fraud operator tactics rather than becoming outdated as the fraud industry develops new evasion methods.

Algorithm Verification and Accuracy Methodology

The 90.1% accuracy figure requires explanation of its methodology, because prediction accuracy claims in the crypto security space are frequently made without rigorous verification frameworks. ChainAware’s accuracy is measured against historical confirmed rug pull events using a held-out test set — contracts and pools that were not included in the training data but whose eventual rug pull status is now known.

Full verification methodology, including the test set composition, evaluation metrics, false positive and false negative rates by pool type, and comparison to V2 baseline performance, is published at chainaware.ai/resources/rugpull-verification .

Three important caveats about the 90.1% figure deserve explicit statement:

Caveat 1 — The algorithm is in active development. 90.1% is the current measured performance. We expect this number to improve. We also acknowledge that novel fraud patterns not yet present in our training data could temporarily reduce real-world performance below this benchmark.

Caveat 2 — False negatives exist. Roughly 9.9% of rug pull events will not be flagged by V3. These are concentrated in the most sophisticated fraud operations — those that maintain clean creator wallets and deploy contracts that pass automated inspection. Human review of tokenomics, social channels, and team identity remains important for high-value investment decisions.

Caveat 3 — False positives also exist. Some legitimate projects will receive elevated risk scores, particularly those deployed by newer wallets without extensive on-chain history or those using novel contract architectures that match patterns we associate with fraud. V3 is designed to flag risk, not to definitively declare fraud — the final investment decision always rests with the human investor.

For comparison with how other detection tools benchmark their accuracy, the broader context of the forensic versus AI-powered blockchain analysis framework explains why predictive accuracy figures differ fundamentally from forensic identification rates.

Who Uses Rug Pull Detector: Retail Investors, Businesses, and AI Agents

ChainAware’s Rug Pull Detector V3 serves three distinct user categories, each with different integration paths and use case requirements.

Retail Investors: Free Web Tool

Individual investors access the Rug Pull Detector at no cost through the web interface at chainaware.ai/rugpull. No account creation is required. Submit any pool address or token contract address on supported chains, and V3 returns a complete risk analysis within seconds. The tool handles both liquidity pool addresses (where additional LP-specific checks run) and regular token contract addresses.

For retail investors who want to go beyond rug pull risk and understand the complete behavioral profile of any wallet — including their own — the ChainAware Wallet Auditor provides a 9-parameter profile covering experience, risk willingness, intentions, AML status, and Wallet Rank. Both tools are free and require no signup.

DApps and Businesses: API Subscription

Businesses that need to check new pools or existing tokens at scale — DEX aggregators, portfolio trackers, launchpads, DeFi protocols — can subscribe to the Rug Pull Detector API. The API provides the same V3 analysis through a programmatic interface, enabling integration into existing DApp infrastructure without requiring users to manually submit addresses.

For DApps that want to screen wallet connections in real time — catching bad actors at the moment of wallet connection rather than at the moment of investment — the broader ChainAware suite integrates via Google Tag Manager pixel with zero code changes. See the complete Transaction Monitoring Agent guide for how automatic wallet screening works in a live DApp environment.

DApps that want to understand not just fraud risk but the full behavioral profile of their user base — their intentions, experience levels, and conversion likelihood — can combine the Rug Pull Detector API with ChainAware’s Web3 Behavioral User Analytics for a complete picture of who is using their platform and which users represent fraud risk versus conversion opportunity.

AI Agents: X402 Micropayment Protocol

AI agents operating autonomously in DeFi environments — executing trades, managing portfolios, or conducting due diligence on behalf of human principals — can access Rug Pull Detector V3 through the X402 micropayment protocol. This enables agents to pay per analysis in real time without requiring pre-approved API keys or subscription agreements.

An agent evaluating whether to provide liquidity to a new pool, or whether to purchase a newly launched token as part of a portfolio strategy, can query V3 and receive a risk assessment as part of its decision-making pipeline. This integration pattern — AI agents using on-chain behavioral intelligence to make better decisions — is the core use case that ChainAware’s MCP integration guide covers in detail. For the complete framework of how AI agents are replacing human functions in Web3, our guide to the Web3 agentic economy provides essential context.

WALLET AUDITOR

Audit Any Wallet Before Sending Funds

Before sending irreversible on-chain transactions, verify the receiving wallet. ChainAware Wallet Auditor delivers a complete 9-parameter behavioral profile — experience, risk, intentions, AML status — in seconds. Free, no signup.

→ Audit Any Wallet Free at chainaware.ai/audit

Projection: How Many Rug Pulls in the Next 20 Weeks?

Based on the 20-week dataset, what does the next 20-week period look like? This is not a rhetorical question. The data provides enough signal to make a structured projection.

The Baseline Projection

Averaging the 20 weeks of data gives a mean weekly rug pull extraction of approximately $28.5M (total $569.4M divided by 20 weeks). If the next 20 weeks perform at the historical mean, the projected extraction would be approximately $570M — virtually identical to the first 20-week period.

However, averages obscure the variance that makes this projection more nuanced. Week 17 produced just $12.6M. Week 4 produced $53.4M. The range is wide — and what drives the range matters for any forward projection.

Bull Market Scenario

If BNB and the broader crypto market experience a significant price rally in the next 20 weeks, retail capital inflows to PancakeSwap V2 will increase. More retail capital entering DEX pools means more capital available for extraction. In a bull market scenario, weekly extraction figures could return to the W3-W5 range ($38M–$53M per week), pushing the 20-week total toward $800M–$900M.

Bear Market Scenario

Sustained market decline reduces retail participation in speculative DeFi activity. The W16-W19 pattern — four consecutive low weeks averaging $15M — represents what a low-sentiment environment looks like. In a bear market scenario, the next 20-week total could fall to $250M–$350M.

The Conservative Certainty

Regardless of market direction, one conclusion is near-certain: rug pulls will continue to extract hundreds of millions of dollars from retail investors in the next 20 weeks. The fraud infrastructure exists, is profitable, and faces no meaningful deterrent. The floor established by the W17-W19 data ($12.6M–$15.1M per week) implies a minimum 20-week extraction of approximately $250M under the most pessimistic scenario.

The only variable the industry controls is how many investors check tokens and pools before buying — and how accurate those checks are. That is the market for Rug Pull Detector V3.

The Complete Protection Stack for DApps and Retail Investors

Rug pull detection is one layer of a complete Web3 fraud protection stack. Understanding where it sits relative to other security tools helps both retail investors and DApp teams build comprehensive protection rather than relying on any single tool.

For Retail Investors: The Three-Check Protocol

Before committing capital to any new token or pool, a thorough retail investor runs three checks. First, they use ChainAware’s Rug Pull Detector to assess the pool or token’s fraud risk — covering both creator behavior and contract analysis. Second, if the rug pull check flags concerns, they use the Fraud Detector to drill into the specific wallets associated with the token deployment. Third, before sending funds to any individual wallet address, they use the Wallet Auditor to assess the receiving address’s behavioral profile and AML status.

This three-check approach takes less than five minutes per investment decision and provides protection against the most common forms of DeFi fraud. It will not catch every sophisticated attack — nothing will — but it filters out the vast majority of the 103,695 rug pull events in our dataset, which are predominantly straightforward enough to be detected by V3’s behavioral and contract analysis.

For a complete understanding of the crypto security landscape and how different tools protect against different threat vectors, the guide to crypto wallet security in 2026 covers hardware wallets, behavioral intelligence, and fraud prevention in a single comprehensive framework.

For DApps: Pre-Connection Screening

DApps face a different version of the rug pull problem: they are not the ones buying potentially fraudulent tokens, but they are being used as distribution channels by users who may have funded their activity through fraud proceeds. A DApp that allows a rug pull operator to use its interface for withdrawals or swaps becomes part of the fraud infrastructure — and faces potential compliance exposure under FATF guidelines and MiCA regulations.

ChainAware’s DApp protection layer screens connecting wallets at the moment of wallet connection — before any transaction is submitted. Wallets associated with known rug pull contracts, flagged behavioral patterns, or AML-positive addresses are identified at the connection stage and can be blocked, flagged for review, or routed to restricted functionality automatically. The full architecture of this pre-connection screening is covered in our guide to Web3 fraud detection for DApps in 2026.

For DApps operating under MiCA requirements, ChainAware’s compliance layer provides 70–75% MiCA coverage at approximately 1% of the cost of traditional compliance solutions from Chainalysis or Elliptic. The complete comparison of DeFi compliance tools and costs is available in our DeFi compliance tools comparison for 2026.

The AML Layer: Complementary, Not Overlapping

AML screening and rug pull detection address different risk vectors. AML screening asks: is this wallet associated with known illicit activity — sanctions lists, mixer usage, dark web transactions? Rug pull detection asks: is this contract creator likely to extract liquidity before investors can exit?

These questions are complementary. A wallet can be AML-clean but behaviorally likely to rug — a fresh wallet with no prior illicit associations but a clear deployment pattern matching rug pull operators. Conversely, a wallet can trigger AML flags without being involved in rug pulls — a legitimate DeFi user who passed through a mixer for privacy reasons, for instance.

Running both checks provides the most comprehensive protection. For the complete technical architecture of AML and KYT compliance for DeFi, our guide to blockchain compliance, KYT, and AML for DeFi in 2026 covers the regulatory obligations and implementation options for protocols of all sizes. Additionally, for protocols evaluating predictive AI versus traditional rule-based approaches for compliance, our analysis of predictive AI for crypto KYC, AML, and transaction monitoring provides a direct comparison.

API FOR BUSINESS

Protect Your DApp and Your Users at Scale

Subscribe to the ChainAware Rug Pull Detector API to screen tokens and pools automatically as part of your platform’s risk infrastructure. Combine with Fraud Detector and AML Screener for complete DApp fraud protection. X402 enabled for AI agent integration.

→ Subscribe to the API at chainaware.ai/subscribe

PancakeSwap V2 Specifically: Why BNB Chain Is Ground Zero for Rug Pulls

PancakeSwap V2 on BNB Chain represents an ideal operational environment for rug pull schemes. Understanding why helps investors calibrate their risk exposure appropriately when interacting with BNB Chain DeFi specifically.

BNB Chain gas fees are among the lowest of any major EVM-compatible chain. Deploying a token contract, creating a PancakeSwap V2 pool, and seeding initial liquidity can cost less than $5 in total gas fees. This near-zero barrier to entry means that fraud operators can deploy hundreds of rug pull setups simultaneously at negligible marginal cost. A single successful extraction — even of a few thousand dollars — covers the cost of dozens of attempted schemes.

PancakeSwap V2 also benefits from extremely high organic retail traffic. Hundreds of thousands of retail investors use PancakeSwap V2 daily, creating a large pool of potential victims for each fraudulent token. The PancakeSwap interface itself presents tokens without any fraud risk warnings — it is a neutral trading interface, not a security layer. The responsibility for fraud detection falls entirely on the investor.

Token aggregators like DexTools and DexScreener surface newly created pools with real-time price charts, trading volume, and holder counts — all of which can be manipulated through bot trading and wash volume. A fresh pool with manufactured trading activity looks identical to a legitimate new project on these interfaces. Retail investors using aggregators as their primary research tool are working with data that fraud operators have specifically optimized to deceive.

CertiK’s 2025 security data placed BNB Chain consistently among the top chains for exit scam and rug pull activity, a position it has held across multiple annual reporting periods. The combination of low costs, high traffic, and minimal native protection makes BNB Chain the most active venue for the rug pull industry globally.

This is not a criticism of BNB Chain or PancakeSwap as infrastructure. Both are legitimate, high-quality platforms. The fraud problem is an emergent consequence of their success — high retail traffic and low costs that serve legitimate users equally serve fraudulent ones.

What the Rug Pull Industry Looks Like at Scale

$569M across 20 weeks. 103,695 individual events. These numbers only make sense at the scale of an organized industry, not at the scale of individual bad actors. Consider the operational requirements to produce this output.

At an average of 5,185 rug pull events per week, operators must be deploying thousands of token contracts weekly. Each contract requires wallet funding, deployment, pool creation, liquidity seeding, marketing (to attract retail buyers), and eventually liquidity removal. The automation required to manage this volume is sophisticated — these are not manual operations but scripted, bot-driven pipelines that handle the entire lifecycle with minimal human intervention.

The diversity of fraud values also tells a story. The same week that produced the maximum fraud value ($53.4M in W4) contained individual rug pulls ranging from a few hundred dollars to millions. This range reflects an ecosystem with multiple tiers: small-scale operators running low-value schemes alongside professional operations running high-value targeted campaigns. The industry has a hierarchy, with the most sophisticated operators at the top extracting the most per event while the smallest operators run volume plays at low margins.

Understanding rug pulls as an industry — not as isolated frauds — changes how we think about protection. Blacklists of known bad actors are largely ineffective against industrial-scale operations that create fresh wallets continuously. Reactive forensics — identifying fraud after it happens — provide no protection to the retail investors who lost money. Only predictive, behavioral approaches that identify fraud operators before they extract value offer meaningful protection at this scale.

This is the core thesis behind ChainAware’s approach. For context on how predictive AI compares to forensic analytics in practical terms, and why the shift from reactive to predictive is the fundamental security challenge facing Web3 in 2026, our comparison of forensic versus AI-powered blockchain analysis provides the complete framework.

The Role of Token Holder Quality in Identifying Rug Pull Risk

One additional signal that Rug Pull Detector V3 incorporates — particularly for tokens that have already launched and have a holder base — is token holder quality analysis. ChainAware’s Token Rank system assigns every token a rank based on the median Wallet Rank of its holders. Legitimate tokens with real communities tend to attract wallets with diverse, experienced behavioral profiles. Rug pull setups, which attract retail speculators and bots, produce distinctive holder quality signatures.

A token where the holder base consists predominantly of fresh wallets with no prior DeFi history, created in the days immediately preceding the token launch, is a warning sign that the holder base was manufactured rather than organically acquired. Bot-driven trading activity similarly produces holder clusters with synchronized creation dates and homogeneous transaction histories — patterns that stand out clearly in a holder quality analysis.

For investors conducting due diligence on tokens with existing holder bases, ChainAware’s Token Rank guide covers the complete methodology for assessing holder quality as part of investment due diligence. Combined with Rug Pull Detector V3’s contract and creator analysis, holder quality analysis provides a third independent signal layer — and convergent warnings across all three layers are among the strongest indicators of fraudulent intent available in the DeFi ecosystem today.

P2P Transactions: The Rug Pull Risk Outside DEX Pools

The $569M we measured operates entirely within the DEX pool context — tokens and liquidity pools on PancakeSwap V2. However, rug pull risk also exists in peer-to-peer payment contexts that do not involve DEX pools at all.

Approximately 50% of on-chain transaction volume consists of direct peer-to-peer transfers — one wallet sending assets directly to another, with no DApp interface in the flow. This volume includes legitimate payments, OTC trades, escrow arrangements, and investment contributions to projects that have not yet launched on a DEX. It also includes fraud: investors sending funds to project team wallets that subsequently disappear, or OTC trades where the receiving party does not fulfill their side of the arrangement.

For the 50% of transactions that happen wallet-to-wallet, the protection question is not “is this pool safe?” but “is this wallet safe?” ChainAware’s free Wallet Auditor addresses exactly this use case — providing a complete behavioral profile and fraud risk assessment for any wallet address before you send irreversible on-chain funds to it. The Wallet Auditor complete guide walks through every parameter the audit covers and how to interpret the results for P2P transaction due diligence.

COMPLETE PROTECTION SUITE

Rug Pull Detector + Fraud Detector + Wallet Auditor

All three tools are free to use at chainaware.ai. Cover pool risk, creator fraud risk, and P2P wallet risk in under five minutes per investment decision. Business API and AI agent X402 access available at chainaware.ai/subscribe.

→ Start at chainaware.ai — Free, No Signup

What Comes Next: ChainAware’s Rug Pull Research Roadmap

This dataset — 103,695 rug pulls and $569M in confirmed extraction — is the foundation of an ongoing research program. Publishing this data is the beginning, not the conclusion.

The next phases of ChainAware’s rug pull research and product development address several open questions that this initial dataset raises but does not answer.

Expanding to Complex Rug Pull Detection

As noted throughout this article, the $569M figure covers only basic liquidity extraction. Adding LP token transfer rug pulls, unlocked token sell-offs, and associated wallet extraction to the detection methodology will require additional algorithmic development — but the training data now exists in our confirmed dataset. V3.1 and subsequent versions will incrementally expand coverage to these more complex patterns.

Multi-Chain Expansion

This dataset covers PancakeSwap V2 on BNB Chain. ChainAware already operates across 8 blockchains — ETH, BNB, BASE, POLYGON, SOL, TON, TRON, and HAQQ. Expanding the rug pull dataset to include Ethereum DEXes (Uniswap V2/V3), Solana meme token launchpads, and BASE chain activity will produce a comprehensive multi-chain picture of rug pull extraction that does not currently exist anywhere in the industry.

Solana’s pump.fun — where an estimated 99% of tokens launched end in loss events for buyers — is a particularly important next target for this analysis framework. The structural characteristics of pump.fun token launches share significant overlap with PancakeSwap V2 rug pulls, but the technical analysis requires adaptation to Solana’s account-based architecture and SPL token standard.

Continuing Algorithm Improvement

The 90.1% accuracy of V3 is a milestone, not a ceiling. The algorithm team continues iterating on both the behavioral and smart contract analysis pipelines. Each confirmed rug pull event from our ongoing monitoring adds to the training dataset, and each fraud industry adaptation that our current model misses provides labeled false negative examples for the next training cycle.

The target is 95%+ prediction accuracy. Reaching that threshold requires solving the core challenge of sophisticated operator evasion — fraud operators who invest significantly in maintaining clean behavioral profiles and deploying contracts that pass automated inspection. ChainAware’s research team is actively working on graph-based analysis of funding networks and deployment clustering to address this remaining gap.

Rug Pull Red Flags: What to Look for Before Investing in Any New Token

While automated tools like V3 do the heavy lifting, investors who understand the underlying red flags make better decisions — both by interpreting V3’s output intelligently and by performing manual checks that complement automated analysis. The following red flags are drawn directly from our analysis of the 103,695 rug pull events in the dataset and from ChainAware’s behavioral research across 20M+ wallet profiles.

Red Flag 1: Unrenounced Contract Ownership

Contract ownership allows the deployer to call privileged functions — modifying transfer fees, adding transfer restrictions, minting additional supply, and pausing trading. A legitimate project with long-term intentions almost always renounces ownership or transfers it to a time-locked multisig. A contract where the deployer retains full ownership indefinitely is structurally set up for the owner to modify conditions after retail investors have bought in.

Checking ownership renouncement takes 30 seconds on BscScan or Etherscan — search the contract address, look for the “Contract” tab, and check whether owner() returns the zero address (renounced) or an active wallet address (retained). This single check eliminates a significant fraction of the most blatant rug pull setups.

Red Flag 2: Unlocked Liquidity Pool Tokens

When a creator seeds liquidity into a PancakeSwap V2 pool, they receive LP (Liquidity Provider) tokens representing their share of the pool. Legitimate projects lock these LP tokens in a time-lock contract — preventing liquidity removal for a defined period (commonly 6–24 months). Unlocked LP tokens held in the deployer’s wallet can be redeemed for the underlying liquidity at any moment, making rug pull execution a one-transaction event.

LP lock verification can be performed manually on platforms like Mudra or Team Finance, which maintain records of locked LP tokens on BNB Chain. The absence of a lock is not automatically fraudulent — some legitimate projects rely on other mechanisms — but it is a significant red flag that requires additional due diligence before committing capital. V3’s smart contract analysis flags unlocked LP positions automatically.

Red Flag 3: Fresh Deployer Wallet with No History

Professional rug pull operators often maintain separate deployer wallets for each scheme — fresh addresses with no prior on-chain history. This is a deliberate evasion tactic: behavioral analysis tools that look at deployer history return a clean result, because there is no history to analyze. V3 handles this by examining the funding source of the deployer wallet (where the ETH or BNB originated from), not just the deployer wallet itself. However, a fresh deployer wallet with no history should still independently raise an investor’s suspicion level, particularly when combined with other red flags.

Red Flag 4: Suspiciously High Maximum Transaction or Wallet Limits

Many rug pull contracts include maximum transaction size or maximum wallet balance limits that restrict how much any individual buyer can purchase. These limits are presented as anti-whale measures — preventing any single buyer from acquiring too large a share. In practice, they often serve a different purpose: ensuring that no single buyer has enough exposure to justify the gas cost of legal action, and ensuring that the token requires extended time to accumulate retail capital before the rug can be executed. Combined with gradual price increases driven by bot activity, these limits produce a slow accumulation of widely distributed retail capital that is then extracted in a single pull event.

Red Flag 5: Concentrated Token Allocation

Token distribution matters enormously. If the top 10 wallets hold more than 50% of the total supply, and those wallets are connected to the deployer or hold unlocked tokens, they represent a latent supply overhang that can be sold into any retail buying pressure. ChainAware’s Token Rank analysis reveals the quality and concentration of holder distribution for any token with an existing holder base — a concentrated, low-quality holder base is one of the strongest predictors of eventual rug pull or dump events. The complete methodology is explained in the Token Rank guide.

Red Flag 6: Anonymous Team With No Verifiable Presence

Full anonymity is the norm in crypto, not the exception — many legitimate projects have anonymous teams. However, the combination of full anonymity with the absence of any verifiable prior project history, a project launched in the previous week with no audit, and an aggressive social media presence focused entirely on price expectations is a signature pattern of rug pull operations. Legitimate anonymous projects typically have verifiable GitHub commit histories, prior community involvement in legitimate projects, and at minimum a third-party security audit. The absence of all three simultaneously is a meaningful red flag.

Red Flag 7: Extremely High Early Price Performance

A token that gains 500%–2,000% in its first 24–48 hours of trading is an appealing investment narrative. It is also the characteristic signature of a pump phase that precedes a rug pull. Organic price discovery — driven by genuine retail demand for a real product — produces growth curves that are steep but not parabolic. Parabolic early gains are typically produced by bot-driven wash trading that manufactures artificial volume and price momentum to attract FOMO-driven retail buyers. The parabolic chart is the marketing material for the rug. When the price is high enough to make liquidity removal maximally profitable, the rug executes.

How Rug Pull Operators Evade Detection: An Adversarial Analysis

Understanding how sophisticated fraud operators attempt to evade detection is as important as understanding the detection methods themselves. The 9.9% of rug pull events that V3 does not catch are concentrated in operations that specifically invest in evasion. Publishing this analysis serves retail investors by explaining what the highest-risk events look like, and serves the research community by documenting the evasion tactics that future algorithm versions must address.

Wallet Aging and History Manufacturing

The most sophisticated operators maintain aged deployer wallets — addresses that have months or years of legitimate-looking transaction history before being used for fraud. These wallets interact with legitimate DeFi protocols, make small token purchases across diverse projects, and accumulate behavioral signals that behavioral analysis models associate with legitimate users. When such a wallet eventually deploys a fraudulent contract, the behavioral layer returns a low-risk signal. Only the smart contract analysis layer can catch fraud from these operators — and only if the contract itself contains detectable risk patterns.

Countering this tactic requires tracking the clustering of aged wallets that share funding sources or that appear in coordinated deployment patterns — even when each individual wallet’s history appears clean. This graph-based analysis is part of ChainAware’s ongoing algorithm development roadmap.

Contract Code Obfuscation

Professional fraud operators increasingly deploy contracts with obfuscated code — transfer restrictions hidden within complex modifier chains, mint functions embedded in proxy contract architectures, and ownership retention disguised as multi-sig governance mechanisms that are controlled entirely by the deployer. These obfuscation patterns specifically target the limitations of automated smart contract analysis tools.

V3’s bytecode inspection — which operates on compiled contract code rather than requiring readable source code — provides partial protection against source code obfuscation. However, novel obfuscation patterns that have not yet appeared in the training dataset represent genuine blind spots. Regular model updates and the continuous addition of newly confirmed rug pull events to the training dataset are the primary mechanism for closing these gaps as they are discovered.

Delayed Execution

Some operators run long-duration schemes — maintaining active development activity, social media presence, and liquidity for weeks or months before executing the rug pull. These delayed execution schemes are specifically designed to outlast the attention spans of initial investors who may have checked V3 at launch and seen a clean result. By the time the rug executes, many initial investors have already forgotten the risk assessment they saw weeks ago and have added to their position based on the apparent ongoing legitimacy of the project.

Protecting against delayed execution requires ongoing monitoring rather than a single point-in-time check. ChainAware’s Transaction Monitoring Agent, which continuously rescreens connecting wallets on every DApp visit, provides this ongoing monitoring layer for DApps. For individual retail investors, re-running V3 checks periodically on held positions — particularly when planning to add to an existing position — is the equivalent individual protection behavior.

Legitimate-Looking Audits

A concerning development in the rug pull industry is the emergence of fraudulent security audits — certificates from obscure or non-existent “audit firms” that create the appearance of third-party verification without the substance. A token that displays an “audited” badge from an unrecognizable firm — or from a legitimate-sounding name that does not correspond to any established security company — provides no real protection against rug pull risk.

Legitimate audits from established firms like CertiK, Trail of Bits, Consensys Diligence, or OpenZeppelin are verifiable on the auditing firm’s own website and are associated with published audit reports. An audit badge that cannot be verified against the auditing firm’s own published report list should be treated as fabricated. V3’s smart contract analysis provides an independent assessment that does not rely on audit claims — it examines the code directly, regardless of what audit certificate the project displays.

The Market Infrastructure Gap: Why DeFi Needs Better Fraud Data

The $569M figure in this report exists not just as a fraud statistic but as a market infrastructure data point. DeFi cannot mature into a mainstream financial system while retail investors lose hundreds of millions of dollars per quarter to a fraud mechanism that could be largely prevented with better tooling and better data.

Traditional financial markets have infrastructure specifically designed to protect retail investors from comparable fraud: prospectus requirements, securities registration, market maker oversight, exchange listing standards, and regulatory enforcement. These mechanisms are not perfect — traditional markets have their own fraud problems — but they represent decades of accumulated institutional knowledge about how to structure market access to minimize retail harm.

DeFi has none of this infrastructure by design — permissionless access is a core feature, not a bug. The trade-off is that permissionless access enables both the extraordinary innovation of the DeFi ecosystem and the extraordinary fraud of the rug pull industry. Building protective infrastructure that preserves permissionlessness while reducing retail harm requires data-driven tools that operate at the protocol layer — not regulatory gatekeeping that would undermine DeFi’s fundamental architecture.

ChainAware’s approach — behavioral AI that flags risk without blocking access, tools that inform investor decisions without requiring permission from any central authority — represents one model for how this protective infrastructure can be built. Publishing the $569M dataset is part of the broader argument that this infrastructure is urgently needed and that the data to build it exists.

For DApp teams specifically, building fraud resistance into their platform architecture is becoming a competitive differentiator. Users who have been burned by rug pulls — and statistically, a significant fraction of active DeFi users have been — actively seek platforms with visible security measures. A DApp that visibly screens connecting wallets, displays behavioral security ratings for tokens listed on its interface, and provides transparent fraud risk data builds trust with the retail user base that DeFi needs to grow beyond its current audience.

The DeFi onboarding problem — why 90% of connected wallets never transact — is partly a product problem, partly a UX problem, and significantly a trust problem. Users who don’t trust that their capital is safe don’t commit capital. Solving fraud at the infrastructure level directly addresses the trust component of the conversion problem. For the complete analysis of why the 90% non-transacting wallet problem is DeFi’s most critical growth challenge, and how behavioral intelligence addresses it, see our comprehensive guide on DeFi onboarding and why connected wallets don’t transact.

Building that trust requires two things simultaneously: making fraud harder to execute and making fraud more visible when it does execute. V3 contributes to making fraud harder to execute — at 90.1% prediction accuracy, it prevents a significant fraction of rug pull investments before they happen. Publishing this dataset contributes to making fraud more visible — giving the industry, regulators, and researchers the empirical foundation to understand and respond to the true scale of the problem.

Together, these two contributions represent ChainAware’s core thesis: that Web3 grows faster and serves users better when behavioral intelligence is embedded into the infrastructure of every DApp interaction. The $569M figure is not just a warning — it is the business case for why predictive fraud detection is one of the most important infrastructure investments any Web3 platform can make in 2026. For the complete framework of how behavioral intelligence powers Web3 growth beyond security, the Web3 agentic economy guide covers the full stack from fraud prevention through personalized growth.

Frequently Asked Questions

What exactly is a rug pull?

In the context of this dataset, a rug pull is defined as a liquidity event where the contract creator of a token pool removes more liquidity than they originally added. A creator deposits funds (Mint event), retail investors buy the token and add value to the pool, and then the creator withdraws all liquidity (Burn event). The difference between what they removed and what they added — when removal exceeds addition — is the rug pull value. The token price drops to zero instantly upon liquidity removal, leaving holders with worthless assets. For a full comparison of rug pulls versus pump-and-dump schemes, see our dedicated guide on rug pull vs pump and dump.

How does ChainAware Rug Pull Detector V3 work?

V3 runs two parallel analysis pipelines. The first examines the behavioral history of the contract creator’s wallet — their deployment history, funding sources, prior rug pull associations, and wallet age. The second inspects the smart contract code itself for dangerous patterns: hidden transfer restrictions, uncapped mint functions, unrenounced ownership, and unlocked LP tokens. Both pipelines produce independent risk scores that are combined through an ensemble model trained on 103,695+ confirmed rug pull events. The combined model achieves 90.1% prediction accuracy on the held-out test set.

Is the Rug Pull Detector free?

Yes. The web interface at chainaware.ai/rugpull is completely free for retail investors, with no account creation required. Businesses that need API access for automated, high-volume token screening can subscribe to the API at chainaware.ai/subscribe. AI agents can access the tool through the X402 micropayment protocol, paying per analysis without requiring a subscription.

What is the difference between V2 and V3?

V2 relied exclusively on behavioral analysis of contract creator wallets, achieving approximately 68% prediction accuracy. V3 adds a full smart contract analysis layer — inspecting contract code for dangerous patterns regardless of the deployer wallet’s history. This combination closes the gap that sophisticated fraud operators exploited in V2 by maintaining clean deployer wallet histories. The combined V3 model achieves 90.1% prediction accuracy — a 32.5% relative improvement over V2.

Does V3 work on tokens that have not yet launched?

Yes. V3 can analyze any deployed smart contract — including contracts that have been deployed but have not yet attracted liquidity. Smart contract analysis runs regardless of whether there is an active trading pool. Creator behavioral analysis also runs at any point after contract deployment. For pre-launch tokens, smart contract analysis is particularly valuable because it does not require any trading history to return a risk assessment.

Can a rug pull still happen even if V3 gives a low risk score?

Yes. V3 achieves 90.1% accuracy, meaning approximately 9.9% of rug pull events will not be flagged. These false negatives are concentrated in the most sophisticated fraud operations — those that invest in maintaining clean deployer profiles and deploy contracts that pass automated inspection. No automated tool can guarantee 100% detection. V3 should be used as a risk filter, not as a guarantee, and combined with human judgment on tokenomics, team identity, and project fundamentals for high-value investment decisions.

Why does $569M in losses generate almost no media coverage?

Rug pull losses are distributed across hundreds of thousands of small transactions affecting individual retail investors, rather than concentrated in a single event affecting an institution. Distributed losses are structurally invisible to media coverage, which requires a single dramatic event with a named victim and a named perpetrator. The victims of rug pulls are anonymous retail investors with no media presence. The perpetrators are anonymous wallet operators with no attributable identity. The structural invisibility of rug pull losses is one of the primary reasons this form of fraud operates at scale without triggering the industry-wide response that dramatic exchange hacks generate.

What chains does ChainAware support for rug pull detection?

ChainAware currently supports 8 blockchains across its full product suite: Ethereum (ETH), BNB Smart Chain (BNB), Base (BASE), Polygon (POLYGON), Solana (SOL), TON, TRON, and HAQQ. Rug Pull Detector V3 is optimized for BNB Chain and Ethereum in its current version, with Solana and Base coverage expanding in upcoming releases. For the complete multi-chain capability overview, ChainAware’s complete product guide covers which tools are available on which chains.

How can AI agents use Rug Pull Detector V3?

AI agents access Rug Pull Detector V3 through ChainAware’s X402 micropayment protocol — paying per analysis in real time without requiring pre-approved API keys. Agents can also access the full suite of ChainAware tools through the Model Context Protocol (MCP) server at prediction.mcp.chainaware.ai/sse. The complete integration guide for AI agents is available at our Prediction MCP guide, and the GitHub repository at github.com/ChainAware/behavioral-prediction-mcp provides open-source agent definitions that any AI framework can deploy directly.

The post $569M+ in Rug Pulls on PancakeSwap V2 in 20 Weeks — Rug Pull Detector V3 Launched With 90.1% Accuracy first appeared on ChainAware.ai.

Rug pulls cost crypto investors approximately $3 billion every year. On PancakeSwap alone, 95% of new liquidity pools end in rug pulls in different versions. On Pump.fun, 99% of launched tokens extract money from buyers. ChainAware’s own analysis of PancakeSwap V2 across the first 20 weeks of 2026 confirmed 103,695 rug pull events extracting $569,388,384 from retail investors — approximately $28.5M per week, every week, with zero media coverage.

This 2026 guide compares the seven most important Web3 rug pull detection tools available today — including a full breakdown of the newly launched ChainAware Rug Pull Detector V3, which achieves 90.1% prediction accuracy by combining behavioral analysis with smart contract code inspection. Understanding what each tool covers — and where each leaves gaps — is the most important security decision any DeFi participant makes in 2026.

Why Most Rug Pull Detection Tools Fail Against Professional Operators

Before comparing individual tools, it is worth understanding why the majority of detection approaches share a fundamental blind spot. Six of the seven tools in this guide analyze smart contract code — scanning for hidden mint functions, unlocked liquidity, blacklist mechanisms, proxy upgrade patterns, and honeypot traps. This approach works well against amateur operators who copy-paste malicious code from known scam templates.

Professional rug pull operations, however, are far more sophisticated. They know exactly which code patterns trigger detection tools. Consequently, they deliberately write clean, well-structured Solidity code that passes every contract scanner check. Their malicious intent does not appear in the code at all. Instead, it lives in their behavioral history — the same wallet addresses have been behind previous rug pulls, have interacted with known fraud infrastructure, and have executed liquidity manipulation patterns across multiple earlier schemes. All of that history sits permanently on-chain, unchanged and verifiable. Yet code-based scanners never look at it.

ChainAware Rug Pull Detector V3 addresses both surfaces simultaneously — behavioral history of the people behind the contract AND the smart contract code itself. This dual-pipeline architecture is what drives V3’s 90.1% prediction accuracy, up from 68% in V2 which relied on behavioral analysis alone. For the complete dataset behind V3’s training and validation, see our $569M PancakeSwap V2 analysis. According to Immunefi’s annual security reports , exit scams and rug pulls consistently account for the largest share of total DeFi losses — and the majority involve operators who knew exactly how to evade detection.

The Two-Axis Framework for Understanding Detection Quality

Every rug pull detection approach falls somewhere on two axes: what data it analyzes (contract code vs. human behavioral history) and when it produces its signal (reactive after deployment vs. predictive before liquidity is drained). Code analysis is reactive by nature — it reads what is already deployed. Behavioral analysis is predictive — it identifies operators whose history makes future fraud probable, regardless of how clean their current code is. V3 is the only tool that operates across both axes simultaneously. For the complete technical analysis of these methodologies, see our Forensic vs AI-Powered Blockchain Analysis guide.

1. ChainAware.ai — Rug Pull Detector V3: Behavioral + Smart Contract Analysis

Core methodology: Dual-pipeline ensemble model — behavioral Trust Score analysis of contract creators and liquidity providers, combined with full smart contract code inspection via AST parsing and bytecode analysis.

ChainAware Rug Pull Detector V3 represents the most significant architecture upgrade in the detector’s history. V2 achieved approximately 68% prediction accuracy using behavioral analysis alone — examining the on-chain histories of contract creators and liquidity providers. V3 adds a complete smart contract analysis pipeline running in parallel, driving accuracy to 90.1%. The jump from 68% to 90.1% — a 32.5% relative improvement — closes the gap that sophisticated fraud operators had exploited by maintaining clean deployer wallet histories.

The key insight behind V3: behavioral analysis alone has a ceiling because experienced fraud operators invest in maintaining clean deployer identities — fresh wallets with legitimate-looking histories, funding through non-suspicious channels, and spaced deployment timing. These operators consistently fell into the 32% gap V2 could not close. Adding smart contract code inspection creates an independent second check that catches these operators even when their wallet history looks clean, because their fraudulent contracts still contain detectable risk patterns regardless of how their deployer wallet looks. For the complete V3 dataset and methodology, see our dedicated Rug Pull Detector V3 launch article with full PancakeSwap V2 data.

RUG PULL DETECTOR V3 — FREE

90.1% Prediction Accuracy — Behavioral + Smart Contract Analysis

The only tool that combines creator behavioral history with smart contract code inspection. Handles pools and individual tokens. No signup, no fee. For businesses, subscribe to the API. For AI agents, X402 protocol is enabled.

→ Try Rug Pull Detector V3 Free at chainaware.ai/rugpull

How V3 Works: The Two-Pipeline Architecture

V3 runs two completely independent analysis pipelines simultaneously. Each produces its own risk score. An ensemble model — trained on 103,695 confirmed rug pull events from PancakeSwap V2 — combines both scores into a single composite risk output between 0 and 100. This ensemble approach is what makes V3 robust against the evasion tactics that defeat single-method tools.

Pipeline 1: Creator Behavioral Analysis

The behavioral pipeline examines the complete on-chain history of the wallet that deployed the contract, plus the wallets that funded that deployer (the “feeder wallets”). ChainAware’s 20M+ wallet persona database, trained across 8 blockchains, provides the foundation. Five behavioral dimensions are evaluated:

• Deployment history: How many contracts has this wallet deployed, and what happened to their pools — did liquidity hold or get drained?
• Funding provenance: Where did the liquidity seed capital originate? Wallets funded from mixer outputs, fresh exchange withdrawals, or clusters of associated addresses receive elevated risk scores.
• Creator feeder analysis: The wallets that funded the deployer are independently scored. A deployer with a clean history but funded by a prior rug pull operator triggers a feeder-chain risk signal — this catches the “clean wallet, dirty money” pattern.
• Temporal patterns: How quickly were pools from this wallet or associated wallets drained after deployment? Short hold periods are the strongest behavioral predictor of rug pull intent.
• Wallet age and diversity: Fresh wallets created days before token deployment, with no prior DeFi activity beyond the deployment itself, score significantly higher than wallets with years of diverse on-chain history.

The behavioral pipeline is unchanged from V2 in its core logic but benefits from a larger, richer training dataset — the 103,695 confirmed events from the PancakeSwap V2 analysis added substantial new signal for the liquidity event timing and feeder wallet dimensions specifically.

Pipeline 2: Smart Contract Analysis

The smart contract pipeline inspects the deployed contract code directly — independently of who deployed it. For verified contracts with published source code, the analysis uses AST (Abstract Syntax Tree) parsing, examining the structural logic to identify dangerous function patterns. For unverified contracts where source code is not published, bytecode inspection detects characteristic opcode sequences associated with honeypot restrictions and hidden mint functions.

Five specific risk patterns are examined:

• Hidden transfer restrictions: Functions that block selling by non-owner addresses, often buried within complex conditional logic that does not appear dangerous in casual code review.
• Owner-privileged mint functions: Unrestricted mint capabilities controlled by the deployer allow unlimited token supply expansion after retail investors have bought in — diluting value to zero.
• Ownership renouncement status: Contracts that have not renounced ownership retain the ability to modify transfer restrictions, fee structures, and other critical parameters post-launch. Renounced ownership is a necessary but not sufficient condition for legitimacy.
• Liquidity lock verification: Whether LP tokens are locked, in what contract, and with what unlock conditions. Unlocked LP tokens in the deployer’s wallet represent immediate rug pull execution capability — one transaction away.
• Fee manipulation functions: Owner-callable functions to increase buy/sell taxes post-launch can make selling economically unviable, trapping investors while the creator exits.

This is what V3 adds that V2 did not have. A sophisticated operator who maintains a spotless deployer wallet but deploys a contract with hidden transfer restrictions now gets flagged by Pipeline 2 even when Pipeline 1 returns a clean signal. The combination closes the evasion gap. For a deeper technical comparison between contract-level and behavioral approaches in the broader blockchain security context, see our AI-Powered Blockchain Analysis guide.

The Ensemble Model: Composite Risk Score

Outputs from both pipelines feed into the ensemble model, which produces a single score from 0 to 100. Scores above 75 trigger a high-risk warning. Scores between 50 and 75 generate a medium-risk flag with specific contributing factors highlighted. Scores below 50 return a lower-risk assessment — though not a guarantee, since novel fraud patterns not yet in the training dataset may not be detected.

The ensemble model is continuously retrained as new confirmed rug pull events are added. This means V3’s accuracy improves over time rather than degrading as fraud operators develop new tactics. Full verification methodology — test set composition, false positive and false negative rates by pool type, and comparison to V2 baseline — is published at chainaware.ai/resources/rugpull-verification .

V3 Specs at a Glance

Accuracy: 90.1% (V2 was 68%)
Chains: ETH, BNB, BASE, POLYGON, SOL, TON, TRON, HAQQ (8 chains)
Handles: Liquidity pools (additional LP checks) and individual token contracts
Speed: Full dual-pipeline analysis under 2 seconds
Free tier: Yes — chainaware.ai/rugpull, no signup required
Business API: chainaware.ai/subscribe
AI agents: X402 micropayment protocol enabled
Training data: 103,695+ confirmed PancakeSwap V2 rug pull events, continuously updated
Limitation: ~9.9% of events will not be flagged — concentrated in operators who both maintain clean behavioral history AND deploy contracts that pass automated inspection. No tool is 100%.

The Data Behind V3: $569M on PancakeSwap V2

V3’s ensemble model was trained and validated on a dataset that ChainAware published in May 2026 — the first comprehensive rug pull measurement ever conducted on PancakeSwap V2. The numbers are stark:

This data represents the conservative floor — only the most basic rug pull pattern was measured (creator adds liquidity, then removes more than added). More sophisticated extraction methods (LP token transfers, unlocked token sell-offs, associated party extraction, honeypot contracts) were not included. The real total is higher. Every confirmed event in this dataset became a labeled training example for V3’s ensemble model, making it the most empirically grounded rug pull detection model in the industry. For the complete week-by-week breakdown and analysis, see our dedicated $569M PancakeSwap V2 rug pull report.

FRAUD DETECTOR

Check the Wallet Behind Any Contract — 98% Accuracy

ChainAware Fraud Detector analyzes the behavioral history of any wallet address — including contract creators and LP providers — to predict fraudulent intent. Use it as the second step after any contract scanner flags a concern.

→ Run a Free Fraud Check at chainaware.ai/fraud

2. GoPlus Security — Rules-Based API Infrastructure (30+ Chains)

Core methodology: Rules-based smart contract analysis — honeypot simulation, ownership flags, mint functions, blacklist/whitelist, tax parameters.

GoPlus Security is the dominant B2B security API in Web3. It powers the risk warnings on DEXScreener, is integrated into Sushi’s trading interface, and underlies security checks in dozens of wallets, explorers, and trading platforms. In Q4 2024 alone, GoPlus detected 67,241 honeypot tokens across Ethereum, Base, and BNB Chain. The platform covers over 30 blockchain networks and provides both a consumer-facing interface and a permissionless API that any developer can integrate without fees or approval.

What GoPlus Analyzes

GoPlus runs a comprehensive suite of contract-level checks: whether the token is sellable, whether the creator can mint unlimited new supply, whether blacklist or whitelist functions exist, whether the contract is open source, whether a proxy upgrade pattern is present, buy and sell tax rates, trading cooldown mechanisms, and LP lock status. These checks are fast, reliable, and cover the vast majority of amateur-level scam patterns. The API returns clear structured data that wallets and DEX aggregators can display to users in real time.

GoPlus is the right first-line tool for any token check. It does not, however, analyze the behavioral history of the people behind the contract — it does not know whether the deployer has a history of previous rug pulls on other tokens, and it does not inspect smart contract code with the depth of AST parsing or bytecode analysis that V3’s Pipeline 2 provides. For any asset trading on a major DEX, GoPlus provides reliable first-line protection. For new pools from unknown deployers, it is necessary but not sufficient.

Chains: 30+ EVM and non-EVM chains
Best for: First-line contract scanning; wallet and DEX integration via API; quick gut checks on any token
Free tier: Yes — free API and consumer interface
Limitation: Rules-based and static — cannot detect sophisticated operators with clean code; no behavioral history of creators

3. Token Sniffer — Pattern Matching and Clone Detection (EVM)

Core methodology: Automated code analysis with pattern matching, contract similarity detection against known scam templates, and honeypot simulation.

Token Sniffer is the most widely used free individual-user tool for EVM token risk assessment. Its core differentiator is contract similarity analysis — it maintains a database of known malicious contract patterns and scam templates and flags any new token whose code shares significant similarity with known fraudulent contracts. This catches the enormous volume of copy-paste scam operations that recycle the same malicious code structure across hundreds of new token deployments. Solidus Labs documented over 188,000 suspected scam tokens on Ethereum and BNB Chain in 2022 alone — the majority used recycled code that Token Sniffer can identify.

Token Sniffer produces a 0-100 risk score combining contract code analysis with swap simulation — testing whether an actual buy and sell transaction can be executed, which catches honeypot-style traps. It is particularly effective as a second-opinion tool to complement GoPlus results. The weakness is the mirror of its strength: it excels at catching copied code but cannot assess original code from operators who write from scratch, and it does not analyze creator behavioral history. For how pattern-matching approaches fit into a broader security framework, see our How to Identify Fake Crypto Tokens guide.

Chains: EVM chains (ETH, BNB, and others)
Best for: Catching copy-paste scams; second-opinion alongside GoPlus; screening high-volume new token launches
Free tier: Yes
Limitation: Cannot assess behavioral history; false positives on legitimate new tokens; no Solana support

WALLET AUDITOR

Audit Any Wallet in the Creator Chain — Free

After running GoPlus or Token Sniffer on a contract, paste the deployer wallet into ChainAware Wallet Auditor. Get a full 9-parameter behavioral profile — experience, risk, AML status, fraud probability — in seconds. The check that no code scanner provides.

→ Audit Any Wallet Free at chainaware.ai/audit

4. De.Fi Scanner — Multi-Asset Portfolio Security (10+ Chains)

Core methodology: Comprehensive contract analysis across tokens, NFTs, and liquidity pools with multi-chain portfolio risk aggregation and PDF reporting.

De.Fi Scanner — built by the team behind De.Fi (formerly DeFiYield) — positions itself as the “antivirus of blockchains” with the most ambitious scope of any tool in this comparison. Where GoPlus and Token Sniffer focus on individual token contracts, De.Fi Scanner extends its analysis to NFTs, liquidity positions, and entire portfolio exposures across 10+ networks simultaneously. This makes it particularly valuable for users managing complex multi-chain DeFi portfolios who need a unified risk picture rather than token-by-token checks.

De.Fi’s interface is notably more visual and information-dense than GoPlus’s API-first presentation — it displays social links, market cap, exchange rankings, and permission flags alongside risk scores. The platform’s ability to generate downloadable PDF audit reports is useful for institutional users and launchpad teams. Like GoPlus and Token Sniffer, De.Fi Scanner analyzes contract code rather than behavioral history, sharing the same fundamental limitation against professional operators with clean code.

Chains: 10+ (ETH, BNB, SOL, Polygon, Arbitrum, others)
Best for: Multi-chain portfolio risk management; institutional due diligence with PDF reports; combined token + NFT + LP risk assessment
Free tier: Yes
Limitation: Complex UI for quick checks; code analysis only; no behavioral creator history

5. RugCheck.xyz — Solana-Native Detection (Solana)

Core methodology: Solana-specific token analysis — liquidity locks, holder distribution, ownership concentration, insider network detection.

RugCheck.xyz holds a unique position as the dominant Solana-specific tool — widely referred to as “the Solana traffic light” by the memecoin community. For anyone active in Solana’s memecoin ecosystem or participating in early Pump.fun launches, RugCheck.xyz has become a standard part of the due diligence workflow. Its most distinctive feature is Insider Networks analysis — identifying suspicious relationships between major token holders, flagging cases where multiple large holders share characteristics suggesting coordinated insider buying. This targets a specific rug pull pattern common on Solana where a team seeds the holder distribution to appear decentralized while actually controlling the majority of supply. For broader context on Solana security challenges and the 99% Pump.fun scam rate, see our Rug Pull vs Pump and Dump guide.

Chains: Solana only
Best for: Solana memecoin research; Pump.fun launch screening; quick mobile-friendly Solana checks
Free tier: Yes
Limitation: Solana-only; no behavioral history; does not evaluate team background or off-chain conduct

6. Webacy — Predictive ML on Base (Base)

Core methodology: Supervised machine learning (GBDT, XGBoost, LightGBM) combining Solidity code forensics with on-chain holder analytics for predictive rug probability scoring.

Webacy stands out as the most technically ambitious approach among the code-analysis tools — and the closest in philosophy to ChainAware’s predictive methodology, though applied primarily to Base chain and incorporating contract code as a primary input. Webacy’s system combines two data streams: Solidity code-level features (hidden mint, risky primitives, upgradeability patterns) available immediately at deployment, and on-chain holder analytics (early sniper clustering, concentrated early ownership, bundled trading) that become available as the token begins trading. The model weights these through ML rather than fixed rules, giving it more flexibility to adapt to novel patterns than purely rules-based systems like GoPlus.

Webacy’s current limitation is scope: it focuses on Base chain. Users on ETH, BNB, or Solana do not benefit from this predictive layer. Additionally, it relies partially on contract code features — meaning sophisticated operators who write clean code and avoid sniper-detectable trading patterns can still partially evade detection. For how ML-based approaches differ from rules-based systems, see our AI-Powered Blockchain Analysis guide.

Chains: Base (primary, expanding)
Best for: Base chain token launches; early deployment risk scoring; ML-based analysis beyond fixed rules
Free tier: Yes
Limitation: Primarily Base-focused; still incorporates contract code features; less behavioral depth than creator-history analysis

7. QuillCheck by QuillAI — Real-Time Monitoring and Alerts (Multi-Chain)

Core methodology: 25+ smart contract and market condition parameters with 24/7 continuous monitoring, real-time Telegram and Twitter alerts when tokens turn into scams.

QuillCheck differentiates itself through continuous monitoring rather than point-in-time checks. Where most scanners return a risk assessment at the moment of query, QuillCheck monitors token contracts 24/7 and delivers automated alerts via Telegram and Twitter when a previously clean-scoring token subsequently changes behavior. This monitoring capability addresses one of the most insidious rug pull patterns: tokens that appear completely clean at launch but activate malicious functions after a waiting period once sufficient investor funds have accumulated — the “time-bomb” rug pull. QuillCheck’s API is specifically designed for launchpad and DEX integration, enabling platforms to screen every project submission automatically and continue monitoring listed tokens post-launch. For how transaction monitoring approaches apply to DApps beyond token screening, see our Transaction Monitoring Agent guide.

Chains: Multi-chain EVM
Best for: Real-time monitoring of holdings; launchpad automated screening; platforms needing post-launch surveillance
Free tier: Yes
Limitation: Contract code analysis only; alert timing vs. fast rug pulls; no behavioral creator history

API FOR BUSINESS

Screen Tokens and Pools Automatically at Scale

Subscribe to the ChainAware Rug Pull Detector API to screen tokens and pools as part of your platform’s risk infrastructure. Combine with Fraud Detector and AML Screener for complete DApp fraud protection. X402 enabled for AI agent integration.

→ Subscribe to the API at chainaware.ai/subscribe

Head-to-Head Comparison Table

Tool	Detection Method	V3 Accuracy	Catches Clean-Code Pros?	Chains	Monitoring?	Free	API
ChainAware V3	Behavioral history + Smart contract analysis (AST + bytecode)	90.1%	Yes — dual pipeline	8 chains	Transaction monitoring agent		MCP + REST + X402
GoPlus Security	Rules-based contract code	~70–75% (estimated)	No	30+ chains			Open API
Token Sniffer	Pattern matching + clone detection + honeypot sim	Good on clones	No	EVM			Limited
De.Fi Scanner	Multi-asset contract analysis + permission flags	Moderate	No	10+ chains
RugCheck.xyz	Liquidity locks + holder distribution + insider networks	Good on Solana	No	Solana only			Limited
Webacy	Predictive ML: code forensics + holder analytics	Improving	Partial	Base (primary)	Partial
QuillCheck	25+ contract parameters + continuous monitoring	Moderate	No	Multi-chain EVM	24/7 alerts		Launchpad-focused

Detection Method Comparison: What Each Approach Catches and Misses

Rug Pull Type	ChainAware V3	GoPlus	Token Sniffer	De.Fi	RugCheck	Webacy	QuillCheck
Honeypot (can’t sell)	Pipeline 2 (AST/bytecode) + Pipeline 1	Strong	Swap simulation
Unlocked liquidity drain	Pipeline 2 LP lock check + Pipeline 1 behavioral	LP lock check			Solana
Hidden mint / unlimited supply	Pipeline 2 mint function detection	Strong
Fee manipulation post-launch	Pipeline 2 detects fee manipulation functions	Partial	Partial	Partial	Partial	Partial	via monitoring
Copy-paste scam code	Pipeline 2		Strongest		Partial
Delayed activation (time-bomb)	Pipeline 1 operator history					Partial	24/7 monitoring
Professional clean-code operator	Pipeline 1 behavioral history — primary differentiator					Partial
Insider / coordinated supply	Pipeline 1 LP cluster analysis	Partial	Partial	Partial	Insider Networks	Sniper detection	Partial
New wallet, no history	Limited behavioral signal — Pipeline 2 still runs

Which Tool Should You Use — and When?

No single tool covers every rug pull type. Professional security practice in 2026 combines multiple tools to close the gaps each one leaves. Here is the practical framework:

For Individual Investors: The Three-Check Stack

Step 1 — Contract check (GoPlus or Token Sniffer): Run any new token through GoPlus for immediate contract-level flags. Token Sniffer adds clone detection as a second opinion. Together they catch the majority of amateur-level scams in 30 seconds.

Step 2 — V3 pool check (ChainAware Rug Pull Detector V3): Submit the pool address or token contract to V3. The dual-pipeline analysis returns a 0–100 composite risk score covering both the behavioral history of the deployer and a full smart contract code inspection. This is the only step that catches professional operators with clean code. It also catches the contract-level risks that GoPlus covers, providing a comprehensive second-opinion from both angles simultaneously.

Step 3 — Ongoing monitoring (QuillCheck alerts): For positions you hold for more than a few days, set up QuillCheck alerts on the contract. Post-launch behavioral changes — fee increases, LP removal preparation — appear before the actual rug pull. Early warning gives you an exit window. For Solana specifically, substitute RugCheck.xyz in Step 1. For multi-chain portfolio exposure, add De.Fi Scanner to your Step 1 workflow.

For DApps and Launchpads: API-Level Integration

DApps and launchpads need API-level automation. The recommended stack is GoPlus API for real-time contract-level screening, ChainAware V3 API for behavioral + smart contract risk scoring of addresses and pools interacting with your platform, and QuillCheck API for continuous post-listing monitoring with automated alerts. This combination covers all three temporal phases: before launch (V3 + GoPlus), at launch (V3 + GoPlus), and post-launch (QuillCheck).

For DApps that also need to screen the wallets connecting to their platform — not just tokens — ChainAware’s Transaction Monitoring Agent screens every connecting wallet at the moment of connection via Google Tag Manager pixel, with Telegram alerts and webhook automation for automatic blocking. No code changes required, active in 12 minutes. See our Transaction Monitoring Agent guide for the full integration walkthrough. For the regulatory compliance requirements that make transaction monitoring mandatory under MiCA, see our DeFi Compliance Tools comparison and our MiCA Compliance guide.

COMPLETE PROTECTION SUITE

Rug Pull Detector V3 + Fraud Detector + Wallet Auditor

All three tools free at chainaware.ai. Cover pool risk, creator behavioral risk, and P2P wallet risk in under five minutes per investment decision. Business API and AI agent X402 access available at chainaware.ai/subscribe.

→ Start at chainaware.ai — Free, No Signup

Frequently Asked Questions

What is the difference between ChainAware V2 and V3?

V2 relied exclusively on behavioral analysis of contract creator wallets, achieving approximately 68% prediction accuracy. V3 adds a full smart contract analysis layer — Pipeline 2 — running in parallel with behavioral analysis. This closes the gap that sophisticated fraud operators exploited in V2 by maintaining clean deployer histories while deploying fraudulent contracts. The combined V3 ensemble model achieves 90.1% prediction accuracy, a 32.5% relative improvement. The training dataset for V3’s ensemble model includes 103,695 confirmed rug pull events from PancakeSwap V2, measured across Weeks 1–20 of 2026.

Can any tool guarantee 100% rug pull detection?

No. V3 achieves 90.1% accuracy — approximately 9.9% of events will not be flagged. These false negatives are concentrated in operators who both maintain clean behavioral histories AND deploy contracts that pass automated inspection. No tool is 100%, and any tool claiming to be should be treated with skepticism. The practical goal is eliminating the categories of rug pull that are systematically preventable while continuously improving through retraining on new confirmed events. Full methodology and accuracy breakdown is published at chainaware.ai/resources/rugpull-verification.

Why do professional rug pulls pass contract scanners?

Professional operators know exactly which code patterns trigger GoPlus, Token Sniffer, and similar tools. They deliberately write clean Solidity code containing none of the flagged patterns. Their malicious intent exists only in their behavioral history — prior rug pulls, interactions with known fraud wallets, patterns of deploying and draining pools across multiple schemes. That history is permanently on-chain but contract scanners never look at it. V3’s Pipeline 1 reads exactly that history. V3’s Pipeline 2 then independently inspects the contract code, catching operators who write clean-looking code that still contains detectable dangerous function patterns when analyzed at the AST or bytecode level.

Which tool is best for Solana memecoins?

RugCheck.xyz is the community standard for Solana token screening — accessible, widely adopted, and with Insider Networks detection specifically relevant to coordinated supply manipulation common in Solana memecoins. ChainAware currently covers ETH, BNB, BASE, POLYGON, SOL, TON, TRON, and HAQQ across its full product suite, with Rug Pull Detector V3 optimized for BNB Chain and Ethereum in its current version. For now, the best Solana approach combines RugCheck.xyz with ChainAware’s Fraud Detector for manual creator wallet checks.

Should I use multiple tools simultaneously?

Yes — strongly recommended. Each tool catches a different category. GoPlus catches amateur code-based scams. Token Sniffer catches copy-paste operations. RugCheck catches Solana-specific patterns. ChainAware V3 catches sophisticated operators with its dual behavioral + smart contract pipeline. QuillCheck catches post-launch behavioral changes. Running V3 plus one code scanner plus QuillCheck for monitoring takes under five minutes and dramatically expands your protection coverage. If two independent tools flag different risks on the same contract, that disagreement alone is a signal worth investigating before committing funds.

How does ChainAware’s rug pull detection relate to its fraud detection?

The Fraud Detector evaluates individual wallet addresses — producing a fraud probability score for any address based on its transaction history. The Rug Pull Detector V3 applies that fraud probability analysis to the specific set of addresses involved in a liquidity pool — the contract creator, any upstream creators, and all liquidity providers — then combines that behavioral assessment with a full smart contract code inspection to produce a composite risk score for the pool as a whole. The rug pull detector uses fraud detection as a component within a broader dual-pipeline ensemble model. Both tools are free at chainaware.ai. For the complete product overview including how both tools fit the broader ChainAware stack, see our complete product guide.

Sources: Immunefi Web3 Security Research · Chainalysis Crypto Crime Report · FATF Virtual Assets Recommendations · GoPlus Security · ChainAware V3 Verification Methodology

The post Best Web3 Rug Pull Detection Tools in 2026 — Ranked & Compared first appeared on ChainAware.ai.