Two failures that look identical from the outside and are completely different in the code. One traps you at the moment of purchase. The other lets you trade freely right up until the liquidity vanishes. Here is what each looks like inside a contract and how to check both in about a minute. Part of Know the Scam by SimpleSwap.

The scale here is easy to underestimate. In January 2026, Dune data showed that ​​Solana launchpads alone created more than 25,000 tokens a day for five consecutive days, with Pump.fun accounting for roughly 70% of them. That is one ecosystem on one chain.

Deploying a token costs almost nothing and requires no permission, which is the point of the technology and also the reason this category exists at all.

Two of the ways it goes wrong are used interchangeably in conversation, and they should not be.

A honeypot is a trap in the code. You buy; the transaction succeeds; then your sell reverts. The restriction was written into the contract before you ever arrived.

A rug pull is a timing trap. The contract may be perfectly ordinary. You can buy and sell normally. Then the people holding the liquidity remove it, or dump their supply into your bids, and the token becomes unsellable because nothing is left on the other side.

The first is a locked door. The second is a room that gets emptied while you are standing in it.

What the trap looks like in the code

Honeypot contracts do not need clever cryptography. They need a conditional in the transfer function.

Sell reverts. The _transfer logic checks whether the destination is the liquidity pair, which is what selling looks like on-chain, and reverts if it is. Buys pass. Sells fail with a generic error, which most people read as a slippage problem and retry with higher slippage.

Blacklists and whitelists. Rather than blocking everyone, the contract keeps a list. Ordinary buyers are added to it after purchase. A handful of addresses never are. This is the variant that fools careful people because the chart shows real sales.

Modifiable tax. The contract exposes an owner-only function such as setFee. Tax is 3% while people accumulate, and becomes 99% the moment the owner decides. Technically you can still sell. You will receive almost nothing.

Mint rights. If the owner can call mint, supply is not fixed regardless of what the tokenomics image said. Your share can be diluted to nothing without a single sell.

Pause functions. A trading toggle that halts all transfers, held by one address.

Proxy contracts. The most underrated. An upgradeable proxy routes calls to a separate logic contract that the deployer can replace. The code you audited on Monday is not necessarily the code executing on Friday. Any check you perform on a proxy has a shelf life.

Why does the chart lie

This is the part worth internalizing because it defeats the most common instinct.

The standard reassurance is to look at the trading activity: price rising, volume real, and sells visible on the chart. In a whitelist honeypot, all of that is true, and none of it protects you. The wallets exiting are the ones the contract permits to exit.

The one-minute check

None of this requires reading Solidity. Four steps, in order, using free tools.

1. Run two scanners against the contract address. GoPlus returns a structured report covering honeypot detection, modifiable tax, hidden owner, mint, and blacklist functions. It powers the risk warnings inside many wallets and explorers. Token Sniffer scores the token and matches its bytecode against a database of known scam templates, which catches the large share of these that are copy-paste jobs. A low score usually means the codebase is structurally identical to previous rugs.

Use two, because they disagree with each other, and disagreement is information.

2. Simulate a sell. Honeypot.is and similar tools execute a simulated buy and sell against the contract and report what actually happens, including the real buy and sell tax rather than the advertised one. This is the single most direct test available, because it asks the contract the only question that matters.

3. Check whether liquidity is locked, and for how long. If LP tokens sit in the deployer's wallet, the liquidity can be withdrawn at any moment and the exercise is over. Look for a lock with a reputable locker such as Unicrypt or Team Finance, verify the lock transaction itself rather than a claim on a website, and note the expiry date. A lock expiring next week is not a lock.

4. Look at holder concentration. Bubblemaps and the explorer's holder tab show whether supply is spread or clustered. If a small group of wallets, especially connected ones, holds a large share, the exit risk is theirs to trigger and yours to absorb.

Then, if all four pass, do a minimal test buy followed immediately by a test sell. Not a small buy. A buy and then a sell. The purchase proves nothing. Only the exit does.

What "low risk" actually means

Two honest limits on all of the above, because a checklist that oversells itself is its own hazard.

A green result from a scanner means no known traps were detected, not that the token is safe. New trap patterns appear before detection rules do, and automated analysis is pattern matching, not comprehension.

And a red flag is not always fraud. Some legitimate launches retain ownership early in order to fix problems, or run temporarily higher taxes. The difference is whether the team is identifiable and whether those powers are time-locked. Unrenounced ownership plus an anonymous team plus unlocked liquidity is not three yellow flags. It is one red one, three times.

Scale gives a sense of the odds. In the fourth quarter of 2024, GoPlus analysts flagged roughly 67,000 suspicious tokens across Ethereum, BNB Chain and Base, a category covering rug pulls, honeypots and other risky contracts rather than honeypots alone. Base by itself accounted for around 54,000 of them. Token Sniffer, for its part, self-reports flagging 6.08 million of the 47.9 million tokens it indexes across fifteen chains, which is a vendor figure rather than an audited one and is best read as an order of magnitude.

Loss estimates deserve more caution than they usually get. Figures for annual rug pull losses range from several hundred million to several billion dollars depending on methodology, because some counts measure funds provably stolen while others include any token whose liquidity collapsed, which sweeps in ordinary project failure alongside deliberate fraud. Both get reported under the same heading. The direction is not in doubt. The precision is.

Where this meets your swap

A swap service can move you into a token. It cannot move you out of one that will not let you leave.

That asymmetry is worth stating plainly, because it is the practical reason this crypto scam belongs in a series about swaps. If a token's contract blocks your sell, no exchange, aggregator, or DEX can execute it, and the failure will appear to be a routing problem rather than what it is. There is nothing on our side or anyone else's to fix, because the transaction is being refused by the token itself.

Which is also why established listings behave differently from brand-new contracts. An asset that has traded across many venues for a long period has been through a filter, imperfect but real. A contract deployed yesterday has been through none, and the only thing standing between you and its author is the check you run before buying.

Our only official domain is simpleswap.io.

What comes next

Each entry above gets its own breakdown in "Know the Scam by SimpleSwap." Next up: rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.

This article is for educational purposes only and is not financial or investment advice. Tools named here are examples rather than endorsements, and none of them replaces your own judgement. SimpleSwap's only official domain is simpleswap.io.