Rug Pull

Developers launch a lending or liquidity protocol, attract deposits, then drain the treasury and disappear. That's a rug pull. The name comes from the image of yanking a rug out from under someone — one moment you have footing, the next you're on the floor with empty pockets.

For anyone depositing funds into a DeFi lending pool, this isn't an abstract threat. Your capital is only as safe as the code holding it — and the people who wrote that code.

How It Works

Most rug pulls follow a predictable script. Developers deploy a smart contract, advertise eye-catching yields — sometimes 200% APY or higher — and let deposits accumulate. Once TVL (total value locked, the sum of all deposited funds) reaches a target, they trigger a hidden backdoor function and transfer everything to their own wallets.

The backdoor is usually baked in at launch. It might be an admin key with unlimited withdrawal rights, a minting function that lets developers create infinite tokens and dump them, or a liquidity pool where developers hold 90% of the LP tokens and can drain the pool in a single transaction.

Speed is the weapon. A smart contract can execute a full drain in seconds. By the time on-chain alerts fire and users notice the token price collapsing, the funds are already moving through a mixer. There's no dispute resolution, no fraud department, no chargeback.

Why It Matters

Rug pulls hit lending protocols especially hard because depositors aren't trading — they're trying to earn yield safely. A borrower who posted collateral loses that collateral. A lender who deposited stablecoins loses the principal. The loss is total and usually unrecoverable.

What to Watch

The most dangerous rug pulls look legitimate on the surface. A slick UI, a white paper, even a partial audit — none of that guarantees safety if the audit didn't cover admin key privileges or token minting functions. Anonymous teams aren't automatically fraudulent, but an anonymous team with unaudited admin controls is a serious red flag.

Three things worth checking before depositing: whether the smart contract has been audited by a reputable firm (and whether the audit specifically reviewed admin functions), whether liquidity is locked or time-locked so developers can't drain it instantly, and whether the TVL history shows sudden large inflows — that pattern sometimes signals a coordinated pump before an exit.