Meme coin scams: the 9 patterns and how each one shows up on chain

Most meme coin losses do not need a clever hack. They come from a short list of patterns that repeat on every chain, and almost every one of them leaves evidence on chain before or while it happens. This guide lists the nine patterns, what each one looks like in the wallets, and which check finds it. It describes patterns, not people: a coin can show one of these signals for an innocent reason, and the evidence never proves intent on its own.

Chainalysis put 2025 losses to rug pulls alone above $2.8 billion (as summarised by CoinLaw). Across the 410 coins Whodl has checked, the top 10 wallets hold a median of 20.6% of the supply, and on 8% of coins at least 15% of the supply sits in wallets that bought in the same block or transaction. Those two numbers are where most of the patterns below start.

1. The copycat ticker

What happens: a coin trends, and within hours other coins launch with the same name and ticker. Buyers who search the ticker on a DEX or click a reply link buy the copy.

On chain: a different contract address with the same symbol, usually younger, with less liquidity and a much smaller holder base.

The check: never buy by ticker. Get the contract from the project's own site or verified account and match every character. Whodl coin pages list other coins using the same ticker. How to find the real contract address.

2. The bundled launch

What happens: the deployer, or wallets working with them, buy a large part of the supply in the first block through many fresh wallets, so the holder list looks spread out.

On chain: many top wallets that bought in the same block or transaction, funded from the same source, often with no history before this coin.

The check: look at linked supply, not holder count. How much bundled supply is normal and what a bundled wallet is.

3. The honeypot

What happens: you can buy but cannot sell, or a sell loses most of its value to a tax.

On chain (Solana): an active freeze authority, or Token-2022 extensions such as a transfer hook, a permanent delegate or a transfer fee. Across coins Whodl checked, 0% still had an active freeze authority at the scan. On EVM chains: contract functions that block sells, blacklist wallets or set the sell tax.

The check: read the contract controls before buying. Whodl coin pages show mint and freeze authority under "Is it a scam? What the wallets show".

4. The pulled pool

What happens: whoever added the liquidity removes it, and holders are left with a coin that has nothing to sell into. This is the "rug pull" in its original sense.

On chain: a large liquidity withdrawal from the main pool, usually by the wallet that created it. On pump.fun the launchpad itself creates the PumpSwap pool when a coin graduates (Bitquery), so the deployer does not hold the pool the way they do on a hand-made one; there the larger risk is holders selling into it.

The check: who controls the LP tokens, and is the pool deep relative to what the top holders own. How much liquidity is enough.

5. The slow sell (soft rug)

What happens: the dev or a linked group sells steadily into every bounce instead of all at once.

On chain: repeated sells or transfers out from the deployer and wallets it funded; on pump.fun, regular creator-fee claims sent onward. Dev fee claims explained and dev sold vs dev holds.

The check: the dev record and the linked wallets' recent balance changes. A deployer with many earlier coins that faded is a fact worth weighing: has this dev launched coins before?.

6. The coordinated pump and dump

What happens: a group buys early, an account with a large following posts about the coin, buyers arrive, and the early group sells into them.

On chain: early wallets with shared funding, a price spike around a post, and the same early wallets selling within hours. Did a KOL call move the price?.

7. Fake volume

What happens: bots trade the coin with themselves so it ranks on trending lists.

On chain: high volume with flat holder growth, the same few wallets on both sides, and many small round trades. Holder count vs holder quality shows why a big holder count can mean little.

8. The drainer airdrop or claim site

What happens: a site or a token in your wallet invites you to "claim" an airdrop. Signing the transaction gives the site control over your tokens. Even an official site can be turned into one: on March 12, 2026 the bonk.fun domain was compromised and showed a fake terms-of-service message that drained wallets that signed it (The Block).

On chain: a transaction or approval you signed that transfers or delegates your tokens, followed by outgoing transfers you did not make.

The check: real coins almost never need you to visit a claim page. Read what a transaction does before you sign it.

9. The recovery offer

What happens: after a loss, someone offers to "recover" your funds for an upfront fee. This is a known follow-on fraud. The US FTC says: "Don't trust calls, letters, emails, texts, or messages on social media from someone who says they can recover money you lost in a scam for a fee" (FTC).

Check a coin in order

1. Exact contract, from the project's own source.
2. Contract controls: mint, freeze, extensions or sell restrictions.
3. Concentration: what the top 10 hold, with pools and exchanges left out.
4. Linked supply: same-block buys and shared funding.
5. The dev record and what the dev wallet has done since launch.
6. Liquidity against what the top holders could sell.

Every Whodl coin page runs these checks and shows the measured value next to each one, or says it was not measured. The step-by-step version is in Is this meme coin a scam? How to check the evidence. Every guide on the subject is collected under meme coin scams.