Anatomy of a rug pull

Solana’s meme coin ecosystem is a live-fire environment. Every day, thousands of tokens are minted on platforms like Pump.fun or LetsBonk. Rug pulls on Solana are the fastest way to lose funds in the crypto trenches: a series of amazing wins can be immediately erased by a single -99% loss, even wiping your entire wallet. Rug pulls are not rare events: they are the baseline. Flintr data shows that more than 90% of meme coin launches end in a zero-liquidity collapse, with hundreds of millions siphoned from buyers who thought they were early. The classic rug pull chart – a sharp pump on launch, followed by a vertical crash – has become so routine that it’s now the default pattern, not the exception.

If you’re trading new Solana tokens, you are operating in adversarial territory where the majority of launches are designed to fail you. Mechanics are simple but devastating in effect. The creator mints a new token, seeds a minimal liquidity pool, and hypes the launch, often with coordinated “bundled” buys to simulate demand. As soon as outside buyers pile in, the creator dumps their tokens or withdraws liquidity, collapsing the price to zero. The result: instant exit liquidity for the scammer, total loss for everyone else.

This article breaks down the anatomy of a Solana rug pull with tactical precision. We’ll map out the real-world flow of these scams, quantify their prevalence using platform-level data, and dissect some on-chain fingerprints that separate a genuine launch from a premeditated trap. You’ll see why relying on manual explorer checks or lagging DEX dashboards leaves traders exposed, and how structured, automation-ready pipelines like Flintr’s real-time feed allow you filter out scams before your capital is even at risk.

Rug pulls on Solana follow a tight, repeatable script. A developer spins up a new token, often on platforms like Pump.fun or Pump Swap, then seeds a minimal liquidity pool to create the illusion of a fair launch. The next move is classic: the creator (or a cluster of their wallets) executes a series of bundled buys, rapidly inflating the token’s price and volume. This “pump” phase is engineered to bait snipers and retail traders into chasing the chart. But the setup is rigged. The developer quietly retains mint or freeze authority, or splits the token supply across a web of interconnected wallets, masking true ownership concentration. Once exit liquidity builds, the creator dumps their stack or yanks the liquidity pool, collapsing the price in seconds. The aftermath is predictable: late buyers are left with illiquid, worthless tokens, while the scammer exits with the spoils.

On-chain, these events are brutally fast. A typical rug pull plays out in under five minutes, often before most traders can even load a block explorer or verify contract flags. The mechanics are visible in Flintr’s real-time logs: the same wallet mints, bundles, and exits, sometimes hundreds of times per day. For example, our data shows that over 95% of Pump Swap tokens are minted using the same default creator account “111111111111111” without ever going through pump.fun. The scale is industrial: millions of tokens launched, but only a fraction ever reach meaningful liquidity, survive past the first hour, or had any future in the first place.

The impact isn’t just measured in lost capital. These exploits erode trust in Solana’s memecoin ecosystem, driving away serious builders and reinforcing a high-risk, adversarial trading culture. Every rug pull compounds the “degen” reputation, making it harder for legitimate projects to gain traction. For traders and bot builders, the lesson is clear: understanding the anatomy of a rug isn’t optional: it’s essential to survival on Solana.

We randomly selected and analyzed 500 rug pulls on Pump Swap:

This chart shows how meme token prices (indexed at 1 at time of creation) behave over time after launch, tracked over the first 100 price points. Q1–Q3 represent the typical range of token value decay, with the Median showing the most common path. Survival% tracks the percentage of tokens still alive (not rugged) at each point in time: a steep drops indicate mass rug pulls. The learning is obvious: within the first minutes, the value has dropped to 0, leaving you to hold all the bags.

Rug pulls are not rare events: they are the baseline reality for Solana meme token launches. Our own logs from Pump.fun and Pump Swap reinforce the point:

• Over 95% of new tokens are spun up by the same mass-generated burner wallet (111111111111111), a clear sign of automated scam farming at scale. See Chart A below.
• The concentration of scams is even more pronounced when you analyze wallet activity. A limited set of wallets, often operating in clusters, account for the vast majority of new token launches. See Chart B below.

1% of creators have generated 50% of all token launches
25 signers account for 25% of all token launches

On-chain, many meme tokens appear to be launched by different creators, but the same signer wallets are routinely used to rotate through dozens of creator addresses, each spinning up new tokens in quick succession. These creator clusters are not random; they are systematically recycling the same playbook, exploiting the speed and anonymity of Solana’s ecosystem. In some cases, multiple signer groups even share the same creators, suggesting a single, larger network operating behind the scenes. Flintr flags these patterns in real time, so you’re not trading into a trap disguised as a fresh dev.

Chart A

Chart B

The odds of finding a legitimate token with staying power are vanishingly small. Out of millions of Pump.fun launches, less a fraction ever sustain more than $1,000 in liquidity after the initial pump. The rest evaporate, leaving late buyers with bags of worthless tokens. The data is consistent across platforms and timeframes.

This isn’t about missing a few red flags or failing to do due diligence. The statistical base rate is so skewed that any random entry is overwhelmingly likely to be a trap. Manual review or gut feel is not enough. The only way to survive is to treat every launch as adversarial by default, and to deploy systematic, automated filtering at the point of entry. Flintr’s data makes this clear: the vast majority of tokens are engineered for exit liquidity, not for trading opportunity.

Spotting a rug pull before it happens requires more than intuition. The key is to interrogate the token’s on-chain metadata in real time. Flintr’s feed exposes these in seconds, letting you cut through noise and spot scams before they mature. Some outstanding vectors are authority keys, holder distribution, liquidity status, creator/signer data and creator bundling.

Authority Keys: If the creator retains the mint or freeze authority, they can mint unlimited new tokens or freeze trading at will. Flintr’s feed exposes these fields directly—any token where `mintAuthority` or `freezeAuthority` is not null is an immediate red flag. Flintr’s JSON payloads highlight these fields up front, making it trivial to filter out tokens with lingering creator control.

Holder Distribution: Rug pulls often disguise ownership by splitting tokens across a web of wallets. If the top holders are all linked or if a single entity controls most of the supply, the risk is high. Flintr’s `holderDistribution` field shows the concentration in real time. In practice, we see scams where the developer splits tokens across dozens of wallets, none holding more than 1 percent, but all controlled by the same actor. Bubble map analysis can reveal these clusters, but Flintr’s direct distribution metrics let you filter instantly.

Liquidity Status: Scammers often claim to have “burned” or “locked” liquidity, but in reality, only a small portion is secured. If LP tokens remain in the creator’s wallet, they can drain the pool at any time. Flintr’s `lockedLP` and `vaultCreatorAuthority` fields make this transparent. If any LP tokens are still under the creator’s control, the risk is immediate.

Bundling and Pump Trades: Coordinated buys at launch—especially via DEX bundle mechanisms—are a hallmark of rug pulls. Flintr’s `isBundled` and `bundleAmount` fields flag these events. A sudden spike in buys from a single entity is a classic setup for a pump-and-dump.

Most traders still rely on block explorers, Discord alerts, or rug-checker widgets to spot scams. In practice, these methods are slow, fragmented, and often miss the window where action matters. By the time you’ve cross-referenced multiple sources, such as RugCheck or DEXScrenner, the rug is usually already pulled. The price chart is a vertical drop, and anyone relying on these tools is left holding worthless tokens.

Manual checks are a bottleneck. Explorer queries require you to copy addresses, load pages, and interpret contract data – steps that add up to tens of seconds per token. Discord signal groups and Telegram bots are even slower, with alerts delayed by minutes. Human-driven “bundle watch” is error-prone: you can’t reliably spot coordinated buys or wallet clusters in real time without automation. Even with tools like Solscan, you’re only seeing a snapshot, not a live feed of authority changes or liquidity moves.

Fragmented data is another killer. Rugcheck widgets might flag a missing mint burn, but they don’t show wallet concentration or bundled buys. DEXscreener can confirm if liquidity is locked, but rarely in the first seconds after launch. None of these tools combine all the critical fields in a single, actionable view. The result: traders get partial signals, react late, and become exit liquidity.

Event-driven, sub-second feeds like Flintr’s WebSocket change the game. Every new token event streams with all relevant metadata—authorities, holders, liquidity, and more—ready for bots to filter before any capital is committed. This isn’t about being first for the sake of speed; it’s about having the complete picture at the only moment it matters. Automated scripts can skip 90 percent of textbook rugs by filtering on authority, creator/signer and holder fields alone. Manual workflows can’t keep up, and naive approaches miss the patterns that matter.

Surviving Pump.fun isn’t about intuition or gut checks. It’s about treating every new token as adversarial by default. The old model—manual checks, Discord alerts, and scattered DEX dashboards—simply can’t keep up with the pace or sophistication of modern rug pulls. The new execution model is simple: automate every critical filter before a token ever hits your buy logic. That means hard-coding rules to reject any mint with unburned authorities, outsized holder concentration, or creator-driven bundle trades. If a token fails any of these, it never makes it to your trading queue.

Flintr’s WebSocket feed makes this shift practical. Each new token event arrives as structured JSON ready to be interpreted by your logic. Instead of parsing Solscan or waiting for RugCheck, you enforce skip logic in your bot before the first real trade. For example, a token with a non-null `freezeAuthority` is instantly dropped. If the top five holders control more than 90 percent of supply, it’s out. If the creator wallet is tied to a bundle spike, you move on.

Moving from theory to execution, Flintr gives developers a direct line to actionable rug-pull detection. The process is simple: connect to the WebSocket, receive structured JSON for every new token, and apply deterministic filters before any trade logic fires. Every relevant arrives with the signal, so there’s no need to scrape block explorers or wait for slow indexers. A typical Flintr integration takes under ten lines of Python. You subscribe to the feed, parse each incoming token, and immediately check for the most common rug flags. Here’s a minimal Python example that captures the core logic:

import websocket, json

def on_message(ws, message):
    sig = json.loads(message)
    data = sig.get("data", {})
    token = data.get("tokenData", {})
    holders = token.get("holderDistribution", {}) // for Pump Swap
    freeze = token.get("freezeAuthority")
    mint = token.get("mintAuthority")
    bundle = token.get("isBundled") // for Pump.fun

    # Concentration: sum top 5 holders
    top5 = sum([v["amount"] for k, v in list(holders.items())[:5]])
    total = sum([v["amount"] for v in holders.values()])

    if freeze or mint:
        return  # skip: authority not renounced
    if total and top5 / total > 0.9:
        return  # skip: too concentrated
    if bundle:
        print("Bundled launch detected")

    print(f"Token passed filters: {data.get('metaData', {}).get('name')}")

ws = websocket.WebSocketApp("wss://api-v1.flintr.io/sub?token=YOUR_API_KEY", on_message=on_message)
ws.run_forever()

Every key field is labeled and processed in real time. This approach lets you review only the tokens that pass strict rug filters, minimizing exposure and maximizing throughput. For advanced strategies, the same feed supports deeper logic—historical wallet risk, liquidity quoting, or custom scoring. The bottom line: Flintr’s real-time data lets you automate rug detection at the point of launch, not after the fact.

Rug pulls are not random blows—they are engineered traps that now define the Solana meme token environment. The numbers are clear: nearly every new token on Pump.fun or Pump Swap is either a short-lived pump or a full-blown rug. Manual reviews, Discord alerts, and after-the-fact checks are not just slow—they are structurally outmatched. The typical rug is scripted to exploit every second of trader hesitation, using bundled buys, split wallets, and hidden authority keys to mask intent until the exit is already underway

The only way to consistently sidestep these traps is to shift from reactive, hope-based filtering to systematic, automation-friendly detection. This means building your stack around structured, block-0 data delivered before the first major price move. In practice, this lets you filter out 90 percent of the worst scams before you even consider a buy. Flintr’s real-time feed is not a magic bullet, but it is the fastest way to surface the core risk signals that matter.

The mindset shift is simple but non-negotiable: treat every new Solana meme coin as adversarial until proven otherwise. Bots and traders who rely on manual checks or scattered dashboards are consistently late to the real move. The edge is in integrating high-signal, low-latency data into your automation pipeline—so you can cut latency tax, filter exit scams, and focus your capital on tokens with a real shot at survival. This is not about chasing the next pump or hoping for luck. It’s about building a repeatable, data-driven process that treats every new token as a threat until proven otherwise. Authority checks, holder analysis, and liquidity verification are not optional—they are the minimum standard for survival. Flintr provides the infrastructure; you bring the strategy.

Ready to get off the rug-pull treadmill? Plug in to Flintr’s WebSocket feed, automate your front-line, and never be late to the only signal that matters. See the full Flintr documentation to fast-track your first bot and put speed, and survival, back on your side.

Whether you’re coding your own sniper or running third-party tools, you need to know what real rug data looks like, and which metrics catch the worst offenders. This isn’t about chasing every green candle: it’s about upgrading your risk filter so you’re never the last one holding the bag. Move first, but move smart. The edge is in execution, not just entry.