Newly issued tokens are risky because buyers have little history to assess tokenomics, ownership controls, liquidity depth, or contract permissions. A small group may still control minting, trading limits, fee settings, or liquidity pools, so the price can be supported artificially, then collapsed once insiders withdraw value or disable trading.
Why New Tokens Are Easy to Manipulate Before the Market Has Evidence
Freshly issued tokens have thin price discovery and very little operating history, so buyers are often forced to infer safety from marketing, social proof, and on-chain snapshots that can change quickly. That creates room for insiders to shape the early market with controlled supply, concentrated liquidity, or rule changes that are not obvious to late entrants.
In practice, the danger is not just “low liquidity.” It is that the token’s economic controls may still be highly centralized, while most participants assume the market is already distributed. When a small issuer group can still influence supply, trading rules, or pool depth, the apparent market price can be more fragile than it looks.
Which Token Controls Create the Highest Rug Pull Exposure?
The highest-risk tokens are the ones where buyers cannot independently verify who can mint more supply, change fees, restrict transfers, or remove liquidity. Those controls determine whether the token can be supported honestly or manipulated until insiders exit.
Contract permissions matter as much as branding. If a deployer, admin wallet, or associated multisig still has authority over token mechanics, then the token may look decentralized while remaining operationally controlled by a very small set of actors. Buyers should treat that as a structural risk, not a cosmetic one.
Liquidity control is especially important because it determines whether buyers can exit at all. A token can appear active while market depth is effectively artificial, and once liquidity is withdrawn or throttled, the price can gap down faster than most participants can react.
Why Early Buyers and Market Participants Misread the Signal
Early token markets often reward speed more than diligence. Buyers may anchor on short-term price appreciation, influencer attention, or exchange listings and miss the more important question: whether the token’s permission model still allows insiders to change the rules after the public has entered.
This is why “looks tradable” is not the same as “is safe to trade.” A token can have volume, a chart, and a community, yet still expose participants to manipulation if the issuer can alter tokenomics, suppress selling, or concentrate control through wallets and contracts that ordinary buyers cannot see clearly.
Participants also need to separate smart contract risk from market structure risk. A contract may be technically deployed correctly while the surrounding distribution, liquidity, and governance model still makes the asset easy to rug.
Risk and Threat Considerations
New token launches create a classic asymmetry: the issuer knows far more about the token’s controls and exit paths than the public does. That gap is what makes rug pulls effective, because buyers can be trapped into a position before they understand who can still move the economic levers.
Failure mechanism: insiders retain minting power, privileged trading controls, fee authority, or liquidity access long enough to inflate confidence, then extract value or disable normal trading conditions once outside demand has formed.
Impact: buyers can be left holding tokens that are illiquid, overissued, or no longer freely tradable, with losses amplified by the speed of on-chain value extraction and the absence of a central recovery path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Issuer or admin control over token mechanics mirrors excessive privilege risk. |
| NHI-07 — Long-Lived Secrets | Launch-time control keys and admin powers can persist long enough to enable a rug pull. | |
| NHI-08 — Environment Isolation | Token launch, liquidity, and admin control should be isolated from broader treasury risk. | |
| Recommendation — Map privileged token controls and remove any authority beyond the minimum needed. Rotate or retire launch credentials and admin keys as soon as control is no longer needed. Separate launch controls and liquidity access from long-term treasury authority. | ||
| MITRE ATT&CK | T1650 — Acquire Capabilities: Acquire Tool | Insiders use retained control to change token behavior or market conditions. |
| Recommendation — Track who can change token behavior and remove unnecessary control paths. | ||
| NIST CSF 2.0 | GV.SC-01 — Supply Chain Risk Management Strategy | Token buyers depend on issuer and liquidity control relationships that need governance. |
| Recommendation — Require governance over issuer control, liquidity access, and exit conditions. | ||
Practitioner Guidance
What to verify: Before buying a newly issued token, verify whether supply can still be expanded, whether trading restrictions can still be changed, and whether liquidity can still be removed or redirected. If those answers are not transparent, treat the token as high risk even if the market appears active.
Common mistake: Do not confuse initial liquidity with durable market safety. Early liquidity can be staged, temporary, or controllable by insiders, so the key judgment is not whether the token is tradable today, but whether the control surface still allows a forced collapse tomorrow.
What to prioritise: Focus first on the issuer’s remaining authority, then on liquidity depth, then on whether the tokenomics can be changed after launch. If any one of those is opaque, the token should be treated as speculative exposure, not routine participation.
Practitioner takeaway: New tokens are dangerous when market visibility is high but control visibility is low, because the ability to change supply or withdraw support turns price discovery into a trap for late buyers.
Related resources from NHI Mgmt Group
- Guide: AI Agent Tool and Plugin Security Guide
- Why do new crypto tokens create such high pump and dump risk for market participants?
- Why do non-human identities create more risk than many human accounts?
- Why do non-human identities create more remediation risk than many human accounts?
- Why do service accounts and API keys create more risk than runtime-issued tokens?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org