Common signs include thin or locked-looking liquidity, sudden volume spikes from a few wallets, repeated self-trades, concentrated holder balances, and price moves that do not match real community activity. Watch for contract features that allow transfers to be paused, fees to be changed, or supply to be minted after launch, because those controls can support a staged exit.
How artificial support masks a rug pull
The pattern usually starts with activity that looks lively but does not behave like a real market. Thin liquidity, tightly controlled LP conditions, and price movement that seems detached from genuine community growth can all indicate that the token is being staged for appearance rather than adoption. What matters is whether the trading pattern is organic, or whether it is being manufactured to keep outside buyers confident long enough for the exit to happen.
A second clue is concentration. If a few wallets dominate buys, sells, and apparent engagement, the token may be receiving repeated support from the same source set rather than broad demand. That can create the illusion of momentum while hiding how little independent participation actually exists.
The Crypto Scam and Drainer Guide is useful here because rug pulls often sit in the same operational family as broader crypto fraud, where false signals are used to keep victims engaged until liquidity or access is removed.
Which on-chain behaviours are most suspicious?
The strongest warning signs are repeated self-trades, wash-trading-like patterns, and volume bursts that come from only a handful of wallets. Those behaviours can make a token look active even when there is little real buying pressure. A healthy launch usually shows some diversity in counterparties, timing, and transaction size, not the same actors recycling volume.
Holder distribution is equally important. When a small set of addresses controls an outsized share of supply, or when new holders appear slowly while price rises quickly, the token can be vulnerable to a staged dump. That does not prove fraud by itself, but it does mean the market structure is too narrow to trust price as evidence of demand.
For a wider launch-security lens, the AI Agent Tool and Plugin Security Guide is a good navigation point for the same “rug pull” concept in tool ecosystems, where trust can be manufactured through misleading signals before access or behaviour changes.
What contract and launch controls should raise alarms?
Contract features can matter as much as trading behaviour. If transfer logic can be paused, fees can be changed without clear constraints, or supply can be minted after launch, the project may have built-in levers that support a staged exit. Those functions are not automatically malicious, but they create the conditions for asymmetric control, where insiders can alter user outcomes faster than outsiders can react.
That is why launch due diligence has to go beyond charts. You should check whether the token has owner-controlled functions, whether liquidity is genuinely locked, and whether the permissions behind minting, taxation, or trading restrictions are narrowly bounded. If the controls are too broad, price stability may be an operational effect of admin power rather than proof of a legitimate market.
The MCP Server Trust Assessment and the MCP Gateway Buyers Guide both reinforce the same practitioner lesson in a different domain: assess trust by permissions, provenance, and changeability, not by surface polish or short-term activity.
Risk and Threat Considerations
Artificial support is dangerous because it turns price discovery into a deception problem. Buyers can mistake manufactured volume and controlled liquidity for legitimate momentum, then enter just before the support is withdrawn and the exit begins.
Failure mechanism: Coordinated wallets, self-trading, and owner-controlled contract features can create a false sense of depth and demand while preserving the ability to drain liquidity, change trade economics, or manipulate supply.
Impact: Late buyers can be trapped with illiquid tokens, severe slippage, or near-total loss once the staged support ends and insiders exit.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1499 — Endpoint Denial of Service | Manipulated trading and support signals can function as deceptive pressure before exit. |
| Recommendation — Map repeated self-trades and staged activity to adversary deception patterns during investigation. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Owner-controlled minting, fees, or pause functions can create excessive launch-time power. |
| NHI-06 — Insecure Cloud Deployment Configurations | Broadly mutable launch controls mirror weakly constrained deployment-time trust boundaries. | |
| NHI-07 — Long-Lived Secrets | Persistent privileged access can enable delayed exits after artificial support is created. | |
| Recommendation — Review token admin powers and reduce any post-launch control that can alter holder outcomes. Constrain mutable launch settings so privileged changes cannot silently reshape the market. Rotate and tightly govern any privileged keys that can change token economics or supply. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Launch permissions should be limited to prevent unilateral fee, pause, or mint changes. |
| CM-5 — Access Restrictions for Change | Contract change powers need strict authorization because they can reshape token behaviour. | |
| Recommendation — Limit owner permissions to the minimum set needed for the token’s intended operation. Restrict who can modify token controls that affect trading, fees, or supply. | ||
| CIS Controls v8 | CIS-5 — Account Management | The token’s privileged admin paths must be inventoried and governed to prevent abuse. |
| Recommendation — Inventory and control every privileged path that can affect token issuance or trading. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Unauthorized use of privileged token functions can enable hidden post-launch control. |
| Recommendation — Protect privileged contract functions so only intended actors can invoke them. | ||
Practitioner Guidance
What to verify: Check whether liquidity is genuinely locked, whether the contract owner can alter fees or mint supply, and whether the early trading set is too concentrated to represent organic demand. If the token only looks active because a few wallets are repeatedly propping it up, treat the chart as manipulated until proven otherwise.
Decision rule: If the token’s market structure depends on discretionary controls that can change after launch, assume the exit path exists and assess downside before evaluating upside. If you cannot explain the source of volume in terms of independent participants, do not treat rising price as validation.
Practitioner takeaway: The key judgement is not whether a token is moving, but whether its price and liquidity are being discovered by the market or being staged by insiders.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org