Liquidity pool rug pull is a crypto fraud where the party controlling a pool or its related token drains the locked funds or abandons the project after attracting deposits. It usually involves removing liquidity, dumping the paired token, or using hidden permissions that let the operator extract value from the pool.
What a Liquidity Pool Rug Pull Is
A liquidity pool rug pull is a form of crypto fraud, where an operator controls the pool, the paired token, or both, then withdraws liquidity or otherwise drains value after attracting deposits. The danger comes from asymmetric control, hidden permissions, and fast-moving on-chain value extraction.
How the Scam Works
These schemes often rely on the project appearing legitimate long enough to build trust, attract buyers, and deepen liquidity. Once enough capital is present, the operator can remove liquidity, dump the paired token, or exercise privileged actions that were not obvious to participants.
Because decentralised finance systems can execute transactions quickly and publicly, the extraction can happen in minutes. That speed limits reaction time and can leave users holding a token whose market support has been intentionally removed.
Why It Is Dangerous for Investors and Protocols
The immediate harm is financial loss, but the broader damage is trust erosion across the token, the pool, and sometimes the surrounding ecosystem. A rug pull can also distort price discovery, trigger panic selling, and create knock-on losses for anyone who entered late or relied on the pool as a source of liquidity.
For protocols, the incident often reveals that control over liquidity, minting, ownership, or administrative functions was too concentrated. Even when no code vulnerability exists, governance design and operational permissions may still allow the operator to behave like an insider threat.
How to Assess Exposure and Respond
Exposure review starts with understanding who can move liquidity, change token parameters, mint supply, or alter pool rules. Review the project’s documentation, contract permissions, and deployment history, and compare those claims with the actual on-chain state. External token approval and permission patterns should also be checked for hidden paths that could enable draining behaviour, as outlined in the Crypto Scam and Drainer Guide.
When a pool appears suspicious, limit new exposure, verify whether liquidity is locked under credible conditions, and treat sudden ownership changes or unexplained contract updates as red flags. If funds have already been drained, response should focus on preserving evidence, identifying affected wallets, and revoking any related approvals or access paths that could still be abused. The MCP Incident Response Playbook is a useful model for structured containment and recovery when a control plane or privileged component has been compromised.
Risk and Threat Considerations
Liquidity pool rug pulls are dangerous because they combine financial deception with operational control. The threat is not only that funds can be stolen, but that the project structure may have been designed so the operator can exit cleanly once deposits are deep enough.
Failure mechanism: Privileged liquidity removal, hidden minting rights, or token dumps collapse the pool’s value and leave holders with illiquid or near-worthless assets.
Impact: Victims can lose capital instantly, while the project, associated token, and any connected users or integrations suffer reputational damage and cascading market loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Liquidity pool control relies on tightly limiting who can move or alter value. |
| AU-6 — Audit Record Review, Analysis, and Reporting | On-chain activity and admin actions need review to spot abusive drains or suspicious changes. | |
| Recommendation — Restrict pool administration and value-moving rights to the minimum set of trusted actors. Monitor and review privileged pool actions and abnormal value transfers for abuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | The scam depends on poorly governed privileged accounts and ownership paths. |
| Recommendation — Inventory and govern accounts that can change liquidity, supply, or pool settings. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Hidden permissions let an operator perform privileged functions ordinary users should not have. |
| Recommendation — Enforce function-level checks on every privileged pool action and state change. | ||
| NIST CSF 2.0 | PR.AA-05 — Least privilege and role-based access | Pool control should be constrained so no single operator can drain value unchecked. |
| Recommendation — Apply least-privilege access to all liquidity and token administration functions. | ||
Practitioner Guidance
What to watch for: Treat unclear ownership, unrestricted administrative rights, and opaque liquidity controls as governance failures, not just project quirks. In practice, the safest posture is to assume that a pool is only as trustworthy as the permissions behind it.
Practitioner takeaway: If users cannot verify who can change or drain the pool, they cannot price the risk correctly, and that uncertainty should be treated as a material control weakness.
Related resources from NHI Mgmt Group
- Guide: AI Agent Tool and Plugin Security Guide
- What happens when a leveraged DeFi position is opened against a pool with low liquidity and a pricing bug?
- What happens when a token creator or primary liquidity provider abandons a pool after inflating activity?
- What are the signs that a crypto project is becoming a rug pull?
- What is the difference between a legitimate crypto project failure and a rug pull?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org