Solana Rug Pull Checker: 5-Minute Safety Check

To know how to check if a Solana token is a rug pull, start with one paragraph of fast answers: confirm the mint authority is revoked (the power to print new tokens is gone), confirm the freeze authority is revoked (nobody can freeze your wallet so you can't sell), confirm the liquidity is locked or burned (the trading pool can't be drained), and confirm the supply is genuinely spread out instead of sitting in a few wallets dressed up to look like a crowd. If all four hold, the obvious traps are closed. The rest of this guide is about the rugs that pass that first glance on purpose, and the exact numbers that catch them.

Quick definitions before we start, because everything builds on them. A rug pull is when the people behind a token pull out the value and leave buyers holding something worthless. Mint authority is the power to print more tokens out of thin air. Freeze authority is the power to lock your tokens so you cannot sell. To revoke means to permanently give up one of those powers. Liquidity (held in a liquidity pool) is the pile of tokens and SOL that lets people trade, and the receipt for owning a share of that pile is an LP token. To burn something means sending it to an address no one can open, so it is gone forever. The classic rug is loud. The modern one is quiet, and most checklists you'll find online stop right before the part that matters.

The basic 5-signal checklist (still the foundation)

Run these first. If a token fails here, you can stop. If it passes, you are not safe yet, you are just ready for the real work in the next section.

Mint authority revoked. If it isn't set to None, someone can mint unlimited new supply and crush the price. Revoke means the creator gave up that power for good. A creator who wants their own token to clear this check can do it at remove the mint authority for 0.1 SOL.
Freeze authority revoked. If it's active, the team can freeze your token account (the on-chain slot that holds your balance) so you physically can't sell while they exit. It should read None. Creators close it at revoke the freeze authority for 0.1 SOL.
Liquidity locked or burned. If the LP tokens sit in a personal wallet, the team can withdraw the entire pool in one transaction. Burned LP, sent to a dead address, is the only state that can never be reversed by anyone, ever.
Holder concentration is reasonable. Holder concentration is how much of the supply the biggest wallets control. If ten wallets hold most of the supply, ten people decide whether you get out alive.
Holders are real, not bots. A wall of sybil or bot wallets (many fake wallets one person controls to look like a crowd) makes a dead token look popular. The old tell was hundreds of wallets holding the exact same balance. That tell is now obsolete, and the next section explains why.

You can pull all five for any mint, for free, with no wallet connection, using the free Token Holder Snapshot tool. It reports mint and freeze status and the holder list in one read, never asks for your private key, and powers everything in the advanced section, because it does arithmetic a plain holder list will not.

Token inspection illustration: a single token under a magnifying glass revealing a small lock and a sealed liquidity pool behind it

Advanced: how modern rugs hide, and how the snapshot catches them

Here's the problem with the basic checklist. Scammers read the same blogs you do. A holder-list explorer like Solscan, or a CSV export, tells you who holds what, and that's where it stops. It does not do the math that separates a healthy distribution from a disguised one. A serious Solana rug pull check in 2026 is mostly about reading two or three numbers correctly, and the setups below are built specifically to clear the five signals above and still drain you. Each technique ends with the exact snapshot metric that exposes it.

Three numbers carry most of the weight. The gini coefficient is a single score from 0 to 1 for how evenly a token is spread: 0 means everyone holds an equal slice, 1 means one wallet holds everything. The nakamoto number (or nakamoto coefficient) is the smallest count of wallets that together control more than half the supply, so a nakamoto of 1 means one wallet can dump the whole market by itself. And a common funder is the single source wallet that sent the starting SOL to a whole batch of bot wallets. Keep those three in mind.

1. Varied-amount sybils

The old advice was simple: if a hundred wallets all hold exactly 4,212 tokens, that's a bot farm. People learned to spot identical balances, so the farms adapted. Modern sybil clusters randomize each fake wallet's balance inside a range, so the holder list looks organic to the eye. No two amounts match.

The tell moved. Identical amounts stopped mattering once the farms started randomizing them. What gives a modern cluster away is a spread that's statistically too even. A real human holder base is naturally lumpy: some whales, lots of small bags, an uneven middle, plus most people hold a little SOL for gas and a few other tokens. A farm of randomized bots produces an artificially smooth spread across wallets that share three other traits: zero SOL, zero USDC, and only this one token. The snapshot computes a gini over real-holder balances and pairs it with a per-wallet SOL and USDC column. When you see a band of fifty wallets at a suspiciously even spread, every one empty of SOL and USDC, that's the disguised farm your eye would have called a healthy crowd. The metric that exposes it: a low gini concentrated in zero-SOL, zero-USDC, single-token wallets.

2. Hidden dev supply

The lazy version was the dev holding 40% in one wallet that screamed "dev." The modern version splits that same supply across a dozen fresh wallets that do not hold the mint or freeze authority, so none of them earn a "dev" badge. On a holder list, each one looks like an ordinary early buyer.

Concentration math sees through the costume because it cares about share, not labels. The snapshot's real-holder top-10 and the nakamoto number are both computed after excluding the liquidity pool, exchange wallets, and burn addresses. So a hidden dev cluster shows up as "a handful of real wallets quietly control a large share." A token marketed as "fair launch, community owned" that comes back with a nakamoto of 1 to 3 is telling on itself: a few supposedly random wallets hold more than half the float. Call that what it is: one team behind several doors, wearing a community costume. The metric that exposes it: real-holder top-10 share plus a low nakamoto.

3. The "that's just liquidity" shield

Scammers count on a reflex. You see a wallet holding 30%, you think "that's the pool, that's normal," and you move on. Sometimes it is the pool. Sometimes it's a personal wallet wearing the pool's reputation, and on a raw holder list you genuinely cannot always tell which is which.

The snapshot labels the liquidity pool, the exchanges, and the burn address, then removes all three from the concentration math. So when a big wallet appears in the real-holder concentration figure, it's there because it is not the pool. An unlabeled personal wallet sitting on a large real-holder share has nowhere to hide behind "oh, that's just Raydium," because Raydium is already named and pulled out separately. If it isn't labeled, it counts. The metric that exposes it: real-holder concentration with labeled pool, CEX, and burn carved out.

4. Fake-CEX laundering

A subtler move routes supply through wallets dressed up to resemble exchange wallets, so a buyer assumes a centralized exchange (a CEX wallet, like Binance's hot wallet) is holding it and relaxes. "Binance holds 30%, must be fine." A plain list shows you an address and a balance. It does not vouch for whose address it really is.

The snapshot's known-entity labels do the vouching. A genuine Binance or Raydium wallet gets named from a maintained registry. An unlabeled wallet merely pretending stays unlabeled, and that 30% lands back in the concentration count where it belongs. So the "an exchange holds a big chunk, so it's safe" assumption gets checked against reality instead of taken on faith. The metric that exposes it: the known-entity label, present or absent.

5. Partial-burn and short-lock liquidity

"Liquidity locked and burned" is one of the most abused phrases in the space, because it's usually only half true. A team burns a slice of the LP for the screenshot and keeps the rest in a wallet they control. Or they put it in a liquidity locker (a contract that holds LP tokens until an unlock date) that quietly unlocks in three days.

The snapshot's distribution breakdown shows you burned percent against pool percent directly, so a partial burn is visible as a number instead of a promise: if only 12% of the LP is at the burn address and the rest sits in a wallet, you know. For a lock, the snapshot points you to the locker and you read the actual unlock date on a free explorer. Remember the rule from the checklist: burned liquidity is the only kind that can never be pulled. A lock is a delay, not a guarantee. The metric that exposes it: the distribution breakdown's burned-versus-pool split, then the unlock date as a Solscan cross-check.

Fake holder cluster illustration: many identical evenly-sized wallet nodes sharing one birth point and glowing the same, beside a few larger distinct real-holder nodes

6. Token-2022 permanent delegate

This one catches careful people, because it beats the basic checklist outright. A token can show mint authority None and freeze authority None and still be fully rug-able. Token-2022 is a newer Solana token format that can carry extra built-in powers the classic format never had. One of those powers is a permanent delegate: a wallet that can move or seize any holder's tokens at will, no freeze needed, no minting needed. It's a hidden rug switch that survives both authorities looking perfectly revoked.

Clean authorities are necessary but not sufficient. You have to confirm whether the token is classic SPL or Token-2022, and if it's Token-2022, whether it carries a permanent delegate or a transfer-fee trap that taxes every sell. Be precise about the limit here: the snapshot reports authority status and surfaces the suspect wallet, but it does not auto-decode Token-2022 extensions for you. You finish by checking the token's program on a free explorer. If you're a creator who wants the cleanest possible signal, you can lock your token's metadata permanently for 0.2 SOL, and the Token-2022 token creator (0.15 SOL) builds standard Token-2022 tokens without adding a delegate. The point for a buyer is simple: do not let a clean authority readout end your investigation on a Token-2022 mint. The metric that exposes it: authority status reads None, but the format check (done on the explorer) reveals a delegate the basic five never see.

A token with revoked mint and freeze can still be drained through a Token-2022 permanent delegate. Always confirm the token's format before you trust "authorities revoked" as the final word.

7. Common-funder farms

The deepest signature of a sybil cluster is the money trail. Every bot wallet in a farm was funded by one source, the common funder, usually pushed through a short chain of throwaway intermediaries, and usually minutes before launch. Real holders arrive from a hundred different places over time, not from one faucet at one moment. That single origin is the fingerprint no amount of balance randomization can scrub.

The snapshot flags the cluster for you by the traits we keep coming back to: wallets empty of SOL and USDC, each controlling a single token account, all entering at near-identical points. Then you finish the trace yourself. Be honest about the boundary: the snapshot does not draw funding graphs and does not show exact wallet creation dates. What it gives you is the suspect cluster, already isolated. You open two or three of those wallets on Solscan, look at their first incoming transfers, and watch them all trace back to the same funder. The snapshot does the math and hands you the cluster. You finish the trace on the explorer. The metric that exposes it: the flagged empty-wallet cluster plus a Solscan funding cross-check.

8. Bundle-launch concealment

The "organic" first ten buyers were often the dev buying their own token from many wallets inside the very first block. That's a bundle launch, and it manufactures the illusion of instant demand. The signature is the same family of traits as a common-funder farm, with one extra: the earliest holders share a funding source and entered in the same block. The snapshot surfaces the early-holder cluster through its real-holder concentration and the empty-wallet signals. You confirm the same-block entry and shared funder on the explorer. A token whose first wave of holders all arrived together, from one wallet, in one slot, was never discovered by a crowd. It was placed. The metric that exposes it: the flagged early cluster plus a Solscan same-block, same-funder cross-check.

Is the trading volume real?

A holder list tells you who owns the token. It says nothing about whether the chart's activity is genuine. Wash trading is cheap on Solana, so a token can show a busy tape while almost nobody is actually buying.

The quickest tell is volume against unique wallets. If the last hour shows $400K in volume but only about 22 distinct wallets traded, you are watching a handful of accounts pass SOL back and forth, not real interest. Genuine momentum leaves a wide tail of small buyers. The second pattern is concentration: when 60% or more of the volume comes from the same 5 to 10 wallets, it is bot-generated, and it tends to vanish the moment the paid campaign stops.

Fake volume exists for one reason. It buys temporary placement on listing pages and trending tabs, where a late buyer sees the number and assumes demand. There is no demand underneath it.

To check by hand, open the trade history on DexScreener or Birdeye and read the buyer addresses. If the same short list repeats on every candle, discount the volume entirely. The token holder snapshot gives you the faster version: it shows the holder count next to the activity, so a token with huge volume and a tiny, clustered holder base flags itself right away.

Volume that climbs while the price falls is its own warning. Real sellers exit into real buyers, and the wallet count widens as they do. A narrow set of addresses cycling size on a red chart is a setup, not a market.

Bonding curve or AMM? Read the stage first

Two tokens can look identical on a chart and carry completely different risk, because one is still on a pump.fun bonding curve and the other has graduated to a Raydium AMM pool. Before you judge the liquidity, work out which stage you are in.

On the curve, the creator cannot yank the floor. Liquidity is not open yet, and the token does not migrate until the curve fills (around 85 SOL bought in). That does not make it safe. It moves the danger somewhere else. Once the token graduates to an AMM, LP-based rug mechanics switch on, and the "is the LP locked or burned" question from earlier becomes the one that decides everything. My Pools shows where the LP tokens ended up after migration.

While a token is still on the curve, these signals carry the most weight:

Insider load. If the deployer plus three sniper wallets hold more than 35% of supply, the chart belongs to them.
Depth against FDV. A $1.2M fully diluted value sitting on under $8K of SOL cannot let everyone out. When pool TVL is below 5% of FDV, read the FDV as decoration.
The 92% trap. A token near full curve completion trending on social is late entry, not an early find. At the migration threshold, snipers front-run the new pool, dump into it, and leave a price that can take days to recover.
Age. Most tokens die before they ever migrate. One that has kept its holders for 36 hours is a different statistical animal from one that launched 11 minutes ago.

When the top of the holder list looks suspiciously coordinated, map the money behind it. Wallet Scope draws the funding graph, so a "distributed" top ten that was really funded by one wallet minutes before launch shows up before you buy.

How j.tools solves what a holder list cannot

Pull all of that together and the positioning is plain. A holder-list explorer, Solscan or a CSV export, answers "who holds what" and stops. Catching a disguised rug needs three things a list does not give you: the concentration math, the per-wallet context, and a real-holder figure that strips out the pool, exchanges, and burn so the number actually means something. Disguised rugs are built to survive a list, and that's the gap j.tools Token Holder Snapshot is built to close. It's free, read-only, and never touches your wallet key.

Concretely, for any mint, a Solana holder snapshot returns:

Mint and freeze authority status, showing None when each is revoked.
The full holder list, every wallet with its balance and percentage.
A concentration scorecard: the top-10 share of real holders (with the liquidity pool, exchanges, and burn addresses excluded), the nakamoto number, the dev share, and a gini coefficient over real-holder balances. This is the Solana token concentration check that the eight tricks above all fail.
A distribution breakdown: what percent of supply is real holders versus liquidity pool versus exchanges versus burned.
Per-holder context: SOL balance, USDC balance, how many token accounts the owner controls, a known-entity label like Raydium or Binance when one applies, and a flag when the wallet is the mint or freeze authority.

Be clear about the boundary. The snapshot does not trace funding graphs, does not show exact wallet creation dates, and does not auto-decode Token-2022 extensions. For those three, it hands you the flagged cluster and you finish the trace on Solscan or by reading the token's program. The SOL-and-USDC-equals-zero column plus the gini score is what turns sybil holder detection on Solana from guesswork into a readout. The snapshot surfaces the suspect cluster and does the concentration math. You finish the trace. That's the honest frame for the whole tool, and it's the difference between reading the math and just scrolling balances.

For more walkthroughs in this vein, the full library of Solana safety guides and our articles about the Solana ecosystem go deeper on individual tools and attack patterns.

Safe versus red flag, at a glance

Signal	Looks safe	Red flag
Mint authority	None (revoked)	Active wallet can still mint
Freeze authority	None (revoked)	Active, can lock your sells
Liquidity	Burned (cannot ever be pulled)	LP in a personal wallet, partly burned, or short lock
Real-holder top-10	Spread across many independent wallets	A few unlabeled wallets hold most of the float
Gini coefficient	Naturally lumpy, mid-range	Artificially smooth across SOL/USDC-empty wallets
Nakamoto number	High (many wallets needed for 50%)	1 to 3 on a "community owned" token
Token format	Classic SPL, or Token-2022 with no special powers	Token-2022 with a permanent delegate or sell tax
Early holders	Arrived over time, varied sources	Same block, one common funder

About j.tools

j.tools is a Solana toolkit with 40+ no-code tools, including a free holder snapshot that does the real concentration math, token creation, revoking authorities, swaps, and more. It's bilingual in Turkish and English, and it never asks for your private key. You sign every action in your own wallet. If you're a creator who wants your own token to pass the checks above, the tools that set these flags are remove the mint authority (0.1 SOL), revoke the freeze authority (0.1 SOL), and make the token immutable (0.2 SOL). When a token clears your checks and you decide to act, you can buy or sell through a swap at roughly 0.005 SOL per swap, in your own wallet, after you've done the homework.

An honest limit you should hold onto: passing every check here is necessary, not sufficient. A token can show revoked authorities, burned liquidity, a healthy gini, and a high nakamoto number, and still go to zero, because the dev sells their honest stake at the first pump, or because no real demand ever shows up. Clean structure removes the engineered traps. It does not manufacture demand or read intent, and nothing in this post is financial advice. Size your position so a total loss is survivable, every time.

FAQ

How do I check if a Solana token is a rug pull for free? Run the token's address through a free read-only holder snapshot. Confirm mint and freeze authority both read None, that liquidity is burned, and that the real-holder concentration (top-10, nakamoto, gini) is spread out. No wallet connection or signing is needed to look.

How do I spot a hidden Solana rug that passes the basic checks? Look past the list at the math. A low gini among empty zero-SOL wallets, a nakamoto of 1 to 3 on a "community" token, a big unlabeled wallet excluded from the pool, or a Token-2022 permanent delegate are the disguised setups the basic five miss.

Can a token with revoked mint and freeze still be rugged? Yes. If it's a Token-2022 token with a permanent delegate, one wallet can seize anyone's tokens regardless of the authority status. Always confirm the token's format before trusting "authorities revoked."

Why exclude the liquidity pool and exchanges from concentration? Because including them hides the real picture. The pool and a CEX wallet are supposed to hold a lot. Counting them lets a dev cluster blend in. Stripping them out is what makes the real-holder top-10 and nakamoto number honest.

What's the difference between this and just using Solscan? Solscan shows you who holds what. The snapshot computes the concentration math, separates real holders from pool, exchanges, and burn, and flags the suspect wallet clusters so you know exactly which addresses to trace back on Solscan.

What is a rug pull in crypto?

A rug pull is a crypto scam where the people who launched a token remove the value and disappear, leaving buyers with a coin they can't sell or that's worth nothing. The name comes from pulling the rug out from under everyone standing on it. On Solana it usually takes one of three shapes.

Liquidity rug. The team drains the trading pool, so there's no SOL left to sell your tokens against. The price goes to zero in one transaction.
Mint rug. The creator keeps the mint authority, prints a huge new supply, and sells it into your buys until the chart collapses.
Authority or delegate seize. Using freeze authority (classic SPL) or a Token-2022 permanent delegate, the team locks or takes your tokens directly, no selling required.

The structural checks in this guide close all three. A token with revoked mint and freeze, burned liquidity, and no Token-2022 delegate has had its built-in rug switches removed before you ever buy.

How to use a rug pull checker

A rug pull checker is any tool that reads a token's on-chain state and tells you whether the traps above are open or closed. You don't need a wallet connection or a signature to look, because all of this data is public. The free Solana rug pull checker reads it in one pass and does the concentration math a plain holder list skips. Here's the order to run it in.

Paste the token's mint address. It loads mint and freeze authority status, the full holder list, and the concentration scorecard at once.
Confirm both authorities read None. If either shows an active wallet, stop here, the structure is unsafe by itself.
Read the distribution breakdown for the burned-versus-pool split. Look for liquidity that's actually burned, not partly burned or sitting in a personal wallet.
Check the real-holder scorecard: top-10 share, nakamoto number, and gini over real holders (pool, exchanges, and burn already stripped out). A nakamoto of 1 to 3 on a "community" token is the disguised-dev tell.
Scan the per-wallet SOL and USDC columns for a band of empty, single-token wallets. That's the sybil cluster you then trace on a free explorer.

The checker reads the chain, you make the call. It surfaces the suspect cluster and the math; you finish funding-trail and Token-2022 format checks on a free explorer like Solscan.

Rug pull checklist (free template)

Copy this and run it top to bottom on any mint. Every line is a yes or no. A single firm "no" on the first three is enough to walk away.

Mint authority is None? No active wallet can print new supply.
Freeze authority is None? Nobody can lock your account so you can't sell.
Liquidity is burned, not merely locked? A burn can't be reversed; a lock is only a delay.
Real-holder top-10 is spread out? No handful of unlabeled wallets controls most of the float.
Nakamoto number is high? It takes many wallets, not one or two, to move 50% of supply.
Gini looks naturally lumpy? Not an artificially smooth band of zero-SOL, zero-USDC wallets.
Token format checked? Classic SPL, or Token-2022 confirmed to carry no permanent delegate or sell tax.
Early holders arrived over time? Not one common funder buying from many wallets in the same block.

Eight yeses means the engineered traps are closed. It still doesn't promise demand or honest intent, so size any position so a total loss won't hurt. Nothing here is financial advice.

How to Check if a Solana Token Is a Rug Pull (5-Minute Safety Checklist)