Token rug pulls examined by Ilia Nikolaevich Zavialov: who empties the pool and how long the scheme lives

Overview / Blog

Published: 22 September 2026 · 9 min read · Ilia Nikolaevich Zavialov

1. The shape of the market in one paragraph

   Two million launches in a year is not a market of projects. It is a market of listings, most of which never attract enough interest to matter and are quietly left where they are.

   Of those launches, 42.35 percent reached a pool on a decentralised exchange, which is the point at which a token becomes buyable by strangers. Everything before that point is a database entry with a name.

   The flagged share, 3.59 percent, sounds small until it is counted. It is 74,037 separate tokens in a single year, each one of which had a page, a description and at least one person who bought it.

   The useful conclusion is about base rates. A new token is overwhelmingly likely to go nowhere, and a meaningful minority are designed from the start to end in one transaction that empties the pool.

2. Who actually drains the pool

   The address that empties a suspected scheme pool is, in about 94 percent of cases, the same address that created the pool. There is no mystery about who did it and no third party to blame.

   The remaining 6 percent were emptied by addresses that the pool or token deployer had funded. In several cases the deploying address and the draining address had been funded from the same source, which points to coordination rather than coincidence.

   This matters for how a company should think about counterparty risk here. The risk is not that somebody might exploit the project. The risk is that the project is the exploit, and the person holding the keys is the person selling you the story.

   It also explains why an exit happens without warning. Nothing has to be hacked and nothing has to fail. A single transaction by an address that always had the authority to make it ends the entire thing.

3. How long the scheme lives

   The average suspected scheme ran for 6.23 days from pool creation to being emptied, and 99 percent of them were finished within 123 days. This is a business measured in days.

   That timescale destroys the most common defensive instinct, which is to wait and watch. A week of watching is the entire lifespan of the average scheme, and by the time a pattern looks established the pattern is over.

   It also explains the marketing tempo. Urgency in this market is not a persuasion technique bolted on afterwards. It is a structural requirement, because the whole operation has to complete before anybody finishes their research.

   For a company the practical rule follows directly. If a decision has to be made faster than the research can be completed, the answer is no, and the speed itself was the information.

   The 123 day figure is worth holding on to as well, because it sets the outer edge. A token that has been trading for well over four months is outside the window that describes almost all of these schemes, which does not make it a good position and does make it a different kind of question.

4. Why trading volume proves nothing

   Suspected wash trading across Ethereum, BNB Smart Chain and Base amounted to 2.57 billion dollars in 2024. Volume is the easiest number in this market to manufacture, because the same party can be on both sides of every trade.

   A chart showing heavy activity therefore carries almost no information about demand. It carries information about how much somebody was willing to spend on transaction fees to make a chart look busy.

   The same applies to holder counts. Addresses are free, and a list of thousands of holders can be produced by one person in an afternoon. What matters is the distribution, not the count.

   The figures that resist manufacture are the ones about control. Who can mint, who can pause transfers, who holds the liquidity, and whether the liquidity is locked in a way a stranger can verify.

5. The checks that fit in an hour

   Look at the concentration of the supply first. A small number of addresses holding most of the tokens means the price is whatever those addresses decide it is, and nothing else you check afterwards outweighs that.

   Then look at the liquidity. Whether it is locked, for how long, and by whom. An unlocked pool controlled by the deployer is the exact configuration that produced the 94 percent figure.

   Then read the contract permissions. The ability to mint new supply, to blacklist addresses, to pause transfers or to change fees after launch are each sufficient on their own to make a position unsafe regardless of intentions.

   Then check the age and the history of the deploying address. An address created days before the launch that has deployed several tokens before is a pattern, and the previous tokens can be looked up to see how each one ended.

   Finally look at who bought first. A pool where the earliest buyers were addresses funded by the deployer shortly before launch is describing its own structure, and that arrangement is visible on any block explorer without special tools or a paid service.

6. Documents that look like assurance

   A security audit is a real document with a narrow scope. It usually confirms that the code does what the code says, which is a different question from whether what the code says is safe for a buyer.

   Read the scope section and the date. An audit of an earlier version of a contract, or of a different contract entirely, is a common arrangement and is visible in ten seconds to anybody who opens the document rather than the badge linking to it.

   Named advisers and endorsements carry even less. Photographs and biographies are cheap, and a person whose name appears on a project page frequently has no idea it is there. A direct message to that person is a faster check than any technical analysis.

   A community of thousands is the weakest signal of the set. Accounts are purchasable in bulk, and the activity of a paid group is indistinguishable from that of a real one over the six days an average scheme needs.

7. What a company should write down in advance

   Decide the exposure limit before there is a specific opportunity, in writing. Positions in this asset class are almost never approved as a decision. They accumulate because nothing said stop.

   Require two people to approve any transfer of company funds to a token position, and keep the approvers separate from whoever holds the keys. This is the ordinary rule for payment runs, applied to the place where it is usually forgotten.

   Keep a one page register of every token the company touches, with the amount, the date, the deploying address and the person responsible. Most firms are surprised by that page the first time somebody assembles it.

   Record the reason for the decision at the time it is made. When a position ends badly, the question from the auditor and the board is what was known beforehand, and a dated note answers it far better than a reconstruction.

8. What these numbers do not say

   The analysis that produced these figures states plainly that it does not estimate victim losses, because on chain data alone is not enough to calculate them. The token counts describe how many schemes there were, not how much anybody lost.

   The flag itself is a pattern match rather than a verdict. Some tokens with these characteristics were abandoned projects rather than deliberate schemes, and the data cannot separate incompetence from intent.

   The wider picture is clearer. Around 14 billion dollars of scam proceeds were visible on chain during 2025, rising towards 17 billion once later identified wallets are counted, and the average payment to a scam operation grew to 2,764 dollars from 782.

   For a decision maker the honest summary is that the base rate is bad, the exit is instantaneous, the timescale is days, and every meaningful check can be completed before the money moves rather than after.