On January 15, 2025, a new token promising three-digit returns appears on a decentralized platform. The website oozes professionalism, the Telegram community already has 20,000 members, and early investors are displaying spectacular gains. Three weeks later, the project vanishes. $4.7 million has disappeared. Welcome to the world of rug pulls and honeypots—the two dominant crypto scams that now account for 68% of scam-related losses according to Chainalysis.
The paradox is striking: just as regulation tightens with MiCA in Europe and established players adopt strict compliance standards, scams are multiplying in unregulated market segments. Early-stage projects launched on DEXs without prior audits have become the playground of choice for fraudsters. And their methods have become considerably more sophisticated. Losses from DeFi exploits now exceed $577 million, a figure that illustrates the scale of the problem.
Rug Pulls and Honeypots: Two Mechanisms, One Outcome
Let's start by clarifying the terminology, since confusion between these two types of scams is common. A rug pull—literally "pulling the rug out from under your feet"—involves creating an ostensibly legitimate token, attracting investors, then draining the project's liquidity and disappearing. The creators typically have a hidden function in the smart contract that lets them withdraw all funds from the liquidity pool in a single transaction.
The honeypot token works differently. The trap is more subtle: you can buy the token without issue, the price climbs, your wallet shows tantalizing gains. But selling is impossible. The smart contract contains a restriction that blocks sell transactions for all holders except the creators. You're stuck with tokens worth nothing, like a fly caught in honey.
These two mechanisms share a common characteristic: they exploit the opacity of smart contract code and the haste of investors lured by promises of quick gains. Article L. 561-10 of the French Monetary and Financial Code imposes a duty of vigilance on digital asset service providers. But on an unregulated DEX, nobody checks the code before the contract is deployed.
Spotting Rug Pulls: Red Flags to Watch Before Investing
Experience from cases handled by the AMF and TRACFIN since 2023 allows us to identify recurring warning signals. Here are the elements that should systematically trigger your vigilance during your crypto due diligence.
The source code is not audited or verified. A legitimate project has its smart contract audited by a specialized firm (CertiK, PeckShield, Trail of Bits). The absence of a public audit is the first alarm bell. If the code isn't even verified on a blockchain explorer like Etherscan or BSCScan, don't invest. Period.
Token distribution is unbalanced. Check the initial distribution: if a single address or small group of addresses controls more than 20% of total supply, the risk of manipulation is real. Creators can sell massively once the price rises, triggering a sharp collapse. Also check whether the team's tokens are subject to vesting: its absence indicates that founders can liquidate their position anytime.
Liquidity is not locked. On DEXs, liquidity provided by creators should be "locked" in a smart contract for a minimum duration, typically six months to a year. This information is public and verifiable. If liquidity isn't locked, creators can withdraw it instantly, draining the pool and leaving investors with worthless tokens.
The website and social media are recent. Check the domain creation date (via whois.com) and the age of Twitter/Telegram accounts. A project launched three weeks ago with a site created ten days ago and accounts dating from yesterday should immediately raise your suspicions. Scammers often create the appearance of community with bots and fake accounts.
Return promises are unrealistic. "1000x guaranteed," "multiply your capital by 50 in one month": these formulations are typical of scams. No legitimate project guarantees returns. Article 67 of the MiCA Regulation explicitly prohibits promising certain gains in crypto-asset promotion anyway. If a project makes such promises, it's already violating European regulation.
The team is anonymous or unverifiable. Anonymity isn't inherently disqualifying in the crypto universe. But total lack of verifiable information on founders, combined with other red flags, should alert you. Serious projects, even if they use pseudonyms, typically have a traceable history and an established reputation in the ecosystem.
Scam Coin Identifier: How to Verify a Smart Contract Before Investing
Technically verifying a smart contract might seem intimidating if you're not a developer. Yet certain basic checks are accessible to everyone and can prevent you from suffering considerable losses.
First step: find the token contract address. It should normally appear on the project's official website or communication channels. Copy this address and go to the corresponding blockchain explorer (Etherscan for Ethereum, BSCScan for Binance Smart Chain, etc.). If the contract doesn't appear or isn't verified (you'd see a "Contract Source Code Verified" badge), that's a major red flag.
Next, examine the contract's functions. Even without technical expertise, certain functions should alert you: "mint" (unlimited token creation), "setTaxPercent" (transaction fee modification), "blacklist" (address blocking), "pause" (transaction freeze). These functions give creators disproportionate control. A legitimate decentralized project limits these powers or subjects them to community governance.
Use automated analysis tools. Token Sniffer, RugDoc, or Honeypot.is allow you to quickly scan a contract and identify suspicious functions. These tools aren't foolproof, but they detect the grossest scams. A high risk score should make you walk away, regardless of the project's promises.
Check the early transactions. On the blockchain explorer, review the contract's history. If you notice that certain addresses can sell while others systematically fail (transactions marked "Failed"), you're facing a honeypot. This simple check can spare you a total loss on your investment.
What to Do If You Fall Victim to a Crypto Scam
Despite all precautions, it's possible to get caught. Your first step should be documentation: take screenshots of all your transactions, the project website, conversations on Telegram or Discord, promises made by the team. These elements will form your complaint file.
File a report with TRACFIN (Cellule de Traitement des Déclarations de Soupçon). It's the French authority competent for crypto-asset fraud. You can also report the scam on the Pharos platform run by the Interior Ministry. These reports help authorities identify organized networks and, in some cases, freeze funds before they're completely dispersed.
If the amount is significant (above €3,000), consider filing a formal complaint at a police station or gendarmerie. Explicitly request an official complaint receipt, not merely a simple report which has no legal value. Your complaint will be forwarded to the prosecutor's office. The chances of recovery are slim, let's be clear, but they're not zero, especially if the investigation leads to identifying the perpetrators.
Also report the project on community platforms. Reddit, Twitter, and specialized forums like BitcoinTalk have sections dedicated to scams. Your testimony can prevent other investors from falling into the same trap. Some projects are exposed thanks to the swift alert from vigilant investors.
Regarding taxes, an important clarification: a loss from a scam remains a capital loss for tax purposes. Keep all evidence of the transaction and the scam. Consult your accountant or a tax attorney to determine whether this loss is deductible against future capital gains. Since each situation is specific, personalized advice is essential. Tax compliance in crypto remains a major issue for French investors.
The Watchpoint
```The crypto scam market evolves as quickly as the legitimate market. Scammers adapt, copy the code of successful projects, professionalize their communication. What worked to identify a scam a year ago may not be enough today. Vigilance is never relaxed.
A simple rule: if you don't understand the technical workings of a project, if you can't verify the code yourself, or if you must "trust" the creators without tangible evidence, don't invest. Easy money doesn't exist. Serious projects welcome thorough examination of their code and business model.
And remember: in the crypto universe, you are your own bank. That's extraordinary freedom, but it comes with total responsibility. Nobody will reimburse your losses from a scam. The only effective protection remains your ability to identify red flags before committing a single euro.
