EverRise 5 Chains, 1 Supply

RISE: 0xC17c30e98541188614dF99239cABD40280810cA3

5 chains, 1 supply Learn More!

On BNB Chain, Ethereum, Polygon, Fantom & Avalanche

Articles & Updates

Stay up to date on what's happening in the EverRise Ecosystem!

EverRise Blog

Examining Crypto Scams and Ways to Avoid Them

Examining Crypto Scams and Ways to Avoid Them


Cryptocurrency is an exciting space full of innovative ideas and has grown tremendously over the past decade as it demonstrates its ability to shape the worlds of finance and technology. However, cryptocurrency is not without its concerns. The biggest issues turning people away from crypto are scams — dishonest people preying upon others. Today, we’re going to take a look at some of the most prevalent scams in the space and how to avoid them.

Rug Pulls

A rug pull occurs when the development team of a project suddenly abandons a project without notice, removing or selling all of the liquidity acquired through organic trading. This often occurs after a period of increasing price and trading volume — adversely affecting many expectant holders who bought into the project with the hope of making a quick return. There are multiple different types of rug pulls, so let’s take a look at the most common and how they happen.


Liquidity Drains

Rug pulling a project by draining its liquidity is one of the most common forms of this scam. This generally happens after a project lists itself on a Decentralized Exchange with a native coin pairing such as BNB or ETH, and a liquidity pool is established to facilitate frictionless trading of the asset.

The next step is typically to generate hype for the project on social media, in order to create FOMO ( fear of missing out ) and lure holders into a false sense of security. Oftentimes influencers are paid to promote the project to their thousands or sometimes millions of followers online, and this creates a surge of trading which in turn bolsters the value of the liquidity pool.

Once the project has been pumped to considerable value, the developers remove all of the native coin from the liquidity pool — creating a massive drop in price and making further selling of the token impossible due to lack of liquidity. Those on the receiving end of a liquidity drain oftentimes experience a 99% or greater loss of value.

If you would like to learn more about liquidity and how it functions, you can read another blog post about it here.


Another way of rug pulling a project involves the developers setting aside a large amount of the total supply in their own private wallets before launching the project. After the project is launched, hype is generated through social media in order to gain the trust and confidence of potential buyers.

After the value of the developer’s wallet has reached their desired value, all of those tokens are sold or “dumped” on the open market - creating a sudden crash in price and allowing the developers to abscond with thousands or sometimes millions of dollars. This typically leads to a panic driven sell-off, in which a majority of holders of the project attempt to retain what little value they have left by selling their positions, leading to a downward spiral in price and ultimately the death of the project.


How to Avoid Rug Pulls

Avoiding rug pulls can be a difficult thing, especially when speculative or new projects are involved. One of the more common ways of assuaging fears that investors might have about the future of a project is by making the identity of the team publicly available ( also known as doxxing ). This is done under the premise that legal action can be taken against members of the team if a rug pull occurs. While this method does lend itself to some degree of trust between holders and developers it is not a definite guarantee that a project is safe, as many projects with a doxxed team have been rug pulled. Some developers have even been known to use fake identities to create a false sense of security.

Another way of identifying potentially safe projects is by looking for those that lock their liquidity using tools provided by third party applications such as Unicrypt or Unilocker. These tools revoke the developer’s access to the liquidity pool for a designated amount of time, making it impossible for them to drain the liquidity pool.

This method is not without its own inherent issues, unfortunately. In the event of a contract exploit from outside forces many projects opt to migrate to a new contract to ensure the safety and security of their project and its holders. If the liquidity is locked, projects are unable to move those tokens alongside everything else in the process of migration. This in turn creates a situation in which buying or selling on the new contract is almost impossible and subject to a large amount of price volatility — oftentimes preceding the project’s eventual demise.

The best way of avoiding this intrinsic issue with locked liquidity is by looking for projects secured using the liquidity locking functionality of EverOwn. EverOwn is the first of its kind smart contract & liquidity locker powered by EverRise in which access to a project's liquidity is based around the community, rather than an arbitrary time-based lockup.

While using EverOwn a project must bring the decision to access its liquidity to a communal vote, with each holder being given a voting weight based on the amount of tokens they hold in their wallet. If the majority of the community votes in favor of unlocking the liquidity, access is granted to the developers for a period of time so that they can make required changes or transfers. The liquidity is then relocked, encouraging honest and transparent behavior from the development team. Through this process, EverOwn effectively democratizes access to liquidity and gives every holder a voice.


Malicious Smart Contracts

Another way of defrauding investors in cryptocurrency is through malicious smart contracts. A smart contract is defined as the following by Investopedia:

“A smart contract is a self-executing contract with the terms of the agreement between buyer and seller being directly written into lines of code. The code and the agreements contained therein exist across a distributed, decentralized blockchain network. The code controls the execution, and transactions are trackable and irreversible.

Smart contracts permit trusted transactions and agreements to be carried out among disparate, anonymous parties without the need for a central authority, legal system, or external enforcement mechanism.”

Smart Contracts are essential to the operation of any cryptocurrency project and every modern protocol utilizes a smart contract, oftentimes multiple smart contracts in conjunction with one-another in order to function properly.

A malicious smart contract is one that is intentionally coded with some sort of backdoor or exploit that siphons funds from investors as transactions are being made or directly from holders as the contract is given permission to transact freely with individual wallets. One of the biggest dangers with smart contracts is the developers retroactively changing the code after the project has already been deployed and holder confidence has been gained.

One notable instance of a malicious smart contract being used is with the Squid Game Coin honeypot. A honeypot scam is when a developer edits a smart contract to only allow buying of an asset, creating an upwards trend in price that encourages others to buy based on FOMO. By preventing swapping, selling, or trading of the Squid Game Coin — the developers effectively trapped thousands of people in their project. Once a desirable amount of value had accrued in the liquidity pool for the project, the developers drained it, defrauding their community to the tune of $2.5M in untraceable BNB.


How to Avoid Malicious Smart Contracts

While malicious smart contracts can be difficult to identify and avoid, there are a few steps that any crypto participant can take to avoid having their funds stolen. As always, research and due diligence should be done before investing into any new or unfamiliar project to ensure that the development team is trustworthy and established in the crypto space. Another good way of verifying the legitimacy and safety of a project is by looking for projects audited by companies such as CertiK or Chainsulting.

These firms professionally audit smart contract code and release a publicly available score, as well as the code’s strengths and weaknesses. Websites such as CoinGecko will also show whether or not a project has been audited under the ‘security’ tab on the project’s page.

Smart contract access can also be revoked using tools such as EverRise’s dApp EverRevoke. After connecting their wallet, a user can see which smart contracts are approved to transact with their wallet. If a contract is found that a user does not recognize, they can revoke those smart contracts for a minimal blockchain gas fee.

Another practical way of avoiding malicious smart contracts is by looking for projects that secure their smart contract with EverOwn. This Decentralized Application ( or dApp ) allows developers to lock access to their project’s smart contract behind a communal vote — making it so that changes can only be made with the explicit consent of the community. After changes are made, the contract is then relocked under EverOwn for the security of both the project and its holders.

Key Takeaways

While crypto scams are unfortunately common and oftentimes intelligently designed, the information provided in this blog is a good starting point for staying safe in the world of decentralized finance, cryptocurrency, and web3. In a future installment of this series, we’ll be covering other varieties of scams and how you can avoid them.