A honeypot is a token you can buy but cannot sell. The chart looks fantastic, because nobody is able to take profit. Then whoever controls the contract drains the liquidity pool, and the chart stops mattering.
This is not a rare edge case. Solidus Labs puts the number of scam tokens deployed in 2022 alone at 117,629 (the bar chart "Scam tokens deployed per year" on page 4 of its report). Across its whole dataset, over 200,000 scam tokens from September 2020 to 1 December 2022, 98,442 were honeypots, which the firm calls "by far the most popular rug pull" (Solidus Labs, 2022 Rug Pull Report, PDF). The good news: a honeypot lives in the contract code, and code is public. You can check it before you send a single cent.
What a honeypot actually does
Every ERC-20 or BEP-20 token has a transfer function. A normal one moves tokens from A to B. A honeypot adds a condition: the transfer goes through if the sender is on an allow-list (the deployer, the marketing wallet, a few friends) and quietly fails or gets taxed to zero for everyone else.
From the outside, nothing looks broken. The token trades on a DEX, the price ticks up, Telegram is buzzing. The only people who notice are the ones who try to sell, and by then they've already paid.
Some honeypots are blunt (sells revert with a cryptic error). Others are subtle: a sell tax of 99%, a maximum sell amount of 0.0001 tokens, or a "cooldown" that never expires. Same result, different wording.
The on-chain signals that give it away
You don't need to read Solidity. Security scanners like GoPlus simulate a trade against the contract and read out its permissions. Five signals carry most of the weight.
1. Sell tax that doesn't match the buy tax
A token that charges 0% on buys and 40% on sells is not "rewarding long-term holders." It's a slow-motion honeypot. Anything above 10% in either direction deserves a hard look. A sell tax far above the buy tax is the classic pattern: cheap to get in, expensive or impossible to get out.
2. Mint function still live
If the contract can create new tokens after launch, the owner can dilute everyone at will. That alone isn't a honeypot, but it's the same power structure: one address decides what your tokens are worth. Legit projects usually cap supply or burn the mint key. Check whether it happened, not whether the whitepaper promised it.
3. Ownership never renounced (or faked)
An owner address that still controls the contract can change taxes, pause trading, or add wallets to a blacklist at any time. "Renounced" in the Telegram pinned message is worth nothing until you see it on-chain. Solidus documented fake renunciations as a category of its own (48,974 cases in the same dataset): the visible owner is set to zero while a hidden address keeps the sensitive functions.
4. Sells blocked by code
This is the honeypot itself. Blacklists, "anti-bot" modes that never switch off, max-transaction limits set absurdly low, or conditions like "sells only allowed when buyers outnumber sellers 2:1" (yes, that one shipped in a real token). A trade simulation catches most of these: if the simulated sell fails, the label is honeypot.
5. Unverified source code and proxy patterns
Unverified code means nobody can read what the contract does. A proxy pattern means the owner can swap the logic later, so today's clean scan says nothing about tomorrow's version. Neither is proof of fraud. Plenty of serious protocols use upgradeable proxies. But combined with the signals above, it's a reason to stop.
Two cases that made the news
SQUID, November 2021. The Squid Game token, a BEP-20 coin with no connection to the Netflix show it was named after, went from about one cent in late October to roughly $2,861 on 1 November 2021. That's a gain in the region of 28 million percent in about a week. The reason it rose so cleanly: holders could not sell. The project called this an "anti-dumping" mechanism; CoinMarketCap had already put a warning on the coin's page, and the BBC reported the sell problem three days before the collapse. When the creators drained the liquidity pool, the price went to a fraction of a cent within minutes and the website disappeared. According to Solidus, investors had spent more than $3.3 million buying SQUID within days of its launch. The team was never publicly identified.
The 2022 numbers. The same Solidus report estimated that almost two million wallets had lost funds to rug-pull tokens since September 2020, and found that roughly 12% of all tokens on BNB Chain and 8% on Ethereum were hard-coded to defraud buyers. That's the base rate you're working against on any fresh DEX listing.
Neither case needed insider knowledge to spot. The sell restriction was visible in the contract from day one.
Step by step: checking a token on CoinVett
We built a free tool for exactly this. It runs on the same GoPlus data our coin pages use, no account needed.
- Open the Token Safety Check.
- Either search the coin by name, or paste the contract address and pick the chain (Ethereum or BNB Smart Chain). Get the address from the project's official channel or a block explorer, never from a random reply.
- Hit Run check. Coins we already track are served from our database; unknown contracts get a live scan that's cached for 24 hours.
- Read the three groups top to bottom:
- Trading security: the honeypot simulation and the buy/sell taxes. A red honeypot marker or a sell tax far above the buy tax ends the conversation.
- Contract security: whether the code is verified and whether the owner can still change the rules (proxy, mint). Warnings here mean the rules can still change.
- Ownership: how concentrated the holders are and whether the liquidity is locked. If a handful of wallets holds most of the supply and liquidity isn't locked, the exit door belongs to someone else.
- Signals the data source didn't report show up as unknown, not as green. Treat unknown as unknown.
The whole thing takes about a minute. Share the result URL if you want a second pair of eyes on it.
What the check cannot tell you
A contract scan reads code and on-chain state. It does not see the team's intentions, off-chain promises, or what an upgradeable contract looks like next week. A clean result lowers the odds of a technical rug pull; it says nothing about whether the project has a product, a market, or a future.
The reverse is also true. A warning is a pattern worth reading up on, not a court verdict. Some legitimate tokens carry a modest transfer tax by design, and many use proxies for upgrades.
Native coins (BTC, ETH itself, SOL) have no token contract to scan. Direct address scans currently cover Ethereum and BSC; for coins already in our database, Polygon and Arbitrum contracts may show up too.
The one-minute habit
Before any small-cap token: address from an official source, run the check, look at the sell tax and the honeypot simulation first, then ownership. If anything is red or unknown in the trading group, you've found your answer without spending anything.
For the broader playbook on social engineering, fake airdrops and impersonation accounts, our guide on recognizing crypto scams covers the non-contract side.
This article is for information purposes only and is not financial advice. Security signals describe on-chain contract behaviour, not the quality or prospects of a project.