What distinguishes a rug pull from a project that simply failed

A rug pull is defined by what the people controlling a token deliberately did, not by the fact that the token’s price fell to zero. A project that fails honestly — through bad decisions, a design flaw, or a market downturn nobody engineered — is not the same event, even though a chart of the two can look identical. That distinction, between deliberate extraction and honest failure, is the one the taxonomy in Rugsafe’s technical paper is built around; the paper was posted to arXiv on 8 July 2025, with an earlier working version dated 1 September 2024. Three price patterns, three different causes Rugsafe’s paper, written by Jovonni L. Pharr and Jahanzeb M. Hussain, sets out three distinct patterns that a collapsing token price can follow. In what the paper calls a scam rug pull, the token’s creators deliberately drain liquidity after building trust with holders, and the price collapses almost instantly once that liquidity is pulled. In a catastrophic event rug pull, a legitimate project suffers an unexpected failure — the paper cites a major design flaw or a market crash — and the price declines exponentially, but gradually, as a result of that failure rather than fraud. In the third pattern, which the paper labels a legitimate project resembling a rug pull, the project keeps operating but the price fades toward zero as community confidence erodes; the paper says this is especially visible in NFT floor prices, where a collection can remain live while its trading value evaporates. All three end in a worthless token. Only the first, in this taxonomy, is a rug pull in the strict sense. How the liquidity-drain mechanism actually works On an automated market maker such as Uniswap V2, liquidity providers deposit two assets — say a new token and ETH — into a pool and receive an ERC20 pool-share token, commonly called an LP token, representing their claim on that pool. Per a Uniswap V2 developer course published by Cyfrin Updraft, withdrawing that liquidity means calling the router’s removeLiquidity function, which first moves the LP tokens from the holder’s wallet to the pair contract and then calls the pair contract’s burn function; burning the LP tokens is what triggers the underlying paired assets to be sent back to whoever held them. Kaspersky and Crypto.com, reporting independently, describe the same underlying mechanic in plain terms: liquidity theft happens when a token’s creators withdraw the paired assets backing the pool, leaving the token with no liquid counterpart to trade against. If a project’s team holds most or all of the LP tokens for its own pool, that suggests they control when the removeLiquidity call gets made — an inference from how the contract mechanics work, not a statement made in that course material.