Solana Rug Pull Analysis: Research Reveals 76% of New Tokens Are Scams and Identifies $151 Million in Quantifiable Losses

The Solana blockchain is currently the most popular ecosystem for new token launches, but it has also become a high-risk environment for financial fraud.

In a study released on March 25, 2026, a team of researchers from Sun Yat-sen University recently released a study titled “SolRugDetector: Investigating Rug Pulls on Solana,” providing the most detailed look to date at the mechanics of these on-chain scams.

By analyzing 100,063 tokens issued between January and June 2025, the team showed that 76,469 (76.42%) of these projects were actually rug pulls.

This article covers their findings on scam lifecycles, the development of a new detection tool called SolRugDetector, and the organized syndicates that run these operations on-chain.

It is important to note that the study focused specifically on tokens that successfully reached the public market. They excluded the vast majority of tokens from the “Pump.fun” launchpad that failed to migrate to a decentralized exchange, as 98.6% of those never establish liquidity and lack analytical value.

Why Solana Rug Pulls Are Different From Ethereum Smart Contract Scams

The researchers explained that Solana uses a unified SPL Token program, which means creators cannot easily hide malicious code inside a custom smart contract as they do on Ethereum.

On Ethereum, a developer might write a hidden function to stop users from selling, but on Solana, the underlying execution logic is governed by the official program for every token. Because of this, fraud on Solana shifts toward on-chain operations and market manipulation.

The study showed that while many Ethereum scams rely on technical code exploits, Solana scams are driven by the deployer’s operational behavior.

Using On-Chain Transaction Data to Detect Fraudulent Tokens with SolRugDetector

The team built a system called SolRugDetector to identify these scams using only raw on-chain transactions and state data. The tool works in two phases: first, it filters out tokens based on their activity levels, and then it matches the remaining tokens against three typical rug pull patterns.

The researchers mentioned that many existing tools rely on static judgments based on partial metadata. In contrast, SolRugDetector relies exclusively on raw on-chain instructions and balance changes, intentionally avoiding price-related data (like market charts) because different platforms often report inconsistent prices for the same token.

In tests on a labeled dataset of 117 confirmed real-world rug pulls, the tool achieved an F1-score of 0.96, indicating it performed better than several enterprise-level detection services.

The Three Most Common Execution Methods for Solana Token Fraud

The research identified three primary ways scammers exit a project and take investor money:

• Freeze Authority Abuse: Scammers intentionally keep the power to freeze accounts. This allows them to let people buy tokens, but they then use a specific instruction to freeze the victim's account, preventing them from ever selling or transferring their assets.
• Liquidity Withdrawal: The creator waits for investors to buy the token and deposit capital into a trading pool, causing the price to rise. The scammer then uses their retained provider tokens to suddenly withdraw the underlying assets, causing the price to collapse and leaving the market dysfunctional.
• Pump-and-Dump: This is the most frequent pattern, seen in over 60,000 cases in the study. The developer holds a large amount of the supply in multiple addresses and sells it all at once when the price reaches a target level.

Analyzing the Short Lifecycle and Economic Impact of Fraudulent Assets

The data showed that rug pulls on Solana happen extremely fast. The researchers confirmed that while some categories occur in minutes, the overall median lifecycle for these fraudulent tokens is 0.0116 days (roughly 17 minutes), with the most common “Pump-and-Dump” type lasting a median of 31 minutes.

Between January and June 2025, these operations caused at least $151 million in quantifiable direct losses. The study also showed that the volume of fraud is highly synchronized with the price of SOL; when the market rises and speculative sentiment is high, the number of executed fraud attacks increases rapidly.

How Organized Syndicates Use Star and Cluster Topologies to Run Scams

The researchers found that rug pulls on Solana are rarely isolated incidents by single actors. They identified 78 large-scale groups that exhibit clear organizational patterns and coordinate their behavior. These syndicates use two main structures:

• Star Topology: A single core address typically conducts multi-cycle fraudulent activities, using automated scripts to launch and rug dozens or even hundreds of tokens within short time windows.
• Cluster Topology: A professionalized pattern featuring multiple participants and a clear division of labor. Different members collaborate to handle batch token creation, initial liquidity injection, and price manipulation across multiple tokens.

Deception Tactics Used in Token Naming and Social Media Marketing

Scammers use several ways to trick traders into thinking a project is legitimate. The study found 3,203 cases where the token name did not match the symbol, such as a token using a symbol that closely resembles mainstream assets like USDC or SOLANA to trick users in wallet interfaces.

They also identified 1,030 tokens that used high-similarity impersonation, with names like USDTea or TIKTOK COIN.

Off-chain, the deception is just as common; only 14.3% of the fraudulent tokens provided a website link, and over 70% of those were invalid, broken, or led to irrelevant social media pages.