Encyclopedia DeFi · Entry 375
Rug pulls and protocol exploits: different mechanisms behind a loss
In this article
At a glance
Key facts
| Fact | Detail | Source |
|---|---|---|
| Authority matters | Administrative permissions can allow sensitive actions without a software bug. | [3] |
| Technical failure | Audited contracts can still contain exploitable weaknesses. | [2] |
| Claims need checking | Official fraud reporting documents false assurances about locked liquidity. | [1] |
Different causes can produce a similar loss
If a person with a legitimate admin key misuses a withdrawal power, the contract may have followed its written permissions. If an outsider bypasses those checks through a bug, the path is different. Both can harm users, but prevention, evidence and responsibility differ.
A legitimate liquidity withdrawal or a market-price decline is not by itself proof of fraud. Intent and representations require evidence beyond the chart.
Reconstruct the mechanism before choosing a label
Identify the contracts, transaction sequence, permissions and resulting asset transfers. For a liquidity-removal claim, check which LP receipts were redeemed and where the assets went. Compare those actions with the published lock or access-control claims rather than treating a project’s own description as conclusive.
Do not pay to unlock a promised recovery
The FBI’s liquidity-mining warning describes fake dashboards and demands for extra deposits after funds become inaccessible. Preserve transaction identifiers, addresses, messages and the relevant website details. Use independently located official reporting channels; another payment to the same contact does not establish that recovery is possible.
Direct answers
Questions people ask
Can a project with locked liquidity still cause losses?
Yes. The lock may be partial or misrepresented, and other token or administrative powers can create separate risks.
Inspect the evidence
The answer and key facts have stable claim links. These records retain the scope and qualification when reused.
A rug pull generally describes project-linked fraud involving misuse of control over funds, including deceptive liquidity removal. An exploit abuses a technical or economic weakness. The categories can overlap, but a price crash or withdrawal failure alone does not establish either one. The useful question is what action moved value and who had the authority to perform it.
Scope: DeFi · data through 2026-10-02. Verification: verified · 2026-10-02T19:18:00.092Z.
Link to this claimTechnical failure: Audited contracts can still contain exploitable weaknesses.
Scope: DeFi · data through 2026-10-02. Verification: verified · 2026-10-02T19:18:00.092Z.
Link to this claimClaims need checking: Official fraud reporting documents false assurances about locked liquidity.
Scope: DeFi · data through 2026-10-02. Verification: verified · 2026-10-02T19:18:00.092Z.
Link to this claimRevision history
- — First publication after primary-source research and separate automated verification.
Source register
Sources and references
Retrieval dates and locators are recorded individually.- Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud SchemeUS Department of Justice
Dated public prosecution report used for terminology and evidence distinctions, not a legal assessment of other projects.
Locator: Evidence at trial; representations about locked liquidity · Version / scope: Report published 2025-05-21; retrieved 2026-10-02; hash recorded · Retrieved: 2026-10-02T19:11:55.721ZOpen source - Preparing for mainnetOpenZeppelin
Audits are scoped security work, not a guarantee.
Locator: Auditing and security; Admin accounts; Upgrades admin · Version / scope: Primary page retrieved 2026-10-02; hash recorded · Retrieved: 2026-10-02T19:10:47.728ZOpen source - Access ControlOpenZeppelin
Privileges beyond a locked LP position.
Locator: Ownership; roles; delayed access · Version / scope: Documentation retrieved for the 2026-10-02 editorial scope; content hash recorded · Retrieved: 2026-10-02T18:53:23.338ZOpen source - Uniswap v2 Pair implementationUniswap
LP redemption authority and reserve accounting.
Locator: mint; burn; swap; _mintFee · Version / scope: Uniswap v2-core v1.0.1 · Retrieved: 2026-10-02T18:53:23.210ZOpen source - Scammers Target and Exploit Owners of Cryptocurrencies in Liquidity Mining ScamFBI IC3
Dated 2022 public-service notice; no adoption of dated loss totals.
Locator: Tactics; Actions to Protect Yourself · Version / scope: Primary page retrieved 2026-10-02; hash recorded · Retrieved: 2026-10-02T19:10:49.579ZOpen source - What To Know About Cryptocurrency and ScamsFederal Trade Commission
General scam signals; does not establish intent in a particular protocol loss.
Locator: Investment scams; cryptocurrency payments · Version / scope: Documentation retrieved for the 2026-10-02 editorial scope; content hash recorded · Retrieved: 2026-10-02T18:53:24.083ZOpen source - UNCX Network introductionUNCX Network
Locker provider explanation; not an endorsement or adoption of safety guarantees.
Locator: Liquidity Lockers · Version / scope: Documentation retrieved 2026-10-02; hash recorded · Retrieved: 2026-10-02T19:10:58.873ZOpen source
Research and drafting use AI assistance. A separate automated review checks claims against primary sources; no external expert or named human review is implied. Publication, substantive editing, source retrieval and verification are recorded separately. This version was independently checked by an automated reviewer on 2 October 2026.
Editorial method and correctionsDegrees of Satoshi editorial project. “Rug pulls and protocol exploits: different mechanisms behind a loss.” Published 2026-10-02; updated 2026-10-02. https://degreesofsatoshi.com/encyclopedia/rug-pulls-vs-exploits/