# Rug pulls and protocol exploits: different mechanisms behind a loss A rug pull generally describes project-linked fraud involving misuse of control over funds, including deceptive liquidity removal. An exploit abuses a technical or economic weakness. The categories can overlap, but a price crash or withdrawal failure alone does not establish either one. The useful question is what action moved value and who had the authority to perform it. Evidence: [Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud Scheme](https://www.justice.gov/usao-edny/pr/chief-executive-officer-digital-asset-company-found-guilty-multi-million-dollar-crypto); [Preparing for mainnet](https://docs.openzeppelin.com/contracts/5.x/learn/preparing-for-mainnet); [Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control) Canonical: https://degreesofsatoshi.com/encyclopedia/rug-pulls-vs-exploits/ Published: 2026-10-02 Substantively modified: 2026-10-02 Independently verified by an automated reviewer: 2026-10-02T19:18:00.092Z Data current through: 2026-10-02 AI-assisted research and drafting with a separate automated source-verification pass; no external expert or named human review is implied. ## Key facts - **Authority matters:** Administrative permissions can allow sensitive actions without a software bug. ([Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control)) - **Technical failure:** Audited contracts can still contain exploitable weaknesses. ([Preparing for mainnet](https://docs.openzeppelin.com/contracts/5.x/learn/preparing-for-mainnet)) - **Claims need checking:** Official fraud reporting documents false assurances about locked liquidity. ([Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud Scheme](https://www.justice.gov/usao-edny/pr/chief-executive-officer-digital-asset-company-found-guilty-multi-million-dollar-crypto)) ## Different causes can produce a similar loss If a person with a legitimate admin key misuses a withdrawal power, the contract may have followed its written permissions. If an outsider bypasses those checks through a bug, the path is different. Both can harm users, but prevention, evidence and responsibility differ. A legitimate liquidity withdrawal or a market-price decline is not by itself proof of fraud. Intent and representations require evidence beyond the chart. Evidence: [Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control); [Preparing for mainnet](https://docs.openzeppelin.com/contracts/5.x/learn/preparing-for-mainnet); [Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud Scheme](https://www.justice.gov/usao-edny/pr/chief-executive-officer-digital-asset-company-found-guilty-multi-million-dollar-crypto) ## Reconstruct the mechanism before choosing a label Identify the contracts, transaction sequence, permissions and resulting asset transfers. For a liquidity-removal claim, check which LP receipts were redeemed and where the assets went. Compare those actions with the published lock or access-control claims rather than treating a project’s own description as conclusive. Evidence: [Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control); [Uniswap v2 Pair implementation](https://raw.githubusercontent.com/Uniswap/v2-core/v1.0.1/contracts/UniswapV2Pair.sol) ## Do not pay to unlock a promised recovery The FBI’s liquidity-mining warning describes fake dashboards and demands for extra deposits after funds become inaccessible. Preserve transaction identifiers, addresses, messages and the relevant website details. Use independently located official reporting channels; another payment to the same contact does not establish that recovery is possible. Evidence: [Scammers Target and Exploit Owners of Cryptocurrencies in Liquidity Mining Scam](https://www.ic3.gov/PSA/2022/PSA220721); [What To Know About Cryptocurrency and Scams](https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams) ## Questions ### Can a project with locked liquidity still cause losses? Yes. The lock may be partial or misrepresented, and other token or administrative powers can create separate risks. Evidence: [Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud Scheme](https://www.justice.gov/usao-edny/pr/chief-executive-officer-digital-asset-company-found-guilty-multi-million-dollar-crypto); [Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control); [UNCX Network introduction](https://docs.uncx.network/) ## Claims and scope ### rug-pulls-vs-exploits-quick-answer A rug pull generally describes project-linked fraud involving misuse of control over funds, including deceptive liquidity removal. An exploit abuses a technical or economic weakness. The categories can overlap, but a price crash or withdrawal failure alone does not establish either one. The useful question is what action moved value and who had the authority to perform it. Scope: {"collection":"defi","dataAsOf":"2026-10-02","blockHeight":null} ### rug-pulls-vs-exploits-fact-authority-matters Authority matters: Administrative permissions can allow sensitive actions without a software bug. Scope: {"collection":"defi","dataAsOf":"2026-10-02","blockHeight":null} ### rug-pulls-vs-exploits-fact-technical-failure Technical failure: Audited contracts can still contain exploitable weaknesses. Scope: {"collection":"defi","dataAsOf":"2026-10-02","blockHeight":null} ### rug-pulls-vs-exploits-fact-claims-need-checking Claims need checking: Official fraud reporting documents false assurances about locked liquidity. Scope: {"collection":"defi","dataAsOf":"2026-10-02","blockHeight":null} ## Sources - [Chief Executive Officer of Digital Asset Company Found Guilty in Multi-Million Dollar Crypto-Fraud Scheme](https://www.justice.gov/usao-edny/pr/chief-executive-officer-digital-asset-company-found-guilty-multi-million-dollar-crypto) — US Department of Justice. Dated public prosecution report used for terminology and evidence distinctions, not a legal assessment of other projects. Locator: Evidence at trial; representations about locked liquidity. Retrieved: 2026-10-02T19:11:55.721Z. - [Preparing for mainnet](https://docs.openzeppelin.com/contracts/5.x/learn/preparing-for-mainnet) — OpenZeppelin. Audits are scoped security work, not a guarantee. Locator: Auditing and security; Admin accounts; Upgrades admin. Retrieved: 2026-10-02T19:10:47.728Z. - [Access Control](https://docs.openzeppelin.com/contracts/5.x/access-control) — OpenZeppelin. Privileges beyond a locked LP position. Locator: Ownership; roles; delayed access. Retrieved: 2026-10-02T18:53:23.338Z. - [Uniswap v2 Pair implementation](https://raw.githubusercontent.com/Uniswap/v2-core/v1.0.1/contracts/UniswapV2Pair.sol) — Uniswap. LP redemption authority and reserve accounting. Locator: mint; burn; swap; _mintFee. Retrieved: 2026-10-02T18:53:23.210Z. - [Scammers Target and Exploit Owners of Cryptocurrencies in Liquidity Mining Scam](https://www.ic3.gov/PSA/2022/PSA220721) — FBI IC3. Dated 2022 public-service notice; no adoption of dated loss totals. Locator: Tactics; Actions to Protect Yourself. Retrieved: 2026-10-02T19:10:49.579Z. - [What To Know About Cryptocurrency and Scams](https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams) — Federal Trade Commission. General scam signals; does not establish intent in a particular protocol loss. Locator: Investment scams; cryptocurrency payments. Retrieved: 2026-10-02T18:53:24.083Z. - [UNCX Network introduction](https://docs.uncx.network/) — UNCX Network. Locker provider explanation; not an endorsement or adoption of safety guarantees. Locator: Liquidity Lockers. Retrieved: 2026-10-02T19:10:58.873Z. ## Revision history - 2026-10-02: First publication after primary-source research and separate automated verification. ## Cite this entry Degrees of Satoshi editorial project. “Rug pulls and protocol exploits: different mechanisms behind a loss.” Published 2026-10-02; updated 2026-10-02. https://degreesofsatoshi.com/encyclopedia/rug-pulls-vs-exploits/