Most of the money lost on memecoins isn’t lost to bad timing. It’s lost to tokens that were structured so that you could never win: supply held by a handful of connected wallets, liquidity that could be pulled, or a contract that quietly blocks selling. None of that is hidden. It’s all on-chain, and four free tools will show it to you in about ten minutes.
This guide walks through that routine in the order we actually do it. Every screenshot is of BONK, which is a good baseline because it is old, boring and widely held. Your job is to notice when a new token looks nothing like this.
Step 1: Paste the address into RugCheck
Not the name. The address. Searching by name on any tool will surface a dozen copies, and the one with the most volume isn’t always the one you want. Get the mint address from the project’s own channels, paste it into RugCheck, and read the report.
RugCheck gives a score, where lower is safer, and a list of flags at three levels: info, warn and danger. The exact cut-offs for its Good and Danger badges aren’t published, so don’t anchor on the number. Read the flags. These are the ones that matter most.
| Flag | What it means | How bad |
|---|---|---|
| Mint Authority still enabled | Someone can print more tokens and dilute you. | Serious. Pump.fun revokes this by default, so a launch with it live chose to keep it. |
| Freeze Authority still enabled | Someone can freeze your token account so you can buy but never sell. | Serious for a memecoin. Normal for a stablecoin. |
| Large Amount of LP Unlocked | The creator still holds the liquidity-pool tokens and can withdraw the SOL. | Danger. This is the classic hard rug. |
| Top 10 holders high ownership | Ten wallets hold more than 70% of supply. | Danger. Exits will be thin. |
| High holder concentration | Top ten hold more than 50%. | Warn. Common on fresh tokens; watch it fall. |
| Creator history of rugged tokens | The deployer wallet has launched tokens that rugged before. | Walk away. |
| Mutable metadata | Name, ticker and image can still be changed. | Minor. Very common at launch. |
| Permanent Control Enabled / Fee config enabled | Token-2022 extensions that let an authority move your tokens or tax transfers. | Serious. See step 5. |
BONK’s report has a single warn flag, mutable metadata, and a score of 7. A new Pump.fun token with revoked authorities and a burned pool will often look similar on this page, which is exactly why you don’t stop here.
Step 2: Look at who holds it on Solscan
Open the token on Solscan and go to the Holders tab. You want three things: how many holders there are, what share the top ten control, and who those top wallets are. Solscan labels the obvious ones, so a top holder tagged as a Binance cold wallet or a Raydium pool is fine. Ten unlabeled wallets created last week, each holding 4%, is not.
A useful rule of thumb from GMGN’s own documentation is that the top ten holding under 30% is healthy. Above 50% you should assume the price is controlled by a small group. Above 70%, RugCheck calls it danger and so should you. Keep in mind that pools and lockers are sometimes counted in the top ten and sometimes excluded, so check which wallets the tool is actually summing.
Holder count matters too. A study of 100,000 Solana tokens found that tokens that later rugged had a median of 9 holders. Legitimate ones had a median of around 41,000. You won’t see numbers like that on a two-hour-old token, but you can see whether the count is growing or whether it’s the same fifty wallets passing the token around.
Step 3: Check the clusters on Bubblemaps
The top-ten percentage can be gamed. Split supply across forty wallets and each one looks small. Bubblemaps defeats that by drawing lines between wallets that share a funding source or move tokens to each other, and coloring wallets it believes belong to one entity.
What you want is a galaxy: lots of bubbles, few connections, exchanges and pools among the big ones. What you don’t want is a solar system, with one large bubble in the middle and spokes to dozens of small ones. That is a deployer who funded a stack of wallets and bought their own token in the launch block. Bubblemaps’ own guide puts the largest connected cluster under 15% as healthy, 15 to 30% as elevated, and above 30% as high risk. Above 50%, one entity effectively owns the market.
Step 4: Liquidity and volume on DexScreener
DexScreener shows you the pool. Two things to read before anything else. First, liquidity against market cap. There’s no official safe ratio, but if a token claims a $5 million market cap on $40,000 of liquidity, selling even a modest position will move the price a lot, and the number on the screen isn’t one you can realize. Second, the buy and sell counts over the last hour and day. A thousand buys and six sells on a new token isn’t organic demand. It’s a volume bot, or a bundle warming up the chart before it exits.
While you’re here, ignore the social proof. DexScreener’s rocket, fire and flag icons are community reactions that feed a trending score. The gold-colored ticker you sometimes see means the token has 500 or more paid Boosts. Boosts are a product, bought in packs, and DexScreener doesn’t claim they mean anything about safety. A boosted token with a bundled holder base is still a bundled token.
Also check which pool you’re looking at. Pump.fun tokens that haven’t graduated are still on the bonding curve, which has no liquidity pool to rug. Once they migrate to PumpSwap the pool exists and the LP question becomes real.
Step 5: Check the token program
This is the step most guides skip, and it is becoming the most important one. Solana has two token programs. The original one starts with Tokenkeg. The newer Token-2022 program starts with TokenzQd and supports extensions. Most are harmless. A few are purpose-built traps.
- Permanent Delegate: one address can transfer or burn any holder’s tokens, forever, and you cannot revoke it.
- Transfer Fee: a tax on every transfer that the authority can raise.
- Transfer Hook: a custom program runs on every transfer and can simply refuse your sell.
- Default Account State frozen: new accounts start frozen until someone unfreezes them.
- Non-Transferable: you can hold it. You can’t sell it.
New Pump.fun mints already use Token-2022, so the program alone isn’t a warning. The extension list is. Solscan shows token extensions on the token page, and RugCheck surfaces the dangerous ones as “Permanent Control Enabled” and “Fee config enabled”. If you see either on a memecoin, there is no legitimate reason for it to be there.
Step 6: Who is trading it, on GMGN
GMGN’s token page tags wallets by behavior: snipers that bought in the first blocks, insiders that held the token before it was public, suspected insiders that share a creation time and funding source, and bundled wallets whose buys landed together in one block. It also shows the dev wallet and whether it has sold, and a rug history for the creator.
The pattern to watch is early wallets selling into new demand. If the sniper and insider tags are offloading while the chart is green and the holder count is rising, you’re the exit. A creator wallet near zero is a healthy sign; a creator wallet that still holds 10% and has “rug history” is not a sign, it’s a sentence.
What the checks don’t catch
All of this reads the structure of the token. None of it reads the people. LIBRA, the token Argentina’s president promoted in February 2025, had a cluster holding 82% of supply from the start. The team controlled the liquidity. Eight wallets pulled roughly $90 to $107 million out of the pools and the market cap went from $4.5 billion to $257 million in about eleven hours. Revoked mint and freeze authority would not have saved anyone. The holder map would have.
HAWK, the Hailey Welch token, is the other textbook case. Bubblemaps found 96% of supply in a connected cluster at launch, 17% unlocked for presale wallets on day one. Those wallets sold about $3.3 million into the launch and the token fell from about $500 million to $25 million. Every “safety” checkbox was ticked. The holders tab told the whole story.
The myths, briefly
- “Mint revoked means safe.” It means nobody can dilute you. It says nothing about who already holds the supply.
- “LP burned means safe.” It means the pool can’t be pulled. Holders can still dump into it, and operators burn LP precisely because it looks safe.
- “Green RugCheck means safe.” It means no structural flags at that moment. It doesn’t check whether the team is real.
- “Boosted means vetted.” Boosts are paid. Rockets are votes.
- “Low top-ten means distributed.” Not if the forty wallets below the top ten share one funding source.
The whole routine, in order
- Get the mint address from the project’s own channels, never from a search result.
- RugCheck: read the flags, not the score. Any danger flag ends the check.
- Solscan Holders: top ten share, holder count, whether the big wallets are labeled.
- Bubblemaps: is it a galaxy or a solar system? Largest cluster under 15%?
- DexScreener: liquidity vs market cap, buy/sell counts, which pool.
- Token program: Token-2022 extensions, especially permanent delegate and hooks.
- GMGN: are snipers and insiders selling? Has the dev sold? Any rug history?
- Decide your position size from the liquidity, not from the market cap.
Ten minutes. It won’t make you money. It will stop you handing it to someone who set the token up to take it.
