Spotting scams and low-quality tokens

A coin that falls hard is not always a scam, and a coin that looks clean is not always safe. This page shows how to tell the difference. By the end, you can check what its creator can still do, spot copies and paid posts, and recognize the messages built to empty wallets.

The chain, the public record of every transaction, shows what happened, never why, so this page leaves motives aside. The Trenches lessons it names sit on the Crypto road, which opens in order, starting with the free Memecoin starter.

Why a falling chart does not prove a scam

In Different mechanisms behind a token collapse, four made-up practice coins fall 75 percent on identical charts, each in a different way. In one, someone withdrew most of its pool, the pair of token reserves it trades against. Then one ordinary sale dropped the price. The others met a single large sale, new supply created and sold, or hundreds of small sales.

A chart shows prices, not the process behind them: only the history tells the four apart. Calling every fall a rug pull, the label that blames the team, squeezes four stories into one.

The coins in a pool are its liquidity, what traders buy from and sell into. A liquidity pull removes a large share of them, whatever the intent (How a liquidity pull works).

Say a pool holds 200 SOL, the Solana network's own coin, and 1,000,000 tokens. Whoever put in most of it takes out 75 percent of both. Both sides shrink by the same share, so the price holds. But selling 250,000 tokens now returns 25 SOL instead of 40.

A sale on the chain shows tokens were sold, not who sold them. So a headline like "an insider sold" is a claim to check (Attributed holder sales).

What can the creator still do to a coin?

Every Solana token is defined by its mint account, a record of its powers and its supply, the number of coins that exist. That account's address, the mint address, tells one coin apart from another with the same name (Mint and freeze authority).

A mint authority can create new units and send them to one chosen account. Say you hold 1 percent of the supply, and the authority creates 25 percent more units for another account. You still hold the same count, but your share falls to 0.8 percent.

A freeze authority can freeze a token account, which holds your balance of one token. Then nothing can be sent out until a thaw. Switching off the mint authority ends minting and nothing else. So a post saying "authorities revoked" can be half true: the freeze power may still be on.

So the coins in your wallet may not be free to sell. In Frozen accounts and blacklists, a correctly signed sale fails from a frozen account. In Transfer restrictions and failed exits, buys succeed while most sells fail. Most of those failures come from a transfer hook, a program that checks every transfer and lets only listed senders through.

Some tokens take their own cut of every transfer. In Transfer fees and tax tokens, a quote, the estimate shown before you trade, says 100,000 tokens. Only 95,000 arrive, because the quote left out the 5 percent cut. All of this can be read on the chain before you trade.

A community takeover, when a group announces that it now leads a coin, changes who speaks for the coin, not who controls it (Community takeovers). No power, pool or fee rights move.

Is it the real coin? Copies, clones and fake pairs

Anyone can copy a coin's name, picture and ticker, the short label on screen. On pump.fun, many coins often share a hot ticker. What identifies a coin is its network and its full mint address (The ticker is not the identity). Take that address from the project's own site or account, found yourself, not from a link someone sent you.

A lookalike address matches the real one's first and last characters and differs in the middle, the part apps hide when they shorten it (Copied names and images). A copied account changes one character of its @name, such as a zero for the letter O. So compare every character against the project's own page.

Easy to mix up: the ticker and the coin. In Clones and fake pairs, a search for one ticker returns four coins with the same ticker and logo but four different mint addresses: four separate coins.

Prices can mislead too. There, one pool shows the real coin's price in fake dollars: a copy of USDC, a coin built to track the dollar. Another prices a clone: buying there works, delivers the wrong coin, and nothing warns you. A price counts only when both tokens in the pair match confirmed mint addresses.

On pump.fun, a new coin first sells on a bonding curve, a launch pricing rule. A later step called migration moves its liquidity into a pool. That pool is the real one (A canonical pool requires evidence). Anyone can open another pool or label one "official", but only the migration settles it.

Paid posts, bought followers and bundles

Memecoins are attention markets: money goes where attention flows, and attention can be bought. So ask who gains if readers act, not how many see a post (Promotion, groups and paid attention). A writer who bought before posting has a conflict of interest, something to gain if you act, even if nobody paid them. An "#ad" line is a disclosure: a fact about the writer, not evidence about the coin.

A post with no "#ad" line may or may not be paid: the missing label proves nothing either way (Conflicts and paid promotion).

A call is a post that names a coin and says or hints that readers should buy it. In one practice call, the chain contradicts its claim that the liquidity is locked, safe from withdrawal (Who is calling it). A wallet shown to be the caller's bought 40 minutes before the post and sold three quarters of it 25 minutes after.

Follower and member counts can be bought or automated, and followers are not buyers (Questionable audience counts). A screenshot proves only that an image exists, and a crop can change its meaning without changing a word (Screenshots and impersonation).

A screener, a site that lists coins, may tag a launch's first buys as a bundle: up to five transactions sent together, all or nothing (Bundles, groups and attribution limits). The bundle is on the chain. A tag saying the creator controls those wallets is a guess.

Messages built to empty your wallet

Phishing copies someone you trust to get you to open a link, reveal a secret, sign something or send funds. So skip the message's link and check the claim through a route you trusted before it arrived, like your own bookmark (Phishing links and lookalikes).

Link text can say anything, so read the web address itself, from the right. Say a link points to trenches.example.checks.example. The page belongs to whoever owns checks.example, whatever the familiar name on the left says. A padlock in the browser means the connection is encrypted, not who runs the site.

A private message after your public question is only a claim to be support, whatever badge or case number it shows (Fake support and DMs). Real support never needs your seed phrase or private key, the secrets that control your wallet. Neither one helps with a login problem.

A drainer is a scam tool built to take your coins. It still needs something from you: a signed transfer, an approval that lets another account spend your tokens, or your seed phrase (Malicious signing requests and drainers). When a page promises one thing and your wallet's request shows another, the request is what you would approve. Removing an approval later cannot undo a transfer already made.

Anyone can send a token to your address, and receiving one grants nothing (Unsolicited tokens and claim requests). But its name may point to a claim page, and that page is the danger. It can ask for signatures, payment or your seed phrase. Wallets, keys and the seed phrase covers the phrase itself.

A message may say your account closes in seconds. That pressure proves nothing about who sent it or where the money would go. A pause leaves the request unsent while you check (Pause when a message creates urgency).

Why no check proves a coin is safe

A test sale is a simulation: a preview of one request, at one moment (A test sale has limits). A tiny test hides how far a full sale would move the price. Later, a freeze or a changed hook can treat your sale differently. So one test that passes does not prove you can sell.

A scanner, a tool that runs a set list of checks, may show "Passed 6 of 6 checks". That means six stated checks at one moment, nothing more (Scanner tools and their limits). In the lesson, it never reads the token's extra rules, so a transfer hook sits outside the badge.

A green flag, one passed check, narrows one concern (Green flags are not proof). What the checks never examined is still unknown. In the lesson, a practice coin passes five checks, then falls 70 percent in a week as large holders sell into a pool with little in it.

So look for facts that could show a coin is unsafe, not just the ones that make it look fine. Reading token stats: holders, volume, age and depth covers the numbers behind those checks.