How to check if a crypto token is safe before you buy it

Before you buy a crypto token, run five quick checks. Confirm the contract source code is published and read who controls it. Check that the trading liquidity is locked. See how few wallets hold the supply. Look at the token permissions, then simulate a sell. Each check takes minutes, and together they catch most of the traps that cost people their money.

Why a pre-purchase check is worth the few minutes

Scam tokens pull real money out of real wallets every day. Americans alone reported more than $11.3 billion in cryptocurrency-related losses during 2025, the FBI's Internet Crime Complaint Center said in its annual report, across 181,565 crypto-related complaints. The on-chain total is larger still. Blockchain analytics firm Chainalysis, in a report published on January 8, 2026, estimated that illicit crypto addresses received at least $154 billion over the year, a 162 percent jump on 2024.

Not every dollar of that is a token scam. Plenty is theft, sanctions evasion and investment fraud. But a real share is the plain trap this guide covers: a token you can buy and then cannot sell, or one whose team empties the pool and walks. Those losses are avoidable. The checks below are what separate a bad trade from a drained wallet.

Which tokens actually need these checks

These checks are built for one situation. A new or thinly traded token on a decentralized exchange, the kind you buy by connecting a wallet rather than through a regulated platform, is where honeypots and rug pulls live. A fresh contract with a few hundred holders and a day-old liquidity pool deserves every check below, run slowly.

Established assets are a different question. Bitcoin, Ether and the large coins listed on regulated exchanges carry market risk, meaning the price can fall hard, but they will not trap your sell order inside a hidden contract rule. If you buy through a licensed exchange, the platform has already done basic listing checks. The checks here matter most the moment you leave that fenced area and trade a token straight from its contract.

Check the contract is verified, and who controls it

Start on the block explorer for the token's chain. Etherscan for Ethereum, BscScan for BNB Chain, Solscan for Solana. Open the token's contract page and look for published, verified source code. A verified contract means the code you are reading is the code that runs. An unverified one hides its logic, and you cannot judge what you cannot see.

Once the code is visible, look at who holds power over it. A mint function lets the team create new supply and dilute you toward nothing. A blacklist or freeze function lets them block your address from selling. A changeable tax lets them raise the sell fee to 100 percent after you have bought in. None of these are illegal, and some honest projects keep a mint function for good reasons. The real question is whether a single wallet can flip any of them without warning.

Check the token's age and its creator too. A contract deployed hours ago, by a fresh wallet with no history, sitting under an anonymous team, is the standard shape of a throwaway scam. That alone does not make a token a fraud. It does mean a new, anonymous token has to earn far more trust than an older one with a named team and a record you can read on-chain.

Check the liquidity, and whether it is locked

Liquidity is the pool of coins that lets you trade the token back out again. If the team controls that pool and it is not locked, they can pull it in one transaction and leave your tokens worth nothing. That move has a name. People call it a rug pull.

On a market tool like DEX Screener you can see the pool size and the trading pairs. Then check whether the liquidity is locked or burned, who holds the lock, and when it expires. A lock that unwinds next week is barely a lock at all. Trust Wallet's own guide tells readers to check how much of the supply a lock actually covers, because a lock on a sliver of the pool protects almost nothing, and insiders sometimes keep a second pool off to one side.

Not every rug pull is a single sudden exit. In a slow rug, the team leaves the liquidity in place and quietly sells its own supply into each new buyer over days or weeks, bleeding the price down while the project keeps posting cheerful updates. That version is harder to catch on day one, which is why holder concentration matters as much as the lock itself. If a few insider wallets hold enough to sell for weeks, the exit never has to be sudden to drain you.

Check who actually holds the token

Look at how few wallets hold the token. On the explorer, open the holders list and read the top addresses. If the top ten wallets sit on most of the supply, one of them selling can collapse the price before you get out.

Read that list with care. Exchange wallets, liquidity pools, bridges and burn addresses all show up as large holders, and none of them are a threat. What matters is supply that traces back to the team. A launch spread across thousands of small holders is a very different risk from a token where the deployer still sits on 40 percent of the coins.

Run a test sell to catch a honeypot

A honeypot is a token you can buy but cannot sell. The contract keeps buying open so the chart looks alive, then blocks every exit, and your money sits trapped while the deployer keeps the pool. Picture a shop that takes your cash at the door and bolts it behind you. Buys go through. Sells do not.

Security firm Dedaub, which audits smart contracts, lists the usual tricks: a hidden rule that only lets the deployer sell, an automatic blacklist that flags every buyer, or a sell tax quietly set to 100 percent. You do not need to read bytecode to catch most of them. Run the token through a scanner such as Honeypot.is, GoPlus or Token Sniffer, which simulate a real sell against the live pool. If that simulated sell fails or returns almost nothing, walk away. One warning from Dedaub is worth repeating. A deployer can toggle these settings after launch, so a clean result today can turn into a trap tomorrow, which is why you re-check right before you trade.

Do not lean on the chart to judge any of this. Price, trading volume and holder count can all be inflated, and because a honeypot lets buys succeed, it often looks busy and healthy right up to the second you try to leave. The sell test is the one that cannot be faked, because it either returns your money or it does not.

What a passing scan does not tell you

A green result from a scanner is a research aid, not a guarantee. Trust Wallet makes the point plainly in its guide: do not assume an audit, a liquidity lock or a security score makes a token safe. Scanners read the contract as it stands right now. They cannot see a team that waits a month, earns some trust, then pulls the pool. They cannot read intent.

An audit is worth understanding on its own terms. It checks the code for known bugs at one point in time. It does not vouch for the people, and it does not promise they will behave. For what an audit does and does not cover, read our guide to a smart contract audit. And if you have already approved a token's contract to spend from your wallet, learn how to revoke those token approvals, because a stale approval is how a lot of drainers get back in.

Before you buy

No check can prove a token is safe. What these five checks do is strip out the avoidable traps: the honeypot you could never sell, the pool that was never locked, the supply sitting in one hand. A token can also pass every one of them today and be rugged next month, so size any position as money you are willing to lose outright. Run the checks every time, even when a token is trending and the urgency feels real. Urgency is the oldest tool a scammer owns.

Keep the amount small on anything new. Use a separate wallet for risky tokens so one bad approval cannot reach your main holdings. And treat a loud community, a polished website and a big follower count as marketing, because that is what they are. The checks look at the code and the money. Those two lie far less often than people do.