Pump and Dump vs Rug Pull: How These Crypto Exit Scams Surface in Screening and Monitoring

Compliance teams at exchanges and virtual asset service providers (VASPs) rarely learn about a pump-and-dump scheme or a rug-pull scam from the victim. They find out when the proceeds land in a wallet their platform touches.

Both are exit scams, which means the scammer’s profit depends on someone else absorbing the loss, a concept traders call exit liquidity. Retail buyers become that liquidity the moment they buy into a chart that is already engineered to sell into.

The two typologies are grouped together for that reason. However, the mechanics and on-chain footprints each one leaves are different enough that a monitoring program built for one will miss the other.

The extent of this challenge is rapidly increasing. According to independent research, nearly every token launched on a coin-making platform, i.e., Pump.fun, from January 2024 until March 2025 showed the clear signs of rug pulls or pump-and-dump schemes. Meanwhile, the IC3 has reported a staggering $9.3 billion in losses from crypto-related fraud throughout 2024.

This piece breaks down how pump-and-dump crypto schemes differ from rug pulls, why they cost VASPs more than they cost individual victims, and where each typology actually surfaces in wallet screening alongside continuous transaction monitoring.

Why Crypto Exit Scams Are an Industry-Wide Problem

Losses stemming from a rug pull or pump-and-dump scheme extend far beyond the investors who lose money. The more scam tokens that go through an exchange or payment mechanism, the more red flags are raised about transaction activity. This, naturally, encourages compliance analysts to investigate to find out what is going on. This is also true if the platform itself did not participate in the fraud.

When digital asset activity is highly volatile and analysts have only a partial view of a token’s on-chain history, distinguishing between illicit proceeds and legitimate activity can be challenging. The frequent occurrence of scams can also tarnish an exchange’s reputation and lead to heightened scrutiny from regulators.

After funds are raised from a fraudulent project, they are usually divided among various wallets. It passes through decentralized exchanges, cross-chain bridges, or cryptocurrency mixers, and finally reaches regulated institutions.

When investor fraud is suspected, it leads to an anti-money laundering investigation. Compliance teams are tasked with identifying criminal proceeds, reviewing any questionable activity, and reporting obligations. They also must perform to ensure that real customer transactions are not significantly affected.

What Is a Pump and Dump Scheme?

Pump-and-dump is a form of market manipulation in which a group artificially inflates the price of a low-value coin. They then hike up the price by collaborating on purchases and using wash trading, while also running campaigns on Telegram, Discord, and other platforms, as well as with influencers.

When retail buyers come on board, and the chart looks promising, the group sells to that demand, and the price drops. The token itself usually stays tradable after the crash. What’s gone is the money new buyers paid at the inflated price.

South Korea’s Financial Services Commission brought its first case under the Virtual Asset User Protection Act in early January 2025, following this pattern: a trader placed repeated buy orders to inflate price and transaction volume before selling the artificially built position.

The case demonstrates that regulators are treating coordinated crypto price manipulation much the same as manipulation in conventional financial markets.

What Is a Crypto Rug Pull?

A rug pull scam works from the inside. Developers or project insiders build (or fake) a legitimate-looking token, then remove the value that made it usable, most often by draining the project’s liquidity reserves that let people buy and sell. Variants include honeypot contracts that enable buyers to acquire but prevent them from selling, as well as “soft” rug pulls in which insiders gradually dispose of their holdings while continuing to promote the project. Unlike a pump-and-dump, the token can become worthless or literally unsellable, and the people responsible are the project’s own team rather than outside traders.

Research found that 93% of liquidity pools on Solana’s Raydium showed signs of rug pulls or pump-and-dump activity, with a median rug-pull value of roughly $2,800, suggesting that most of today’s activity is high-volume, low-dollar fraud rather than the occasional headline case.

How These Cryptocurrency Scams Surface in Screening and Monitoring

Neither scam depends on a compliance team spotting the scheme while it’s running. What matters is catching the proceeds once they touch a regulated entity, and that happens through a handful of recurring signals.

Tokenomics and Concentrated Ownership

A small number of wallets, often the deployer and a handful of connected addresses, holding a disproportionate share of a token’s supply, is one of the clearest rug pull indicators. Insider allocations without a vesting or unlock schedule may release a large volume of tokens into the market in a single transaction, with no warning.

Liquidity Lock Status and Smart Contract Permissions

Legitimate projects lock liquidity for a defined period through a third-party contract. A rug pull frequently hides behind a partial liquidity lock that covers part of the pool, or a contract that retains minting, pausing, or blacklisting permissions the team never disclosed. These permissions are visible on-chain before a single transaction moves.

Wallet Clustering and Linked Ownership

Deploying wallets that fund each other before launch, or a cluster of “early buyer” wallets with no independent transaction history, points to coordinated insider activity rather than organic demand. Effective crypto wallet screening flags concentrated ownership and links between deployer wallets and previously reported scam addresses.

Large Liquidity Withdrawals

A liquidity pull typically shows up as a single large withdrawal from a DEX pool, followed by swift routing across several wallets. Transaction monitoring tuned to this pattern, rather than generic large-value thresholds, catches the drain before funds fully off-ramp.

Coordinated Deposit Timing and Mixer Exposure

Pump-and-dump money usually comes to an exchange in a bunch just after a price surge, frequently using a privacy instrument or bridge first to conceal the transaction. Wallets that have been used with a mixer in the past need to be monitored more carefully, regardless of the label the token they hold has.

Community Reporting and Adverse Media

Rug pulls and manipulated tokens are frequently flagged in real time by blockchain analytics firms, blockchain investigators, and reputable crypto news outlets, well before formal enforcement. Adverse media screening that ingests this kind of reporting closes the gap between community detection and formal action by financial institutions.

Legitimate meme coins often share characteristics with scam tokens, making manual reviews difficult to scale. Risk-based prioritization helps compliance teams to reduce false positives and focus investigations on genuinely suspicious activity.

Why Regulators Expect VASPs to Catch This

Regulators increasingly expect VASPs to detect and report potentially suspicious crypto fraud, even when they are not involved in the scheme. In the US, the DOJ’s April 2025 memo kept rug pulls and investor-harm fraud as prosecution priorities. The CDD and SAR rules require covered VASPs to report transactions that the VASP knows, suspects, or has reason to suspect are connected to fraud or other illegal activity, including rug pull scams and pump-and-dump schemes. The SEC and CFTC are attempting to prosecute the underlying conduct for either securities fraud or commodities fraud, depending on the nature of the token.

In addition, MiCA does not explicitly mention pump-and-dump schemes, though it does require service providers on EU trading platforms to identify and report suspected market abuse. The obligations for AML monitoring and reporting are similar across the UK’s FCA, Singapore’s MAS, and Australia’s AUSTRAC, while the FATF requirements for originator and beneficiary data also mandate that VASPs provide such data when transactions qualify for reporting.

How Compliance Teams Detect Pump and Dump and Rug Pull Activity

Detecting pump-and-dump and rug-pull activity requires a layered, risk-based compliance program rather than a single control. During onboarding, exposure to high-risk token categories should be taken into account, and enhanced due diligence should be applied if repeated activity involving newly launched or unaudited tokens is detected.

A constant screen of deployer wallets, scam wallets, and wallets exposed to mixers should be performed. These controls facilitate the identification of links between wallets, the identification of deployer networks, and the review of patterns of fund flow. All of which increases the likelihood of detecting suspicious transactions before funds are deposited into regulated institutions.

Transaction monitoring should not rely solely on transaction value but also on typology-specific indicators, such as coordinated deposits, concentrated outflows, and mixer routing.

Ongoing sanctions and adverse media screening, supported by documented investigation along with the clear escalation processes, help compliance teams respond consistently as new risks emerge.

How AML Watcher Helps Detect These Typologies

Pump-and-dump schemes and rug pulls do not end when investors lose money. The money usually flows through regulated institutions, which means compliance teams must identify suspicious wallets, review alerts, and meet reporting requirements.

AML Watcher’s crypto wallet screening detects unsafe exposure to mixer services, scam wallets, darknet markets, sanctioned entities, and hundreds of other types of blockchain risks before the money ever enters the customer’s wallet. Using customizable monitoring rules, transaction monitoring looks for patterns associated with coordinated deposits, rapid liquidity withdrawals, layering, and other crypto AML typologies.