How to Check if a Crypto Token Is Safe: The Complete Security Checklist
A safe crypto token is one whose contract cannot trap your funds, whose supply cannot be secretly inflated, and whose liquidity cannot be pulled out from under you. Checking for these three things takes under a minute with the right tool — this guide walks through exactly what to check, why each check matters, and what no automated scanner can tell you.
The 60-second version
Paste the token's contract address into the free RugShield scanner. It runs the checks below automatically against live on-chain data and gives you a trust score. Read on to understand what that score is actually measuring — a passing scan is a strong signal, not a guarantee.
What the scanner checks automatically
These are real, on-chain, machine-verifiable facts. RugShield checks all of them every time you run a scan.
Can the contract trap your money?
The single most important check: can you sell what you buy? A honeypot token allows buying but blocks selling through hidden logic in the contract — by the time you notice, your funds are stuck. Related to this are buy and sell taxes: even a token that technically lets you sell can tax you 40-90% on the way out, which functions the same as a honeypot in practice.
Can the supply be secretly inflated?
If the deployer retains an active mint function, they can create new tokens at will and dump them on the market, collapsing the price. The fix a legitimate project makes is renouncing that ability — but renounced ownership isn't automatically safe either: check what was actually given up, since some "renounce" functions are cosmetic.
Two related contract risks worth checking: whether the contract has a pause or blacklist function that can freeze specific wallets from transferring, and whether it's built as a proxy contract — meaning the logic itself can be swapped out after launch, silently changing the rules you agreed to when you bought in.
Can the liquidity disappear?
Liquidity is what lets you actually sell your tokens for real money. Check whether it's genuinely locked — and for how long — versus sitting in a wallet the deployer can drain at any moment. Liquidity removal is one of the most common rug-pull mechanics: the price chart looks healthy right up until the pool is emptied in one transaction.
Is ownership concentrated in a few wallets?
If a handful of wallets hold most of the supply, they can crash the price the moment they decide to sell — regardless of how clean the contract code is. Learning to read holder concentration tells you how exposed you are to a small group of early holders acting in their own interest.
Is the source code even verifiable?
An unverified contract means nobody outside the deployer can confirm what the code actually does. This alone doesn't prove malice, but it removes your ability to check anything else on this list independently — treat it as a reason to be more cautious with everything else.
What no automated scanner can tell you
These risks don't show up as a single yes/no flag in on-chain data — they require reading the situation, not just the contract. A clean scan doesn't rule any of these out.
Trading pattern manipulation. Wash trading inflates volume to make a dead token look active. Sniper bots and MEV bots front-run ordinary buyers in ways that don't appear as a contract risk but directly cost you money on every trade.
Wallet-level tricks. Wallet clustering and bundled wallets let a single actor make holder distribution look decentralized when it isn't — the top-10-holders number can be technically accurate and still misleading. Deployer wallet analysis — checking what else that wallet has launched — is one of the fastest ways to spot a serial rug-puller before they repeat the pattern.
Reading the data correctly. Knowing how to read a holder distribution table properly, and understanding the specific dynamics of tokens launched via pump.fun-style launchpads or with Solana's freeze and mint authority model, all change how you should weight everything above.
The verdict is the worse of the two
A token that passes every contract check can still be a bad trade — see our full methodology for how RugShield separates contract security from speculative risk, and why the honest verdict is always the worse of the two, never an average.
Run it now
Paste any EVM or Solana contract address into the free RugShield scanner — no wallet connection required, results in seconds.
Frequently Asked Questions
- How do I check if a token is a scam before buying?
- Run its contract address through a free scanner like RugShield to check for honeypot behavior, active mint functions, unlocked liquidity, and holder concentration — the checks covered in this guide. A clean result is a strong signal, but also check trading volume for wash-trading patterns manually, since no scanner can catch every manipulation tactic.
- What is the biggest red flag when checking a new token?
- A honeypot signal — where the contract allows buying but blocks selling — is the single most damaging risk, since it can trap 100% of your funds instantly. An active mint function and fully unlocked liquidity are the next most serious, since both let the deployer damage the token's value at will.
- Is a token safe just because ownership is renounced?
- Not automatically. Renouncing ownership should remove the deployer's ability to mint, freeze, or edit taxes, but some contracts renounce cosmetically while retaining those powers through other functions. Always verify what renouncing actually disabled, not just that it happened.
- Can a token be safe on paper but still lose money?
- Yes. A token can pass every contract security check and still be a bad trade due to thin liquidity, concentrated holders, or being a purely speculative new launch. Contract security and market risk are separate questions — a real answer needs both, not just one.