What to do after a rug pull: a step-by-step checklist

If you just realized you've been rugged, here is what to do, in order: stop any further losses first (revoke token approvals and move remaining funds if your wallet may be compromised), don't send anyone more money, then save every piece of evidence before the project team deletes it. After that, write down your transaction hashes, report the scam to the authorities, ignore anyone who contacts you offering to recover your funds, and find the other people who lost money on the same project.

The order matters. Some steps are only useful in the first few hours, and some mistakes (like paying a fake recovery service) can turn one loss into two. This checklist is split into the first hours, the first days, and the first weeks, so you can work through it even if you're still in shock. Nothing here guarantees you'll get money back, and anyone who says otherwise should make you more careful, not less.

First hours: stop the bleeding

Your first job is not to figure out what happened. It's to make sure nothing else leaves your wallet. A rug pull on its own usually just means the token you hold is now worth close to nothing. But some scams also involve malicious contracts, fake claim sites, or drainer links, and those can keep taking funds after the initial loss.

Revoke token approvals

When you buy or trade a token on a decentralized exchange, you usually sign an approval that lets a smart contract spend a specific token from your wallet. Many interfaces request unlimited approvals by default. If you approved a contract controlled by the scammers, or interacted with a suspicious site connected to the project, that approval may still be live.

You can review and cancel approvals with a tool like Revoke.cash or the Etherscan Token Approval Checker for Ethereum. Similar checkers exist on other block explorers for other chains. Connect or paste in your wallet address, look for approvals to contracts you don't recognize or that belong to the rugged project, and revoke them.

• Revoking is an on-chain transaction, so it costs a small network fee.
• Revoking stops future spending. It does not reverse anything that already happened.
• Only use tools you navigated to yourself. Scammers set up lookalike 'revoke' and 'claim' sites and promote them in the same channels where the rug happened.

Move remaining funds if your wallet may be compromised

Ask yourself honestly: did you ever type your seed phrase or private key into a website, form, bot, or 'support' chat? Did you sign a transaction you didn't understand, or download something the project asked you to install? If the answer to any of these is yes, or you're not sure, treat the wallet as compromised.

In that case, create a brand-new wallet with a new seed phrase (not a new account inside the same wallet, which shares the same seed) and move any remaining assets there. Revoking approvals will not protect a wallet whose seed phrase is already in someone else's hands. Keep the old wallet address written down: it's evidence, and you'll need it for reports.

If your funds are simply sitting in a token that crashed and your keys were never exposed, you don't need to move anything. Don't panic-sell into a drained pool either; in a liquidity pull there is often nothing left to sell into, and in a honeypot contract your sell may fail and cost you another fee.

Do not send more money

This sounds obvious, but it's the step people get wrong most often under stress. After a rug, you may see messages saying liquidity will be 'restored' if holders pay a fee, that a 'migration' to a new contract requires sending tokens, or that the team needs a deposit to unlock withdrawals. These are almost always a second round of the same scam.

First hours: capture the evidence before it disappears

Rug-pull teams tend to delete their Telegram groups, take websites offline, and wipe social accounts quickly. The blockchain record is permanent, but the promises that make a rug pull a fraud (claims of locked liquidity, audits, a doxxed team, a roadmap) live on platforms the scammers control. Save those first.

• Screenshots of the project's Telegram or Discord, especially pinned messages, admin lists, and anything about liquidity locks, audits, or team identity.
• The project website, whitepaper, and tokenomics page, saved as full-page screenshots or with your browser's 'print to PDF'.
• X/Twitter posts and profiles from the project and any influencers who promoted it, with the URL and date visible.
• Any direct messages you had with team members, moderators, or promoters.
• The token's contract address and the chart page you bought from (for example, a DEX screener page).

If a page is still up, the Internet Archive's Wayback Machine lets you save a public snapshot that others can verify later. We cover this step in detail, with a full checklist, in Preserve your evidence before it's gone.

First day: record your transactions

Your transaction hashes are the backbone of any report or claim. A transaction hash (also called a TX ID) is the unique identifier for a single transaction on a blockchain. Unlike screenshots, hashes can't be deleted by the project team, and anyone can look them up on a block explorer such as Etherscan, Solscan, or BscScan.

Make a simple document or spreadsheet with one row per transaction:

1. The date and time (note your time zone).
2. Your wallet address and the address or contract on the other side.
3. The chain (Ethereum, Solana, Base, BNB Chain, and so on).
4. What you sent and received, with amounts, for example 1.2 ETH for 4,000,000 tokens.
5. The transaction hash.
6. What you paid in U.S. dollars (or your local currency) at the time, if you know it.

Include every related transaction, not just the purchase: funding the wallet from an exchange, any failed sell attempts, fees paid, and anything that left your wallet unexpectedly. Failed sells matter more than people think. In a honeypot case, a pattern of failed sells across many victims' wallets is strong evidence of how the contract was designed.

If you bought through a centralized exchange first, download your account statements too. They show where the money came from and when, which is useful both for reports and for your taxes later.

First days: report the scam to the authorities

Reporting won't produce a refund on its own, and it's realistic to expect that you may not hear back about your individual complaint. It's still worth doing. Reports help agencies connect cases, spot patterns across many victims, and prioritize investigations, and having a filed report can matter later for legal or tax purposes.

In the United States, the main places to report are:

• The FBI's Internet Crime Complaint Center at ic3.gov. The FBI's guidance for cryptocurrency scam victims asks for wallet addresses, the amount and type of crypto, and the date, time, and transaction hash of each transaction.
• The Federal Trade Commission at ReportFraud.ftc.gov.
• The SEC through its tips and complaints portal, if the token was marketed as an investment, and the CFTC through its complaint page.
• Your state attorney general's consumer protection office.
• The exchange you used to fund your wallet, and any exchange where you can see the stolen funds landing. Exchanges sometimes freeze deposits linked to fraud when they're flagged quickly.

Outside the U.S., report to your national police or fraud reporting service. Wherever you are, file even if your information is incomplete: the FBI's guidance says to submit what you have. For a walkthrough of each form and what to put in it, see How to report a crypto scam.

First days: watch out for recovery scammers

Once you've lost money, you become a target. People who post about a rug pull in public channels are often contacted within hours by 'recovery experts,' 'blockchain investigators,' 'ethical hackers,' or law firms offering to get the money back for an upfront fee. Many of them are scammers working from the same playbook as the original rug.

The FBI has issued repeated warnings about this. In 2024 and again in 2025, it warned that fraudsters posing as lawyers from fictitious law firms were contacting crypto scam victims, sometimes claiming to work with the FBI or other government agencies. In 2026 it warned that criminals are impersonating the IC3 itself, and stated that IC3 will never contact individuals directly by phone, email, or social media, and will never ask for payment to recover lost funds.

Red flags that someone is running a recovery scam:

• They contacted you first, especially through DMs or comments after you posted about your loss.
• They guarantee recovery, or give you a specific percentage they'll get back.
• They want an upfront fee, a 'tax,' or a 'release fee,' especially in crypto or gift cards.
• They ask for your seed phrase, private key, or remote access to your computer.
• They claim to be working with the FBI, a regulator, or a court, or say they've already found your funds.

Legitimate lawyers can be verified through your state bar's public directory, and they don't need your keys. We wrote a longer guide on spotting these schemes: Crypto recovery scams.

First weeks: find the other victims

A rug pull almost never has one victim. Hundreds or thousands of wallets may have bought the same token. That matters practically: the evidence from one person is a story, while the evidence from many people is a pattern. Many holders' failed sells, the same promises screenshotted by many people, and a clear timeline of the team's wallet activity add up to a much stronger picture than any one person can build alone.

Places people usually find each other include replacement Telegram groups started by holders (not by the team), threads on X or Reddit about the project, and on-chain analysis showing other buyers' wallets. Be careful in these spaces. They are exactly where recovery scammers go looking for targets, so don't share your seed phrase, don't click claim links, and don't pay anyone who shows up offering help.

When you compare notes, share evidence rather than just anger: screenshots others may have missed, the contract address, the wallet that pulled liquidity, and the dates the team made specific promises.

First weeks: consider collective action

Individual lawsuits over a single meme-coin loss are rarely practical. Forensic wallet tracing, legal research, and court filings cost real money, often more than one person lost. Grouping victims of the same project into a single case changes that math, because the cost is shared and the evidence is pooled.

Whether any case can lead to recovery depends on things no one controls at the start: whether the people behind the project can be identified, whether funds reached an exchange or other place where they can be traced or frozen, which jurisdictions are involved, and what assets exist to recover. Some cases produce nothing. A qualified lawyer can tell you what applies in your situation.

That's the model Recoup is built around. We're not a law firm. We document losses, preserve evidence, group victims of the same project into a collective case, and fund the work of affiliated independent counsel. You can read how it works, or start a case if you'd like your loss documented alongside others from the same project. Recovery is never guaranteed.

First weeks and beyond: keep records for taxes

A rug pull can affect your taxes, and the rules depend on your country, your situation, and how the loss is characterized. We can't give tax advice, but the recordkeeping side is the same either way: save everything.

The IRS says that people with digital asset transactions should keep records documenting each purchase, receipt, sale, exchange, or other disposition, along with fair market values in U.S. dollars where relevant. The transaction log you built earlier covers most of this. Add to it:

• Exchange statements showing when and how you funded the wallet.
• Copies of your reports to the IC3, FTC, or other agencies, with dates and any reference numbers.
• Evidence showing when the token became worthless or unsellable, such as the liquidity withdrawal transaction and screenshots of the chart.
• Any records of later recoveries or payouts, if any ever happen.

Bring these to a qualified tax professional who is familiar with digital assets. How a scam or theft loss is treated, and whether it can be deducted at all, is a question for them, not for a blog post.

The short version

1. Revoke suspicious token approvals.
2. If your seed phrase or keys may be exposed, move remaining funds to a new wallet with a new seed phrase.
3. Don't send anyone more money or share your seed phrase.
4. Screenshot and archive the project's channels, website, and posts right away.
5. Log every transaction hash, with dates, amounts, and addresses.
6. Report to IC3, the FTC, and other relevant agencies and exchanges.
7. Ignore unsolicited recovery offers.
8. Connect with other victims and consider a collective case.
9. Keep all records and talk to a tax professional.

You don't have to finish all of this today. The only truly urgent steps are the first few: securing what you still have and saving what could disappear. Everything else can be done over the coming days and weeks.