Curriculum·J306 Smart Contract Risk for Non-Developers·about 33 min
The rug taxonomy
By the end of this lesson you can
- →Classify an exit scam by the mechanism that executes it, not by the story around it
- →Map which categories the J306-01 and J306-02 checks catch, and which they miss
- →Compute the base rate you are drawing from when evaluating new tokens
- →Treat a liquidity lock expiry as a dated deadline rather than as a safety property
Junior · enrolled learners
This lesson opens with The base rate, measured.
- What happened
- This is a population finding rather than a single incident, and it is labeled as such. Chainalysis reported that in 2021 rug pulls took in more than $2.8B, 37 percent of the more than $7.7B of cryptocurrency scam revenue that year, against 1 percent in 2020. Nearly 90 percent of that rug pull value was a single case, Thodex, a Turkish centralized exchange whose chief executive disappeared; every other rug pull it counted began as a DeFi project. A later Chainalysis report counted 2,063,519 tokens launched during 2024 and found that 74,037 of them, 3.59 percent, displayed patterns that may be linked to pump and dump schemes, and that about 94 percent of the DEX pools involved appear to have been rugged by the address that created the pool.
- The decision point
- The rate is a floor rather than an estimate, because it counts only what somebody classified afterwards, and per S203-04 the schemes that were never identified are absent from the numerator while remaining in the denominator. What the figure establishes is the prior you are drawing from when you evaluate an unfamiliar token: not a rare pathology to be alert for, but roughly one identified case in every twenty-eight launches, in a population of over two million.
- Recorded loss
- $2,800,000,000
What you will be able to answer
- →What are the seven rug mechanisms?
- →Which categories do the contract checks catch?
- →What is the measured base rate?
- →What is a liquidity lock?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.chainalysis.com/blog/2021-crypto-scam-revenues/
- https://www.chainalysis.com/blog/crypto-market-manipulation-wash-trading-pump-and-dump-2025/
- https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-scams-pulled-in-28b-this-year-chainalysis
- https://web.archive.org/web/20250604121855/https://coincodex.com/article/13190/users-lost-77-billion-to-crypto-scams-in-2021-according-to-chainalysis-report/
- https://gizmodo.com/squid-game-cryptocurrency-scammers-make-off-with-2-1-m-1847972824
Confidence medium·Volatility medium·Reviewed 2026-10-22·Owner unassigned
Contested
Marked medium confidence because scam classification methodology varies between analysts and between years, and the two figures used here come from different Chainalysis reports covering different periods. The 2021 rug pull total is dominated by one centralized exchange, Thodex, at nearly 90 percent of the value, so it says little about token launches; the 2024 figure is the one about tokens. Chainalysis counts pump and dump candidates by on-chain criteria, not by any finding of intent, and a pump and dump is not identical to a rug pull, though Chainalysis found that about 94 percent of the pools involved appear to have been rugged by their creator. The 2,063,519 launches is Chainalysis's own count, and 74,037 divided by 0.0359 reproduces it to within rounding.
J308-02 owns governance as an attack surface, including vote buying, delegation concentration and treasury capture. This lesson names the governance rug as a category and defers the mechanics. Keep the split.