This guide is general education about checking tokens, not financial or legal advice. Scanners and explorers change their features, and no check makes a new token safe. Never put in more than you can afford to lose.

If you buy new tokens on decentralised exchanges, or you are thinking about it because one has already gone up tenfold, this guide is for you. By the end you will know how a honeypot traps buyers, the seven checks we run before buying anything new, which free tools do the heavy lifting, and which results mean walk away.

What is a honeypot crypto scam?

A honeypot crypto scam is a token whose smart contract lets anyone buy it but stops ordinary holders from selling. The buy works, the price chart climbs, and the moment you try to sell the transaction fails or the contract keeps almost everything. Only the deployer and a few wallets they control can sell, and they sell into the money you brought.

The name comes from the honey that draws the bee in. Here the honey is a chart that only goes up. Because nobody outside the scam can sell, there is no selling pressure, so the price rises in a near-straight line and draws in more buyers who think they have found something early. We have watched this pattern repeat in every cycle since DeFi took off in 2020, and the tooling to deploy these tokens has only got cheaper. CertiK documented one wallet that funded 979 separate honeypot tokens between late August and the end of October 2023, at times one every 30 minutes, in its analysis of honeypot scams.

A honeypot is a cousin of the rug pull, which we cover in our guide to avoiding crypto scams. In a rug pull the team drains the liquidity and the price collapses for everyone. In a honeypot the price can look healthy right up to the end, because the trap is in what you are allowed to do, not in what the chart shows.

How does a honeypot token stop you selling?

The trap sits in the token's transfer function, the code that runs every time tokens move. When you buy, tokens move from the liquidity pool to you, and the code lets that through. When you sell, tokens move from you to the pool, and the code checks a condition you cannot meet. The common versions are:

  • A blacklist or whitelist. Every new buyer is quietly added to a list that cannot sell, or only a whitelist of insider wallets can. CertiK notes the check is often hidden behind a harmless-sounding function name.
  • A sell tax the owner controls. The buy tax is low and the sell tax can be set to 100%, so a sale goes through but returns nothing. GoPlus flags contracts where the tax can be changed, and where a different tax can be set for each address.
  • Pauses, cooldowns and sell limits. The owner can pause transfers, force a long wait between trades, or set a minimum sell size that is always larger than your balance.
  • Hidden control. Ownership that looks renounced but can be taken back, owner functions that can edit any holder's balance, or a proxy contract whose underlying code can be swapped after launch.
Five-step flow of a honeypot token: the buy succeeds, other buyers push the price up because nobody can sell, the buyer tries to sell, the sell reverts or is taxed away, and the exempt owner sells into the pool. Four cards cover blacklists, 100% sell taxes, pauses and hidden owner control.

Nothing looks wrong until the sell. Real honeypots often combine several of these mechanisms, which is why one clean check is never enough.

Older research uses the word differently. The 2019 USENIX Security paper "The Art of The Scam" studied contracts that pretend to leak funds to anyone who tries to exploit them, and then trap the exploiter's deposit. That is a different trick aimed at would-be hackers. The token honeypots in this guide are aimed at ordinary buyers.

What does a honeypot look like before you buy?

Most of the warning signs are visible to anyone who looks for five minutes, which is exactly why the marketing works so hard to stop you looking. Watch for:

  • A chart that rises almost vertically with no meaningful red candles.
  • Hundreds of buy transactions in the pool and hardly any sells from ordinary wallets.
  • A token you heard about from a Telegram group, an X reply or a direct message, often with a countdown or "last chance" message. Our guide to crypto scams on Telegram covers the fake groups that push these.
  • A name that borrows from a trending story, a celebrity or a well-known project, with a contract address that does not appear on that project's own site.
  • Contract code that is not published on the block explorer, or is published behind a proxy.

The best-known example is the SQUID token, named after the Netflix series, in 2021. It rose about 35,000% in three days while buyers reported they could not sell it on PancakeSwap, and CoinMarketCap posted a warning to that effect. Days later it fell about 99.99% after an address sold its tokens for millions of dollars of BNB, and the developers said they had left the project, as CoinDesk reported. Every warning sign on this list was there in plain sight.

How to detect a honeypot scam in seven checks

Run these in order. Any single red flag is enough to walk away; passing all seven lowers the risk but does not remove it. On a chain you know, it takes about ten minutes.

  1. Get the contract address from the source. Copy it from the project's own website or official documentation, then confirm the same address appears on CoinGecko or CoinMarketCap. Scammers deploy tokens with the same name and ticker as real ones, so the name tells you nothing. If you cannot find an official address, stop.
  2. Confirm the code is verified. Search the address on the chain's explorer, such as Etherscan, BscScan or Basescan, and open the Contract tab. Verified source code is readable there. If the code is unverified, or the contract is a proxy pointing to code you cannot read, you cannot know what the sell function does.
  3. Simulate a buy and a sell. Paste the address into Honeypot.is or a scanner built on GoPlus data. Honeypot.is simulates a purchase and a sale against the live contract, and GoPlus-based scanners flag whether the token can be sold, and both report the taxes. A failed sell, or a sell tax far above the buy tax, is a fail.
  4. Read the owner's powers. Scanners list them: blacklist or whitelist functions, a pause switch, adjustable taxes, minting, a hidden owner or ownership that can be reclaimed. Any owner power that can stop you selling is a fail, even if it is switched off today.
  5. Look at the holders. The explorer's Holders tab shows how supply is spread. The liquidity pool and a burn address are normal top holders. A handful of other wallets holding most of the supply means a few people can crash the price whenever they like.
  6. Check the liquidity and the lock. Thin liquidity means even a working sell barely moves you out. If the team claims the liquidity is locked, check the lock on the locker's own site, not a screenshot. Liquidity tokens held in a locker such as UNCX cannot be withdrawn until the lock expires, so check how soon that is.
  7. Watch real sells happen. Open the pool's recent trades on the explorer or a DEX screener and look for sells by ordinary wallets that succeeded at a normal tax. A long list of buys with almost no sells is the honeypot signature.
Checklist of seven token checks in order: contract address from the project's own source, verified code, a simulated buy and sell, the owner's powers, holder concentration, liquidity and its lock, and real sells by ordinary wallets. Each card names the red flag.

Our checking order. Each step names where to look and what result means walk away. The test-buy advice at the bottom is the last line of defence, not the first.

For a token that passes, we still buy a small amount first from a separate wallet and sell part of it straight away. A sell that works on your own wallet is the only result you can fully trust, and it costs a few dollars of fees. Our DYOR framework covers the slower research on the team, the token supply and the roadmap that should come after these checks.

How do you verify a token is legitimate?

You verify a token's legitimacy by tying the contract address to the people who claim to run it, then checking that the contract does what they say. A real project publishes its contract address on its own website and documentation, and the same address appears on the major data aggregators and in the explorer's token profile. The code is verified and readable. Supply is spread beyond the team, liquidity is deep, and ordinary holders buy and sell every day.

Legitimate is not the same as a good investment. Plenty of tokens pass every check here and still go to zero because nobody needs them. Reading how a token's supply and incentives work, and understanding who is likely to be selling to you, which our guide to exit liquidity covers, is the second half of the job. If you want a second opinion on a specific contract or message before you act, members can paste it into Ask Crypto.

Which free tools can check a token?

ToolWhat it doesWatch out for
Honeypot.isSimulates a buy and a sell against the live contract and reports the result and the taxes. Lists Ethereum, BNB Smart Chain and Base.Its own site says it is not foolproof: a token that passes now can change later.
GoPlus SecurityToken security data used by many wallets and scanners: honeypot status, sell tax, blacklist, pause, proxy, hidden owner and more. Field definitions are in the GoPlus documentation.Results are automated flags, not a verdict. Read what each flag means.
Block explorers (Etherscan, BscScan, Basescan)Show whether the code is verified, the owner and admin functions, the holder list and every transfer.A proxy needs the "Read as Proxy" view to see the code that actually runs.
DEX screenersPool liquidity, recent buys and sells, and summary audit panels.Scores summarise other data and can lag a contract change.
Token Sniffer, De.Fi ScannerAutomated scores and pass or fail checks across many chains.A high score does not prove a token is safe.
Revoke.cash, Etherscan Token Approval CheckerShow and revoke the spending approvals your wallet has granted.Use after any test buy, so the token contract keeps no access to your wallet.

No tool reads intent. A clever contract can pass an automated scan by enabling its trap only after enough money arrives, which is why the owner-powers check matters more than any score.

What should you do if you bought a honeypot?

Stop adding money. Tokens you cannot sell are, for practical purposes, gone, and the most common follow-up is a second scam: someone in the group or your messages offering a tool, a fee to "release" the tokens or a recovery service for a fee. Every one of those is the same people, or new ones, taking a second bite.

  1. Revoke the approval. If you approved the token or a router to spend anything from your wallet, revoke it with Revoke.cash or the explorer's approval checker. Our guide to token approval phishing explains why that matters.
  2. Move remaining funds if you signed anything unusual. If you connected to a site you are now unsure of, send what is left to a wallet whose seed phrase has never been exposed.
  3. Record the evidence. Save the contract address, your transaction hashes, the website and the group where it was promoted.
  4. Report it. Report to your national fraud or cybercrime agency, such as the FBI's IC3 in the US or Action Fraud in the UK, and to the scanners and the explorer so the next buyer sees a warning.

Expect the money to stay lost. Promises can be made in writing and still be false: in January 2025 the US SEC charged a token founder who told buyers the liquidity was locked when it was not, and who then withdrew it, according to the SEC's litigation release. Enforcement cases like that are rare and slow, and they do not usually return funds to buyers.

Is it ever worth buying brand-new tokens?

For most of our readers, no. New tokens on decentralised exchanges are where honeypots, rug pulls and pump-and-dump schemes concentrate, and the odds are set by people who write the contracts. If you do it anyway, treat it as entertainment money in a separate wallet, run every check above, and never buy anything you heard about from a stranger. Reading the chain yourself, which our on-chain analysis guide teaches, is the skill that protects you long after any single scanner goes out of date. More guides like this one sit in the Scams and Risk hub.

Frequently asked questions

What is a honeypot in crypto?

A honeypot is a token whose smart contract allows buying but blocks or confiscates selling for ordinary holders. It usually works through a blacklist, a sell tax the owner can raise to 100%, a pause switch or hidden owner control. Because nobody else can sell, the chart only rises and attracts more buyers, until the deployer sells into the pool and leaves.

How can I tell if a token is a honeypot?

Paste the contract address into a scanner such as Honeypot.is, which simulates a buy and a sell, and check whether the sell succeeds at a normal tax. Then read the owner's powers, look for blacklist, pause or adjustable tax functions, and check the pool's recent trades for successful sells by ordinary wallets. Any owner power that can stop selling is a fail.

Can a token pass a honeypot check and still be a scam?

Yes. Scanners test the contract as it is at that moment. If the owner can change taxes, add wallets to a blacklist or upgrade the code behind a proxy, the token can pass today and trap buyers tomorrow. It can also be a rug pull or a pump and dump with a perfectly normal sell function. Passing a scan is the minimum, not proof of safety.

How do I verify a token's contract address?

Copy the address from the project's own website or official documentation, never from a chat, a reply or a search ad. Confirm the same address is listed on CoinGecko or CoinMarketCap and that the explorer's token page shows verified code. Scammers copy names and tickers freely, so the address is the only identifier that counts.

Can you get money back from a honeypot token?

Almost never. The tokens cannot be sold, and the funds you paid went into a pool the deployer drains. Report it to your national fraud agency and the scanners, revoke any approvals, and ignore anyone offering to release or recover the tokens for a fee, because those offers are a second scam aimed at people who have just lost money.

Is a locked liquidity pool proof a token is safe?

No. A genuine lock only stops the team withdrawing the pool's liquidity until the lock expires. It does nothing about code that blocks you from selling, and lock claims can be false: check the lock on the locker's own site. A honeypot can have locked liquidity and still trap every buyer, because the trap is in the token contract, not the pool.

Keep learning