Honeypot Scam: Tracing the Operator When You Can't Sell (2026)

Q: What is a crypto honeypot?

A crypto honeypot is a token contract on a DEX (Uniswap, PancakeSwap, Raydium, etc.) that is engineered so buyers can purchase the token but cannot sell it back. The contract creator retains a privileged function — typically a whitelist, blacklist, transfer restriction, or massive sell tax — that prevents anyone except the operator from converting the token back to ETH, BNB, SOL, or USDT. The buyer's funds are effectively locked, and the operator drains the liquidity pool when enough victims have bought in.

Q: How do I check if a token is a honeypot before buying?

Run the contract address through a free honeypot scanner — honeypot.is for Ethereum and BSC, GoPlus Token Security API, Token Sniffer, and DEXTools' security report all simulate a sell transaction and report whether it would succeed. Combine the scanner result with manual checks: is the contract source code verified on Etherscan/BSCscan? Is liquidity locked? Has the deployer renounced ownership? Are most tokens concentrated in one or two holder addresses? Any one of these red flags is reason to walk away.

Q: Can I recover funds from a honeypot?

Almost never directly. The funds are not technically stolen in the way exchange-side fraud is stolen — they are converted to a token whose sell function has been disabled. There is no centralized counterparty to subpoena and no exchange to freeze. What a forensic investigator can do is trace the operator's wallet, identify the off-ramp where they convert the drained liquidity to fiat, and produce a report that supports law enforcement action against the operator personally. Recovery happens at the operator level, not the smart contract level.

Q: What is the difference between a honeypot and a rug pull?

A rug pull is a broader category of token scam in which the operator removes liquidity or otherwise destroys value after attracting buyers. A honeypot is a specific subtype of rug pull where the contract is engineered so buyers cannot sell from the moment of contract deployment. Classic rug pulls allow normal trading until the operator pulls liquidity; honeypots prevent victims from ever exiting in the first place. Both end the same way for the buyer — locked or worthless tokens — but the mechanism differs.

What a honeypot actually is
The buyer's experience: a walkthrough
How honeypot contracts are engineered
The six common honeypot patterns
How to spot a honeypot before buying
Real-world honeypot examples
What to do if you've been honeypotted
The forensic angle: tracing the operator
Frequently asked questions

A honeypot is a token contract on a decentralized exchange that is engineered so buyers can purchase the token but cannot sell it back. From the moment the contract is deployed, the operator has built in a function that prevents anyone except themselves from converting the token back to ETH, BNB, SOL, or USDT. The buyer's funds are effectively locked the second the buy transaction confirms, and the operator drains the liquidity pool when enough victims have bought in.

This is one of the most common scams on every major DEX in 2026 — Uniswap, PancakeSwap, Raydium, the lot. New honeypot tokens are deployed by the thousand every day, and a meaningful share of the "low-cap memecoin opportunities" trending on Telegram and X are honeypots specifically. The mechanism is fully on-chain, fully visible if you know what to look for, and entirely invisible to a buyer who doesn't know to check.

This article explains the mechanism, walks through what the buyer experiences in real time, breaks down the six smart contract patterns operators use to engineer the trap, and shows you how to detect a honeypot before you ever sign the buy transaction. It also covers what a forensic investigator can do after the fact — because while the funds are usually unrecoverable from the contract itself, the operator behind the scam often is traceable.

What a Honeypot Actually Is

A honeypot is not a hack. It is not an exploit. It is not a bug. It is a smart contract that does exactly what its author wrote it to do — the author just happened to write a contract whose sell function fails for everyone except the addresses they control.

The buyer experience and the operator experience are both on the blockchain in plain sight. There is no hidden code. There is no off-chain trickery. The contract source code, if the operator chose to verify it on Etherscan or BSCscan, will literally contain the function that blocks selling. Even if the operator did not verify the source code, a decompilation of the bytecode will reveal the same logic. The trap exists in plain view; the buyer simply did not read the contract before signing the transaction.

The Honeypot Definition

A honeypot token is a token whose smart contract permits the buy function to execute normally for any address but causes the sell function to revert (or be confiscated through a 99%+ fee) for any address that is not on the operator's whitelist. The mechanism is implemented at the contract level. There is no centralized intermediary. There is no third party who could undo it. The buyer cannot sell because the contract code is written to refuse.

The Buyer's Experience: A Walkthrough

From the buyer's side, the honeypot is invisible until the moment of attempted exit. Step by step, here is what happens:

Step 1: Discovery

The buyer encounters the token on Telegram, X, a Discord server, a Reddit memecoin thread, or via a paid promotion. The pitch is typical: "low-cap gem," "100x potential," "team is doxxed," "audit coming next week." The token has a name, a logo, sometimes a website, sometimes a Twitter account.

Step 2: Buy

The buyer goes to Uniswap, PancakeSwap, or whichever DEX the token is listed on. They paste the contract address into the swap interface, set their slippage (often the operator's marketing tells victims to set 12–15% slippage to get past the buy tax), confirm the transaction, and pay gas. The buy succeeds. The token appears in the wallet. The wallet's USD value reflects the buy price.

[FIGURE PLACEHOLDER: DEX interface showing successful buy transaction]

Step 3: The Pump

While the buyer holds the token, the on-chain price often appears to rise. This is engineered — the operator may add small amounts of liquidity, or the chart simply reflects other victims also buying. The buyer's wallet shows their position appreciating. They feel good about the trade. They may even buy more. The chart looks like this:

Honeypot token chart showing the all-green pump pattern with no sells before the operator pulls liquidity — Honeypot chart pattern · the "all-green, zero sells" signature

The "all green" chart with no sells is itself a detection signal — in a healthy token, sells happen alongside buys as holders rotate. When buys accumulate but sells are absent, the contract is preventing them.

Step 4: The Sell Attempt

The buyer decides to take some profit, or the price stops moving and they want to exit. They open the DEX swap interface, select the token to sell, set slippage, hit confirm. The transaction submits to the network. Then it reverts. They paid gas to fail.

Failed sell transaction in DEX wallet interface showing the revert when attempting to sell a honeypot token — Sell attempt rejected · the trap engages at the moment of exit

Step 5: The Realization

The buyer tries again with higher slippage. Reverts. Tries with lower amounts. Reverts. Searches "[token name] cannot sell" and finds Telegram threads of other victims discovering the same thing simultaneously. Looks at the contract on Etherscan. Sees the holder list dominated by one or two wallets. Realizes what happened.

Step 6: The Drain

Within hours or days of enough victims being trapped, the operator removes the liquidity from the pool, or sells the contract's whitelisted token holdings into the pool, draining the ETH/BNB/SOL/USDT that the victims contributed. The operator's wallet receives the proceeds. The token's chart drops to zero. The buyers' tokens become fully worthless even on paper.

Block explorer showing Remove Liquidity transactions from a honeypot operator pulling 972 million tokens from the Uniswap V2 pool — Block explorer view · the operator's "Remove Liquidity" transactions are publicly visible and timestamped

This is what makes the operator traceable even when the funds are gone. The drain transactions are permanent on-chain records. The receiving wallet is identifiable. The flow from drain wallet to off-ramp exchange is the trail a forensic investigator follows to identify the operator's KYC-linked accounts.

Total elapsed time, common scenarios

30 minutes: for low-effort honeypots that drain immediately on a tiny number of buyers. 6–48 hours: for honeypots that ride a Telegram pump and drain after 50–200 victims have bought in. Days to weeks: for sophisticated long-tail honeypots that simulate organic price action before draining.

Honeypotted? Trace the Operator.

Recovery from the contract itself is rarely possible, but the operator who deployed the honeypot is traceable. We produce forensic reports identifying off-ramp addresses and supporting law enforcement action against the operator personally.

Start a Free Case Review

How Honeypot Contracts Are Engineered

A standard ERC-20 or BEP-20 token contract has a transfer function and a transferFrom function. When you sell on Uniswap, what actually happens at the contract level is that Uniswap's router calls transferFrom on your token to move your tokens into the liquidity pool, and then transfers the corresponding ETH out of the pool to you. The honeypot operator engineers their contract so that the transferFrom call — which the DEX router uses for sells — succeeds for the operator's whitelisted addresses but reverts for everyone else.

A simplified example of the malicious logic at the contract level:

// Inside the token contract, transfer function
function _transfer(address from, address to, uint256 amount) internal {
    require(_balances[from] >= amount, "Insufficient balance");

    // The honeypot trap
    if (to == uniswapPairAddress && !_whitelist[from]) {
        revert("Transfer denied");  // The sell fails here
    }

    _balances[from] -= amount;
    _balances[to] += amount;
    emit Transfer(from, to, amount);
}

The buy direction works fine because the buyer is receiving tokens FROM the Uniswap pair address (so from == uniswapPairAddress and the condition does not trigger). The sell direction reverts because the buyer is sending tokens TO the Uniswap pair address and the buyer is not on the whitelist. From the buyer's perspective everything looks normal until the sell — the buy succeeds, the tokens land in the wallet, the wallet shows a balance.

This is one of dozens of patterns. The next section covers the most common variants.

The Six Common Honeypot Patterns

Pattern	How It Works
Whitelist gate	Sell function reverts unless the seller's address is on a whitelist that only the contract owner can update. Victims are never on the whitelist; the operator's wallets always are.
Blacklist trap	The owner has a function that adds arbitrary addresses to a sell-blocking blacklist. Buyers are quietly blacklisted at the moment of purchase, so by the time they try to sell they are already blocked.
99% sell tax	The sell function technically works, but the contract's tax logic confiscates 99% (or more) of the sold tokens to a fee-recipient address. The buyer "sells" but receives effectively nothing.
Pause function	The contract has a global pause that disables all transfers. The owner pauses transfers when victims try to sell, then unpauses to allow their own outflows.
Hidden mint	The owner can mint unlimited additional tokens to themselves and dump them into the liquidity pool, draining the ETH/USDT side. Buyers are technically not blocked from selling; their tokens are just suddenly worth nothing because supply was diluted to infinity.
Liquidity rug	The owner removes liquidity from the pool by burning their LP tokens or via a backdoor function. Buyers can technically sell, but there is no ETH on the other side to sell into — the swap reverts because of insufficient liquidity.
Stateful / dynamic control	Token behavior changes post-deployment. The contract passes scanner checks at launch (sell function works, no obvious whitelist), then the operator activates a sell-blocking function days or weeks later via an owner-only call. Defeats simulation-based scanners that only check the current state.
External contract indirection	The malicious sell-blocking logic lives in a separate contract that the token contract calls into during the transfer function. The token contract source itself looks clean; the trap is in the indirected contract that the casual reader never inspects. Evades source-code review.
Edge-case logic	Minimum-sell amounts set impossibly high, sell amounts that get rounded to zero, or balance-manipulation logic that silently zeroes the holder's balance during the transfer. Technically the sell "succeeds" but the holder receives nothing or transfers zero tokens.

The most sophisticated honeypots combine two or more of these patterns to defeat scanners that only check for one. A contract may pass a whitelist check (no whitelist exists), a tax check (sell tax is 0%), and a sell-simulation check (sell function works at scan time) but still be a honeypot via a stateful pattern that activates later or an external contract that gets called during transfer.

Why ERC-20 Doesn't Protect You

ERC-20 (and BEP-20, SPL-Token, etc.) is an interface standard, not a guarantee of fairness. A token contract can implement every standard ERC-20 method and still wrap them in arbitrary restriction logic — "this transfer succeeds only if X, Y, and Z." The token shows up in your wallet because the standard balance query works. The standard doesn't promise that your balance is sellable. The contract author writes the rules; the standard just defines the interface.

How to Spot a Honeypot Before Buying

The single most important habit: never buy a token on a DEX without running it through at least one honeypot scanner first. Scanners simulate a buy and a sell against the token contract on a forked version of the chain and report whether both succeed. A failed simulated sell is a honeypot — full stop.

Free honeypot scanners (EVM chains: Ethereum, BSC, Base, Polygon, Arbitrum)

honeypot.is — Ethereum, BSC, Base. Paste the contract address; scanner reports buy/sell tax, simulates a sell, flags honeypot patterns. Does not support Solana.
GoPlus Token Security — multi-chain including Solana. API and web interface. Used by major wallets and aggregators as a backend.
Token Sniffer — multi-chain. Combines honeypot detection with rug-pull risk scoring.
DEXTools security report — built into the DEXTools chart for any token; quick check.
DEX Screener security tab — multi-chain charting tool with built-in security flags.
De.Fi Scanner, RugDoc, Phishfort — specialized scanners with overlapping coverage.

Solana-specific honeypot and rug scanners

Solana's program model is different from EVM, and most EVM-focused scanners (including honeypot.is) do not support it. For Solana tokens, use these instead:

RugCheck.xyz — the Solana standard. Paste any SPL token mint address; reports mint authority, freeze authority, LP lock status, holder concentration, and known rug patterns. The first check before buying any Sol memecoin.
Birdeye — Solana charting + security tab; flags suspicious token attributes alongside chart data.
GoPlus — covers Solana in addition to EVM chains.
Sol Sniffer — Solana-focused token risk scoring.
Solscan + SolanaFM — the canonical Solana block explorers; check mint authority, freeze authority, and holder concentration manually.

On Solana, the equivalent of an EVM honeypot is usually a token where the mint authority is not renounced (operator can mint unlimited supply), the freeze authority is not renounced (operator can freeze any holder's tokens), or the LP is unlocked (operator can pull liquidity). RugCheck reports all three in one view.

Scanner Caveat: Present State, Not Future State

Honeypot scanners simulate a buy and a sell against the contract at the moment of scanning. A token that is not a honeypot now may still become one later when the operator activates a stateful trap (pause function, blacklist update, fee change, or external-contract switch). The scanner is a necessary check, not a sufficient one. Combine it with the manual checks below before any non-trivial position size.

Manual checks if you don't trust the scanner

Scanners can be fooled by sophisticated honeypots that only activate after the operator manually toggles a function. Layer in manual checks:

Contract source verified? If the source code is not verified on Etherscan, BSCscan, Basescan, or the relevant EVM explorer, you are buying a black box. Most legitimate tokens verify their source. (For Solana, source verification is less common — check mint authority, freeze authority, and program ID via Solscan instead.)
Liquidity locked? Check the LP token's holder — legitimate projects lock liquidity in a time-locked contract (UNCX, PinkSale, Team Finance). If the LP tokens sit in the deployer's wallet, the liquidity can be pulled at any moment.
Owner renounced? A deployer who has renounced ownership cannot toggle pause, mint, blacklist, or update fees. Renounced ownership is a strong (but not perfect) signal.
Holder concentration. If 80–100% of supply sits in 1–3 wallets that are not the LP, the operator can dump on the pool at any time.
Buy/sell history asymmetry. Look at the token's transaction history on Etherscan/BSCscan. If hundreds of buys exist but almost no sells (other than from a small set of addresses), that is the signature of a honeypot in progress.
Contract age. Honeypots are usually deployed and drained within hours or days. A contract less than 24 hours old with no audit and no track record is a high-risk profile by default.

The 99% Rule

If 99% of the people in the Telegram or Discord pumping a token cannot tell you exactly what makes the contract NOT a honeypot — specifically, why the sell function works for the public — treat it as a honeypot. Operators rely on excitement to bypass diligence. The diligence step is 30 seconds with a scanner.

Real-World Honeypot Examples

The Squid Game token (October 2021)

The single most famous honeypot to date. A token branded as connected to the Netflix series Squid Game launched on PancakeSwap in October 2021 and ran up from cents to over $2,800 per token in days as media coverage drove buyers in. The contract had a transfer restriction that prevented holders from selling. The operators drained approximately $3.4 million from the liquidity pool and disappeared. The case is often cited because the media-driven pump created an unusually large pool of victims for a single contract.

The endless stream of meme honeypots

Below the headline cases, thousands of smaller honeypots are deployed every day across Ethereum, BSC, Base, and Solana. These typically drain $5,000–$50,000 each from a few dozen victims, then the operator deploys the next contract from the same wallet (or a fresh wallet funded from the same exchange withdrawal). The pattern is industrial — many operators run dozens of honeypots per week, each one a slight variation on the previous template, riding whatever narrative is trending in the market that day.

The "rug pull on schedule" pattern

More sophisticated operators run honeypots that look legitimate for days or weeks — allowing some sells, building an organic-looking chart, attracting larger holders — and then trip the pause or whitelist trap on a coordinated schedule. These are harder to detect with scanners because the sell function technically works at the time of scanning. The trap activates later via an owner-only function.

What to Do If You've Been Honeypotted

Honest answer: in nearly every case, the funds you put into a honeypot contract are unrecoverable through any technical means. There is no exchange to subpoena, no centralized counterparty to freeze, and no smart contract owner who can be compelled to undo the transfer restriction. The funds are converted to a token whose sell function refuses to work, and there is no protocol-level way around that.

That said, several things are worth doing:

Preserve evidence. Take screenshots of the buy transaction, the failed sell attempts, the DEX interface, and the contract address. Save the Telegram or Discord messages that promoted the token. Save any communications with anyone who introduced you to it.
Report to industry blacklists. Submit the contract address and operator wallet to Chainabuse, Etherscan's address tagging, and any chain-specific scam-reporting platforms. Other potential victims will see the warning.
File a formal complaint. File with the FBI's IC3 regardless of the dollar amount. Cumulative IC3 reports against the same operator wallet eventually trigger federal aggregation.
Engage a forensic investigator if the loss is material. The operator behind the contract is traceable even when the contract itself is unrecoverable. See the next section.
Do not engage with "recovery services" that contact you. Within hours of being honeypotted, you will likely receive Telegram or Discord messages from people claiming to be able to "recover" your funds. They cannot. They are running the second-stage scam. See how to spot recovery scams for the full pattern.

The Forensic Angle: Tracing the Operator

The honeypot contract itself is unrecoverable. The person who deployed it usually is not. A forensic investigator working a honeypot case focuses on the operator side, not the contract side, because that is where the trail leads to off-ramps and ultimately to attribution.

The standard workflow:

Identify the deployer wallet. Every contract on Ethereum, BSC, Base, etc. has a deployer transaction. The wallet that signed the contract creation is the operator's wallet. Tronscan, Etherscan, and BSCscan all show this directly on the contract page.
Trace the deployer's funding. Where did the deployer wallet get the ETH or BNB it used to deploy and seed the liquidity pool? In nearly every honeypot case, the funding traces back through 1–3 hops to a centralized exchange withdrawal — Binance, Bybit, OKX, MEXC. The exchange withdrawal is the operator's KYC link.
Trace the drain destination. When the operator drains the liquidity pool, the proceeds go somewhere. That destination is on-chain, it is timestamped, and it usually flows back to the same exchange family within 1–7 hops. The off-ramp is the second KYC link.
Cluster the operator's wallet network. Most honeypot operators run dozens of contracts. Cluster analysis identifies the other contracts the same wallet network deployed, which dramatically expands the victim pool and the dollar damage attributable to the operator. A $10K loss in your case may be one of fifty $10K losses across the operator's full deployment history.
Produce a report law enforcement can act on. The deliverable identifies the operator's exchange-side accounts via the KYC links, quantifies the aggregate loss across all victims of all the operator's contracts, and provides the documentation a federal agency needs to subpoena the exchange and identify the operator personally.

The recovery for an individual victim is uncertain — once the operator is identified, civil or criminal proceedings determine whether any restitution is possible. But the attribution work is feasible in most honeypot cases, and aggregating the operator's full damage often crosses the threshold where a federal agency will pursue the case as a serial offender rather than a single $10K loss not worth their time.

For the broader forensic methodology, see our pieces on how blockchain forensic investigators trace crypto and crypto forensic investigation. For the broader category of token-based scams that includes honeypots, see rug pull red flags.

Operator Identification Available.

If you've been hit by a honeypot, the operator behind the contract is traceable. Wallet Witness produces forensic reports identifying the deployer's exchange-side identity and aggregating their full deployment history. Free initial case review.

Start a Free Case Review

Frequently Asked Questions

What is a crypto honeypot?

A token contract on a DEX that is engineered so buyers can purchase the token but cannot sell it back. The contract creator retains a privileged function — whitelist, blacklist, transfer restriction, or massive sell tax — that prevents anyone except the operator from converting the token back to ETH, BNB, SOL, or USDT. Funds are effectively locked the moment the buy confirms.

Why can I buy this token but not sell it?

Because the smart contract was deliberately written that way. The buy function executes normally but the sell function reverts for non-whitelisted addresses. From the DEX interface, everything looks normal at the moment of purchase. The trap is sprung when you try to sell.

How do I check if a token is a honeypot before buying?

Run the contract address through honeypot.is, GoPlus Token Security, Token Sniffer, or DEXTools' security report. Combine the scanner result with manual checks: contract source verified, liquidity locked, owner renounced, holder concentration, buy/sell history asymmetry. Any one red flag is reason to walk away.

Can I recover funds from a honeypot?

Almost never directly. There is no centralized counterparty to subpoena and no exchange to freeze. What a forensic investigator can do is trace the operator's wallet, identify the off-ramp where they convert drained liquidity to fiat, and produce a report supporting law enforcement action against the operator personally. Recovery happens at the operator level, not the smart contract level.

Are honeypots illegal?

In nearly every jurisdiction with consumer-protection or wire-fraud statutes, deliberately engineering a token to take buyers' money without delivering the ability to sell qualifies as fraud. The challenge is jurisdictional — most operators deploy from offshore wallets through anonymous infrastructure. The crime exists; the operator is often outside the practical reach of any single LE agency. Forensic attribution is the bridge that makes prosecution possible.

What is the difference between a honeypot and a rug pull?

A rug pull is a broader category in which the operator removes liquidity or destroys value after attracting buyers. A honeypot is a specific subtype where the contract is engineered so buyers cannot sell from the moment of contract deployment. Classic rug pulls allow normal trading until the operator pulls liquidity; honeypots prevent victims from ever exiting.

If I'm caught in a honeypot, will more buyers help me?

No, the opposite. Every additional buyer adds more ETH/USDT to the pool that the operator will eventually drain. Posting in groups asking others to buy "to push the price up" actively makes the operator's haul larger and your loss larger when the drain happens.

Honeypots are one face of a broader category of token-based scam mechanics. For the offensive side — what to look for in any new token deployment — see our rug pull red flags piece. For what to do in the broader aftermath of any crypto scam, see what to do after a crypto scam. For the recovery-scam pattern that targets honeypot victims specifically, see legitimate vs scam recovery services.

Zack Coffing

Founder of Wallet Witness. Independent blockchain forensic investigator specializing in crypto scam analysis, digital asset tracing, and litigation support. Based in the United States, serving victims and attorneys worldwide.