> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jup.ag/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs cover what users see and do on jup.ag, Jupiter Mobile and Jupiter Wallet.
> Universal Deposit, the GUM routes in Bridge & Swap (GUM Universal Bridge, GUM Universal Deposit) and other GUM integrations on jup.ag are built by GUM. For how they work, their full fee rules, security model and APIs, the reference is the GUM docs: start from https://docs.gum.ag/llms.txt.
> When the GUM docs and these docs differ on how a GUM product behaves on jup.ag, describe the jup.ag experience from these docs and the mechanics and fees from the GUM docs.

# Scams, rug pulls and fake tokens

> How rug pulls, scam airdrops and fake tokens work on Solana, the red flags to watch for, and where to check a token on Jupiter before you buy it.

export const GuideMeta = ({level, minutes, author, avatar, published, updated}) => <div className="jg-meta not-prose">
    <div className="jg-badges">
      <span className={`jg-level jg-level-${level.toLowerCase()}`}>{level}</span>
      {minutes ? <span className="jg-read">About {minutes} min read</span> : null}
    </div>
    <div className="jg-byline">
      <img noZoom className="jg-avatar" src={avatar} alt="" width="32" height="32" />
      <span>
        Written by <span className="jg-author">{author}</span>
        {published ? <span className="jg-origin">
            Originally published on Jupiter Academy, {published}{updated ? " · Updated for Jupiter Docs" : ""}
          </span> : null}
      </span>
    </div>
  </div>;

<GuideMeta level="Intermediate" minutes={3} author="Bryan" avatar="/images/guides/authors/bryan.webp" published="February 23, 2026" updated />

<img src="https://mintcdn.com/jupiter-support/p5FdkagPcbEGL8wN/images/guides/safety-rugs/cover.webp?fit=max&auto=format&n=p5FdkagPcbEGL8wN&q=85&s=98a96ad19e7af6f516c414e6eb978771" alt="A coin rolling toward an open hole next to a warning sign, the cover of this lesson" width="1920" height="1080" data-path="images/guides/safety-rugs/cover.webp" />

Not every threat comes from a hacker trying to break into your wallet. Some of the biggest losses in crypto come from willingly investing in projects that were fraudulent from the start, or buying tokens that were designed to deceive.

## Rug pulls: from right under you

A rug pull occurs when the creators of a project, usually a new [token](/user-docs/guides/basics/cryptocurrency) or <Tooltip headline="DeFi" tip="Decentralized Finance. Financial services built on blockchain technology that operate without traditional intermediaries like banks." cta="Open the glossary" href="/user-docs/guides/glossary#defi">DeFi</Tooltip> protocol, build up hype and liquidity, then abruptly drain the funds and disappear, leaving investors with worthless assets. Signs to watch for include:

* anonymous teams with no verifiable track record;
* promises of extremely high or guaranteed yields;
* no public audit from a reputable security firm;
* social media accounts created very recently, with artificially inflated follower counts.

<img src="https://mintcdn.com/jupiter-support/p5FdkagPcbEGL8wN/images/guides/safety-rugs/rug-pull-chart.webp?fit=max&auto=format&n=p5FdkagPcbEGL8wN&q=85&s=d5bbc90c060bc1e8387b28f1278bd6be" alt="A candlestick chart: green candles climb while hype builds, then one long red candle wipes out the gains in a rug pull" width="1920" height="1080" data-path="images/guides/safety-rugs/rug-pull-chart.webp" />

On jup.ag, token pages also show developer controls that put holders at risk, such as an active Mint Authority (more tokens can be created at any time) or Freeze Authority (your tokens can be frozen). See [Developer authority risks](/user-docs/trade/spot/risks-and-limitations#developer-authority-risks) and [Liquidity removal](/user-docs/trade/spot/risks-and-limitations#liquidity-removal-rug-pulls).

## Fake airdrops

You may occasionally notice unfamiliar tokens appearing in your wallet that you never asked for. These unsolicited tokens, often called dust or spam, are sent to your address to lure you into interacting with a malicious contract or site. Do not try to swap, sell, or interact with tokens you do not recognize. Simply ignore them.

In the Jupiter Mobile app, you can also hide them: tap the token, open the three-dot menu and select **Hide**. See [Spam tokens](/user-docs/global/mobile/portfolio#spam-tokens).

## Verifying token legitimacy

On Solana, anyone can create a token in minutes and name it anything, including names identical to legitimate projects. Before buying an unfamiliar token, always verify its contract address against the official project website or another reputable source, then run the checks below.

* Check the contract address: the token's mint address should match the one published on the official project's website. A token named "USDC" with a different address than the real USDC mint is a fake. On jup.ag, a token flagged as impersonating another shows a warning banner with a link to the legitimate asset.
* Look for the Verified badge: Jupiter marks verified tokens, and unverified ones carry a Not Verified entry in their JupShield warnings (see [Token information](/user-docs/trade/spot/token-page#token-information)). Verification confirms you have the right token, not that the token is safe. If a token is not verified and you don't recognize it, treat it with caution.
* Read the safety indicators: token pages show mint and freeze authority, holder concentration, developer holdings and more, and [JupShield](/user-docs/trade/spot/risks-and-limitations#jupiter-shield) warns about risks in the trade widget. They inform you; they do not guarantee anything. See [Safety indicators](/user-docs/trade/spot/token-page#safety-indicators), and [AlphaScan](/user-docs/trade/spot/alphascan) for developer data on brand-new launches.
* Audit status matters: established DeFi protocols publish security audit reports from firms like Zenith, OtterSec, or Certora. No audits is a meaningful red flag. Jupiter lists the audits of its own programs on [Security](/user-docs/more/security).

## Go deeper

<CardGroup cols={2}>
  <Card title="Risks and limitations" icon="triangle-exclamation" href="/user-docs/trade/spot/risks-and-limitations">
    Fake tokens, developer authorities, rug pulls and the warnings Jupiter Spot shows.
  </Card>

  <Card title="Token page" icon="chart-line" href="/user-docs/trade/spot/token-page">
    The Verified badge, safety indicators and how tokens are listed and routed.
  </Card>

  <Card title="Token verification" icon="badge-check" href="/user-docs/launch/vrfd/token-verification">
    What the Verified badge means, and what it does not guarantee.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.