Honeypot in crypto: a trap token with an entrance and no exit

Start with a famous collapse, then open the contract: how blacklists, sell taxes and frozen accounts turn a token into a one-way door, and what a scanner can and cannot tell you.

Published: · Last reviewed:

Hardware wallet app screen composed in Flexdger Wallet: a portfolio named Ridge, a total balance and its change for the day above a row of Transfer, Swap and Buy buttons, a market row and a perpetuals card, then the list of holdings with each amount and its move for the day, in a dark theme with a lavender accent.
Composed in Flexdger Wallet. Every figure on it was typed in; nothing is held, sent or received, and no chain is read.

A collapse worth remembering

The most cited example is the SQUID token of 2021, which rode the popularity of a hit television series. CoinMarketCap Academy reported that holders could only sell if they held "marbles" earned in a game that required staking 456 SQUID to enter. On November 1, 2021, the price fell from $2,861.80 to $0.0007926, a drop of 99.9999%.

That is the whole genre in one picture: an exuberant chart, a rule hidden in the mechanics, and a door that only opens inwards.

The definition

A honeypot is a token you can buy but cannot sell. Kraken's learning center describes a malicious smart contract that restricts which addresses can transfer the token: anyone may buy, but only a select address or addresses may sell. Buyers watch the price edge up, since no one else can sell into it. Then the one wallet allowed out sells, or drains the pool.

Four tricks and one authority

Security firm CertiK listed the common mechanisms in January 2024.

TrickWhat the contract does to you
BlacklistAdds buyers to a list that cannot sell, sometimes behind a harmless-sounding function name
Balance changeResets your balance to a tiny figure the creator picked
Impossible thresholdAllows selling only above an amount nobody can hold
Sell taxCharges so much on a sale that almost nothing comes back

On Solana, the effect can come from an authority instead of custom code. The Solana documentation explains that a frozen token account cannot transfer tokens until it is thawed, and that only a mint that still has a freeze authority can do it.

The activity can be industrial: CertiK reported that one actor created 979 honeypot contracts between August and October 2023, roughly one every 30 minutes.

Checking before you click buy

  1. Read who sold. On an explorer, many different wallets should have sold successfully. CertiK treats a sell count of zero or near zero as a major red flag, and an all-green chart with almost no sells is the classic picture.
  2. Simulate a sale. Paste the contract address into a scanner that attempts a buy and a sell. It can flag sell restrictions and extreme sell taxes.
  3. Find out who can still change the rules. On Solana look for an active freeze authority; elsewhere, an owner who can alter taxes. A token that sells today might not tomorrow. See renounced.
  4. Sell a crumb first. If you still want in, buy the smallest amount possible and try to sell it before adding more. It only proves selling worked at that moment.

Unverified contract code, and loud promotion of a token nobody can explain, are also reasons to stop. Honeypot.is and RugCheck are scanners that Kraken names; the names are examples, not endorsements, and we are not affiliated with any of them.

The blind spots of a scan

A scanner reads code. It cannot tell you who is paid to promote the token, and a pass today leaves room for an owner with active powers to change the code tomorrow.

Hearing it in a chat

Tone: nearly always warning, mock when a victim jokes. Phrases: "it's a honeypot", "honeypot check", "honeypot scanner", "can't sell, honeypot". Invented posts, written for this page:

An old word, turned around

Wiktionary lists a pot of honey, a spy who lures targets and, in computer security, a trap set to detect or deflect unauthorized use of a system. Early smart-contract honeypots inverted that idea. A 2019 USENIX Security paper described contracts that look vulnerable to lure would-be attackers, who send funds trying to exploit them and watch those funds get trapped. Its authors found 690 such contracts on Ethereum, 240 victims and more than $90,000 in profit for the creators. When the word shifted to today's buy-only tokens is not documented.

Look-alikes

Company names appear here only as sources or examples. We are not affiliated with Kraken.

Sources

Questions

Can a scanner prove a token is safe?

No. Kraken notes that the creator can still pull the rug on a token that scanned clean, and a contract that keeps active powers can be altered after your scan. A clean result is a snapshot of one moment.

Is there any way to recover money from a honeypot?

Rarely through the token, because the contract is the thing blocking the sale. Report the scam to the platform where you found it and, in the U.S., to the FBI's Internet Crime Complaint Center, and distrust anyone who offers to recover the funds for a fee.

How does a honeypot differ from a rug pull?

In a honeypot the contract itself prevents selling. In a rug pull you could sell, but the creators removed the liquidity or dumped their supply, so nothing is left to sell into. Many honeypots finish as rugs.

Why does the price look so healthy?

Because the only sells that go through come from the creator. With almost no one able to sell, the chart is a straight climb, which is itself a clue.

Is the word the same as in cybersecurity?

It shares a root. In computer security a honeypot is a decoy system set up to detect or deflect unauthorized use, per Wiktionary. The crypto sense points the trap at buyers, with a rising chart as the bait.

Keep reading