Decentralised exchanges such as Uniswap (Ethereum) and PancakeSwap (BNB Chain) let anyone list a token by posting liquidity. Most newcomers meet that fact as a green candle. Researchers meet it as a factory.
The paper Serial Scammers and Attack of the Clones (WWW ’25) studied short-lived “simple” rug pulls — pools that live roughly a day, trade only that token pair, then have nearly all liquidity pulled. Across the two venues the authors assembled on the order of hundreds of thousands of scam pools and scammer addresses, then showed money moving in stars and chains: one wallet funding many operators, or profits hopping to the next clone. Token contracts inside a cluster often looked more than 70% alike; across clusters, much less. Wash trading made profits look fatter than they were once the cluster’s fake buys were counted.
For a buyer the lesson is not “never use a DEX”. It is that a busy chart on a famous front-end can still be a disposable clone. Check contract age, liquidity lock, mint/freeze powers and whether the same bytecode keeps reappearing under new tickers. If the story is only “next 100x” and a screenshot of volume, assume you are funding someone else’s template.
If this already cost you money, start at Get help. Anyone selling a guaranteed clawback for an upfront fee: Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.