What Is a Honeypot Token? How Crypto Honeypot Scams Trap Buyers

The chart looks perfect. A new token is climbing steadily, the buy button works, and your wallet shows a balance that keeps growing. Then you try to sell, and the transaction fails. Again and again.

That is the classic honeypot token. It lets money in and quietly refuses to let it out, so the only person who can ever cash out is the one who wrote the code.

This guide explains what a honeypot means in crypto, how the trap is built into a token contract, the other scams that share the name, and the checks that catch most of them before you spend a cent.

What a honeypot token is

A honeypot token is a cryptocurrency, usually launched on a decentralized exchange such as Uniswap or PancakeSwap, whose contract allows buying but blocks or heavily penalises selling.

The name comes from security research, where a honeypot is a decoy system set up to attract attackers. In crypto the idea is turned around: the decoy exists to attract buyers, and the people running it are the attackers.

From the outside, nothing looks wrong. The token has a website, a Telegram group, a liquidity pool and a rising price chart. The problem is hidden in the rules the token follows when someone tries to move it.

How the trap works inside the contract

Every token on Ethereum, BNB Chain and similar networks is a smart contract with a transfer function. Each time tokens move, that function runs and decides whether the move is allowed.

When you buy on a DEX, tokens move from the liquidity pool to your wallet. When you sell, they move from your wallet back to the pool. A honeypot contract simply treats those two directions differently.

The most common ways it does that:

Sell blacklists. The owner can add any address to a blocked list. Buyers get flagged automatically or manually, and every later transfer from their wallet reverts.

Whitelists. The reverse approach: only approved addresses, usually the deployer's own wallets, may send tokens to the pool. Everyone else's sell fails.

Adjustable taxes. Many legitimate tokens charge a small fee on trades. A honeypot lets the owner raise the sell tax to 99% or even 100% after launch, so a "successful" sale returns almost nothing.

Tiny sell limits and pause switches. A maximum transaction size can be set so low that selling is pointless, or trading can be paused for everyone except the owner.

Hidden control. Some contracts claim ownership has been renounced while another admin role, or an upgradeable proxy, still lets someone change the rules later.

Because the price can only go up while nobody else is able to sell, the chart becomes part of the bait. The deployer usually drains the pool once enough money is in, which is why many honeypots end as a rug pull.

The Squid Game token: a textbook case

The best-known example is the SQUID token from late 2021, which borrowed the name of the Netflix series and promised a play-to-earn game.

The price shot from around a cent to more than $2,800 in a matter of days. Holders soon found that the contract stopped them from selling, and the developers then pulled liquidity and disappeared with an estimated $3.3 million.

It is worth reading alongside our look at the biggest crypto rug pulls, because the pattern repeats: a trending theme, aggressive marketing, a price that only rises, and an exit that leaves holders with tokens nobody can trade.

Other scams called a crypto honeypot

The word gets used for at least two other tricks, and it helps to recognise both.

The leaked seed phrase wallet. A stranger messages you, or posts publicly, sharing the recovery phrase to a wallet that holds a few thousand dollars in USDT and asking for help. It looks like easy money. To move the tokens you first need to send the network's native coin to pay gas.

As MetaMask's support pages describe, the moment that gas arrives, a sweeper bot moves it to the scammer's wallet. The bait never leaves, and you lose whatever you sent. Anyone handing out a seed phrase is a red flag on its own.

Contracts that bait would-be exploiters. Some older Ethereum contracts appear to contain an obvious flaw that lets the caller withdraw the balance if they deposit first. The flaw is fake, and the deposit is what gets taken. These target people trying to game the contract rather than ordinary investors, but the lesson is the same: code that looks too generous usually is.

Warning signs of a honeypot token

No single signal proves a scam, but several together should stop you.

No successful sells from ordinary wallets. On Etherscan or BscScan, open the token's transfers and look for transactions sending tokens back to the pool from addresses that are not the deployer. A long list of buys and almost no sells is the clearest tell.

Unverified or copied code. If the source code is not verified on the block explorer, you cannot see the rules at all. Verified code with functions named for blacklists, fee changes or trading toggles deserves a careful read.

Owner powers that survive launch. Check whether the deployer can still change taxes, limits or allowed addresses. "Ownership renounced" claims should be confirmed on-chain, not taken from a Telegram post.

Liquidity that is not locked. If the pool tokens sit in the deployer's wallet rather than a time-lock, they can be withdrawn whenever the owner likes.

Hype without substance. Paid shill posts, countdown timers, promises of guaranteed returns and admins who delete questions about selling are all part of the playbook.

How a honeypot token checker helps

You do not need to read Solidity to get a first opinion. Several free tools scan a contract address for honeypot behaviour.

Honeypot.is, for example, simulates a buy and a sell of the token on Ethereum, BNB Chain or Base and reports whether the sale goes through and what tax applies. Token Sniffer and GoPlus Security run similar checks and flag risky owner permissions.

These scanners are useful, but treat a clean result as "not obviously a trap right now" rather than "safe". Honeypot.is itself warns that a token that passes today can be changed later. A contract with adjustable taxes or an upgradeable design can switch behaviour after the scan.

A sensible routine is to run two checkers, look at the sell history yourself, and if you still want in, buy a very small amount and try selling it before committing anything meaningful.

What to do if you are already stuck

If you hold a token you cannot sell, the hard truth is that the funds are usually gone. There is rarely a technical way around rules written into the contract.

Do not pay to unlock. Messages offering to "whitelist" your wallet for a fee, or recovery services promising to get the money back, are a common second scam aimed at the same victims.

Clean up your wallet. If you gave the token or a related site any spending approvals, revoke them with a tool such as Revoke.cash or your block explorer's approval checker. Our guide to wallet drainers covers why lingering approvals matter.

Report it. Flag the contract on the block explorer and in scam databases so others see a warning. In the US you can also file a report with the FBI's IC3 and the FTC, and keep a record of every transaction hash.

The bottom line

A honeypot token is not a bug or a bad trade. It is a token built from day one so that only its creator can sell.

The defence is mostly habit: check who can sell before you buy, verify that the owner cannot change the rules, run a honeypot checker, and test with an amount you can afford to lose. If a chart only goes up and nobody seems to be cashing out, that is not a signal to buy. It is the trap working as designed.