🤖 AI

Early Rug Pull Warning for BSC Meme Tokens via Multi-Granularity Wash-Trading Pattern Profiling

This paper proposes an end-to-end framework for early rug-pull warnings on BSC meme tokens that constructs multi-granularity wash-trading features from transaction, address, and flow signals, demonstrating that a Random Forest model achieves high precision (AUC=0.9098) and actionable early detection (mean lead time of 3.81 hours) while functioning best as a high-precision screener under weak supervision.

Original authors: Dingding Cao, Bianbian Jiao, Jingzong Yang, Yujing Zhong, Wei Yang

Published 2026-03-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Dingding Cao, Bianbian Jiao, Jingzong Yang, Yujing Zhong, Wei Yang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of cryptocurrency, specifically the Binance Smart Chain (BSC), as a massive, bustling street market. In this market, people are constantly creating new "meme tokens"—digital coins based on jokes, cats, or internet trends. These tokens are like pop-up stalls that open and close in the blink of an eye.

Most of these stalls are harmless fun, but some are scams. The scammers set up a stall, hype it up to get people to buy in, and then suddenly grab all the money and run away. This is called a "Rug Pull."

The problem? By the time the police (or regulators) realize what happened, the money is gone, and the scammers have vanished into the crowd.

This paper is about building a super-smart security guard who can spot these scammers before they run away, giving honest investors a few precious hours to get their money out.

The Detective's Toolkit: How It Works

The researchers built a system that acts like a detective looking for specific "suspicious behaviors" in the crowd. Instead of just looking at one person, they look at how people move money around. They focus on three main types of fake trading (called "Wash Trading") that scammers use to make a token look popular when it's actually dead:

The "Self-Hug" (Self Pattern): Imagine a scammer standing at their own stall, buying their own product with their own money, over and over again, just to make it look like there's a long line of customers.
The "Handshake Club" (Matched Pattern): Imagine two friends, Alice and Bob, standing next to each other. Alice buys from Bob, then Bob buys from Alice, back and forth, creating a fake frenzy of activity.
The "Circle Dance" (Circular Pattern): Imagine a group of five people passing a bag of money around in a circle. No one actually leaves the group, but the money is moving fast, creating the illusion of a busy market.

The "Scorecard" System

The researchers turned these behaviors into a 12-point scorecard for every token. They didn't just count how many trades happened; they looked at:

Who is trading? (Is it the same 5 people over and over?)
How much are they trading? (Are the amounts weirdly similar?)
How fast are they trading? (Is there a sudden burst of activity right before the crash?)

They fed this scorecard into a computer brain (a Random Forest model, which is like a team of experts voting on whether a token is safe).

The Results: A High-Precision Scanner

Here is what they found:

The Teamwork Wins: The computer brain (Random Forest) was much better at spotting scams than a simple rule-based calculator (Logistic Regression). It got the "scam vs. safe" decision right about 91% of the time in terms of ranking risk.
The Secret Sauce: The most important clues came from the actual trades (who bought what and when). The "who" (the addresses) helped a little bit, but the "what" (the transaction details) was the biggest giveaway.
The "Heads-Up" Time: This is the most exciting part. For the scams they caught, the system gave an average warning 3.8 hours before the scammer ran away.
- Analogy: It's like a weather forecast that tells you, "There is a 90% chance of a tornado in 4 hours." You have time to pack your car and leave, rather than getting caught in the storm.

The Catch: It's a Screener, Not a Crystal Ball

The authors are very honest about the system's limits.

It's not perfect: It missed 8 scams (False Negatives) but only cried "Wolf" once when there was no wolf (False Positive).
The Strategy: Because it rarely cries "Wolf" falsely, it's best used as a high-precision filter. Think of it as a metal detector at an airport. It doesn't stop every criminal, but if it beeps, you know you definitely need to check that person closely. It's designed to help human experts prioritize which tokens to investigate, not to make the final decision automatically.

Why This Matters

In the wild west of meme coins, scams happen so fast that humans can't keep up. This paper provides a reproducible, step-by-step guide to building a digital watchdog. It proves that by looking at the patterns of how money moves (rather than just the code of the token), we can spot the "Rug Pulls" early enough to save some money.

In short: They built a radar that spots the "fake crowds" scammers create, giving honest investors a few hours to run for the exit before the rug is pulled.

1. Problem Statement

The rapid issuance and short-cycle speculation of meme tokens on the BNB Smart Chain (BSC) have exacerbated the risk of "rug pulls" (fraudulent projects where developers abandon the project and withdraw liquidity). Existing risk control methods face three critical challenges in this context:

Data Scarcity & Label Noise: Anomaly samples are rare, and labels are often incomplete or inconsistent.
Static Limitations: Static smart contract analysis fails to capture fast-evolving behavioral risks, while graph-based methods struggle with the rapid lifecycle of meme tokens.
Lack of Actionability: Current approaches often lack interpretability and fail to provide early warning signals (Lead Time) before a rug pull occurs, making them difficult to deploy for real-time risk control.

2. Methodology

The authors propose an end-to-end warning framework consisting of four stages: dataset construction, multi-granularity feature modeling, risk prediction, and error analysis.

A. Data Construction & Labeling

Dataset: 7 BSC meme tokens with a total of 33,242 transfer records.
Preprocessing: A unified window strategy retains the earliest 5,000 valid records per token to ensure comparability.
Labeling Strategy: Due to limited ground truth, a weak-supervision approach is used. Samples are categorized as high_risk or non_high_risk (with unknowns merged into the negative class).

B. Multi-Granularity Wash-Trading Feature Engineering

The core innovation is the conversion of three specific wash-trading patterns into 12 token-level behavioral features:

Patterns Modeled:
- Self: Self-looping or highly self-associated address behaviors.
- Matched: Frequent paired transfers between specific address pairs.
- Circular: Multi-address cyclic fund transfers.
Feature Categories (12 Features):
- Activity: Transaction count (tx_count).
- Address Diversity: Unique senders/receivers (unique_from, unique_to) and their ratio.
- Amount Statistics: Mean, median, and standard deviation of transfer quantities.
- Concentration: Top-10 address share.
- Burstiness: Ratio of peak to median minute counts.
- Flow Imbalance: Net inflow/outflow ratio.
- Route Reuse: Frequency of repeated (sender, receiver) pairs.
- Lifespan: Active minute buckets.

C. Modeling & Inference

Algorithms: The study compares Logistic Regression (baseline) and Random Forest (primary model).
Objective: Binary classification to output a risk probability ( $\hat{y}_i$ ). A warning is triggered if the score exceeds a threshold $\tau$ .
Lead Time Metric: Defined as $LeadTime = t_{rugpull} - t_{warning}$ , measuring the time between the first warning signal and the actual rug pull event.

3. Key Results

A. Performance Metrics

Under the current weak-supervision setting, Random Forest significantly outperformed Logistic Regression:

AUC: 0.9098 (RF) vs. 0.7243 (LR).
PR-AUC: 0.9185 (RF) vs. 0.7397 (LR).
F1 Score: 0.7429 (RF) vs. 0.6316 (LR).
Precision: 0.9286 (RF), indicating a very low false-positive rate.

B. Ablation Analysis

The study quantified the contribution of different feature groups:

Trade-level features (e.g., transaction counts, amounts) were the primary performance driver. Removing them caused a massive drop in PR-AUC ( $\Delta = -0.1843$ ).
Address-level features provided stable complementary gains ( $\Delta = -0.0573$ ).
Contract-level features (currently a single feature) showed negligible impact in this specific version.

C. Warning Timeliness & Error Profile

Lead Time: The model achieved a mean Lead Time of 3.81 hours (median 1.03 hours) for a subset of 25 samples, proving the existence of actionable warning windows.
Error Distribution: The system produced 1 False Positive (FP) and 8 False Negatives (FN).
Interpretation: The model acts as a high-precision screener rather than a high-recall alarm engine. It is highly effective at filtering out safe tokens but currently misses some rug pulls.

4. Key Contributions

Executable Pipeline: Established a reproducible, end-to-end framework for rug-pull warning, bridging the gap between wash-trading pattern detection and operational risk scoring.
Feature Validation: Empirically validated that multi-granularity wash-trading features (Self, Matched, Circular) are effective under weak supervision, with trade-level signals being the dominant risk indicator.
Deployment-Oriented Analysis: Moved beyond standard classification metrics to report Lead Time and Error Bounds, positioning the system as a tool for human-in-the-loop triage rather than fully autonomous decision-making.

5. Significance & Limitations

Significance: The paper provides a practical, interpretable method for detecting early-stage rug pulls on BSC. It demonstrates that behavioral analysis of transaction flows can outperform static contract analysis for short-cycle meme tokens.
Limitations:
- Label Noise: Merging unknown samples into the negative class may inflate false negatives.
- Lead Time Approximation: The current Lead Time (v1) relies on rule-based approximations for low-transaction samples rather than precise event timestamps.
- Data Scale: The dataset is small (7 tokens), limiting statistical robustness.
Future Work: The authors plan to implement event-level timestamp labeling (Lead Time v2), bootstrap confidence intervals, and richer contract-mechanism features to improve recall and generalization.