By Bryan Martin, founder of RektRadar. Ethereum scam-detection infrastructure since 2024.
Most rug-pull advice tells you to read the contract. That is good advice and it is also slow, and by the time you have read it the pool is often already empty.
There is a faster tell, and it is public: look at who bought first.
We scored the first buyers of every new Uniswap pool on Ethereum mainnet for a month. When almost all of them are addresses we already know as serial bots, the pool’s liquidity gets pulled 71.9% of the time. When they are mostly not, that number is 29.4%.
Dataset snapshot
Snapshot: 2026-08-02. Source tables: pool_serial_signal (our per-pool first-buyer scoring, refreshed each sweep) joined against on-chain mint / burn events for the same pools.
- Pools scored in the window: 14,177 (14,151 distinct tokens)
- Window: 2026-07-03 to 2026-08-02, one month
- Serial-bot addresses in the scoring set: 574,072
- First buyers examined per pool: 9.6 on average
- Pools with a matched WETH liquidity outcome: 586
72.5% of launches are bought by bots first
The headline number is not the rug rate. It is how normal bot-farmed launches have become.
Of the 14,177 pools we scored, 10,276 (72.5%) had at least 80% of their first buyers flagged as serial bots. Only 2,301 pools had fewer than one in five.
| Share of first buyers that are serial bots | Pools | Share of launches |
|---|---|---|
| Under 20% | 2,301 | 16.2% |
| 20-49% | 727 | 5.1% |
| 50-79% | 873 | 6.2% |
| 80% or more | 10,276 | 72.5% |
When you buy a brand-new token five minutes after the pool opens, you are usually not early. You are behind a fleet.
The liquidity outcome
A “serial bot” label is only worth something if it predicts what happens to the money. So we ignored our own risk score entirely and measured a plain on-chain fact: was the liquidity taken back out?
We counted a pool as drained when the WETH removed through burn events reached 90% or more of the WETH ever deposited through mint events.
| Share of first buyers that are serial bots | Pools | Liquidity pulled |
|---|---|---|
| Under 20% | 126 | 29.4% |
| 20-49% | 53 | 58.5% |
| 50-79% | 62 | 56.5% |
| 80% or more | 345 | 71.9% |
That is a 2.4x difference between the cleanest and the dirtiest bucket, and the gradient runs the right way across all four.
The bot-farmed pools die in under two hours
The same split shows up in how long the pool stays alive. Measuring the time between a pool’s first and last on-chain event:
| Share of first buyers that are serial bots | Median lifetime |
|---|---|
| Under 20% | 15.9 hours |
| 20-49% | 73.3 hours |
| 50-79% | 169.8 hours |
| 80% or more | 1.8 hours |
Half of the heavily bot-farmed pools have all of their trading activity inside 1 hour 48 minutes. There is no “watch it for a day and see” with these. The entire event, launch to exit, fits inside a lunch break.
Note that the middle buckets live longer than the clean one. A launch that mixes real buyers with a partial bot fleet tends to be an actual attempt at a token, and it takes longer to fail.
Why we did not use our own risk score here
This is the part most write-ups skip. We tried the obvious analysis first: does the bot ratio predict our own scam score? It does not, and the reason is instructive.
In every single bucket, 99.8% to 100% of the tokens scored 70 or higher on our scale. Under 20% bots: 100%. Over 80% bots: 99.8%. The score is saturated because a fresh token launched into a fresh pool trips enough structural flags to clear the threshold regardless of who bought it.
A saturated metric cannot discriminate. That is why every number above is an on-chain outcome (liquidity removed, pool lifetime) rather than a verdict we produced ourselves. If we had graded our own homework, this article would have claimed a perfect signal and taught you nothing.
What to actually do with this
Before you buy a token that is minutes old, pull the first ten buyer addresses off the pool and ask one question about each: has this address done this before, on other brand-new tokens?
An address that has bought the first block of forty different tokens this month is not a trader who found a gem. It is inventory management. If most of the early book looks like that, you are not early to a token, you are late to a script.
This is a targeting signal, not a blocklist. Plenty of bot-farmed launches still trade, and some of them trade up. But you are taking a coin-flip that lands wrong 72% of the time, inside a window that closes in under two hours.
Limits of our data
- The liquidity outcome uses a sub-sample. 586 of the 14,177 scored pools had a matched WETH
mint/burnhistory inside our 35-day event window. Pools paired against USDC, USDT or another quote are not counted, and very recent pools have a truncated history. The bucket sizes (53 to 345) are small enough that a few percent of movement is noise. - “Liquidity pulled” is a proxy, not a verdict. A 90%+ withdrawal is what a rug looks like on-chain, but a legitimate migration to a new pool looks identical. We are measuring an outcome, not proving intent.
- Our serial-bot labels are our own. An address is flagged from its history of buying brand-new pools. That is a heuristic. A very active human sniper will be labelled a bot, and a fresh bot wallet with no history will not be labelled at all, which pushes the measured gap down, not up.
- Selection bias at the entrance. Tokens enter the dataset through our factory and mempool watchers. Launches on deployment paths we do not watch are invisible to this analysis.
- Pool lifetime is bounded by the window. A pool created three days before the snapshot cannot show a 200-hour lifetime. This compresses the long tail and affects the cleaner buckets most, since those are the ones that survive.
TL;DR
- 72.5% of new Ethereum pools have 80%+ of their first buyers flagged as serial bots (14,177 pools, one month).
- Those pools have their liquidity pulled 71.9% of the time, versus 29.4% when the early buyers are mostly not bots. A 2.4x gap.
- Median time from first to last trade in the heavily bot-farmed pools: 1.8 hours.
- Our own risk score was useless here (99.8-100% flagged in every bucket), so every figure above is a raw on-chain outcome.
- The check is cheap: read the first ten buyers before you buy.
Related reading: 76% of new Ethereum tokens are scams, how to detect an Ethereum scam token, and wash-traded volume on fake tokens.
Paste an address into the free scan, no signup, no card and it will show you the early buyers alongside the contract flags, before you decide.