Honeypot
A honeypot in crypto is a fraudulent smart contract that lets you buy a token freely but technically blocks any subsequent sale. The victim watches the price climb, buys in, and then discovers the token can't be sold or swapped at all. Honeypot contracts are especially common on Ethereum and BSC (BNB Smart Chain).
How a Honeypot Contract Works
The trap works because buying and selling a token are, at the code level, two entirely separate functions in a smart contract. A honeypot's buy function works exactly like a legitimate token — anyone can purchase it, and the price often climbs as more buyers pile in, reinforcing the illusion that it's a real, tradeable asset. The sell function, however, contains hidden logic that reverts the transaction, or routes 100% of the proceeds to the contract creator, making an actual profitable sale impossible for anyone but the deployer.
Common tricks inside the sell function
Some honeypots hard-block all sells outright. Others use a whitelist that only allows the deployer's own wallets to sell. A subtler variant applies an enormous, hidden sell tax (sometimes 99%+) that only trips when a non-whitelisted address attempts to sell — letting a handful of "proof" sales go through early to build trust, then trapping everyone who buys in afterward.
How to check before buying
Free honeypot-checker tools (built into most DEX aggregators and several standalone sites) simulate a buy-then-sell sequence against the contract before you risk real funds. A token with no verified source code on the relevant block explorer, or one whose contract owner retains the ability to modify trading rules after launch, is a red flag worth treating seriously regardless of what the checker says.
Why Honeypots Matter for Your Crypto Security
Honeypots specifically target the instinct to chase a rising price without verifying that an exit actually exists. Unlike a rug pull, where liquidity is pulled after the fact, a honeypot is fraudulent by design from the moment the contract is deployed — there was never a real exit available. Recognising the pattern before buying is the only real defence, since funds locked inside a honeypot contract typically can't be recovered technically.
A Worked Example: How a Victim Gets Caught
Picture a token that appears on a decentralised exchange with a polished website and an active Telegram group. A promoter tells followers it has just launched and is already up sharply. The chart looks healthy, other wallets are buying, and a few even seem to sell at a profit early on. A newcomer buys a modest amount, sees the balance appear in the wallet, and then tries to swap it back to a stablecoin. The transaction fails every time, or it succeeds but returns almost nothing because of a hidden tax.
What the buyer did not see is that the early successful sales came from wallets controlled by the deployer, or from addresses placed on an allow list. The rising price was real only in the sense that people kept paying in. Every new purchase added funds to the liquidity pool that only the creator could effectively withdraw.
What to Do and What Not to Do After Buying One
Once you realise a token cannot be sold, stop interacting with the contract. Do not buy more to "average down", do not pay anyone who offers to unlock your tokens for a fee, and do not connect your wallet to sites that promise a sell workaround, since those are often drainers or phishing pages. Revoke any token approvals you granted so the situation does not get worse.
Then document everything calmly: the contract address, your transaction hashes, the pool address, the social media accounts that promoted the token, and the time you bought. This record matters because the money you paid ends up in a pool the deployer controls, and the deployer's wallet often moves those funds onward. If they reach an exchange that verifies identity, a well-documented trace gives a compliance team something concrete to act on. Success is never guaranteed, and the tokens themselves stay stuck, but the payment side is sometimes traceable.
Frequently Asked Questions
Can I get my money out of a honeypot contract?
Almost never through technical means — the sell function is deliberately broken or restricted by design. In rare cases, if the funds later move to a KYC-verified exchange, blockchain tracing combined with a legal complaint can create pressure, but a direct technical recovery from the contract itself is generally not possible.
How can I check if a token is a honeypot before buying?
Use a dedicated honeypot-checker tool that simulates a buy-and-sell before you commit real funds, and review the contract's verified source code on the relevant block explorer for suspicious sell restrictions or owner-only functions.
Are honeypots only found on new, unknown tokens?
They're most common among newly launched, low-liquidity tokens promoted aggressively on social media, but the same trap pattern can technically be built into any smart contract, so due diligence matters regardless of how established a project appears.
Is a token with a sell tax always a honeypot?
No. Many legitimate tokens charge a modest transaction tax that funds development or liquidity. The warning sign is a tax that is extreme, hidden, or able to be changed by the owner after launch, especially one that only applies to sellers. Checking the contract and running a simulated sale helps tell the two apart.
Does a honeypot count as a rug pull?
They are related but different. A rug pull usually involves a project that looks real and then removes liquidity or sells its holdings. A honeypot is built so that selling is impossible or heavily penalised from the first day. In practice scammers sometimes combine both methods in a single token.