Pump and Dump Scheme: How to Spot One and Avoid Scams

Three data points explain why a pump and dump guide for cryptocurrencies matters right now. Solidus Labs found that 98.6% of the 11.9 million tokens launched on Pump.fun since January 2024 ended as pump-and-dumps or rug pulls. Chainalysis tracked 94% of DEX pump-dump pools getting rugged by the pool creator within 6-7 days. The FBI's 2025 Internet Crime Report logged $11.4 billion in crypto-related fraud losses, $7.2 billion of it investment-scam related. The old stock-market playbook is alive, on-chain, and running at industrial scale.

This guide walks you through how pump and dump schemes actually work in 2026, who runs them, which red flags catch almost every one, which tools you should use before buying anything new, and what to do if you got caught. Practical, specific, and aimed at traders who want to keep their money instead of financing someone's exit.

What is a pump and dump scheme?

A pump and dump scheme is a form of securities fraud in which a fraudster or promoter network artificially inflate the price of a thinly traded asset. They spread false or misleading information through a stock newsletter, chatrooms, and social feeds to attract buyers. Then they sell their shares at the inflated price, leaving everyone else holding the crash. It is a classic market manipulation pattern that leaves investors with significant losses, and regulators treat it as straight-up fraud. The U.S. Securities and Exchange Commission has prosecuted this pattern in stocks, including over-the-counter and microcap tickers, for more than a hundred years, and the sanction penalties can be severe. Crypto made it cheaper to run and harder to regulate, which is why the model exploded across 2024 and 2025.

Historically, the pump ran through a classic boiler room setup: cold callers pushing penny stocks, small-cap stocks, or micro-cap stocks onto retail buyers. Stratton Oakmont, Jordan Belfort's firm from The Wolf of Wall Street, ran this playbook across 34 companies over seven years. Bre-X engineered a CAD $6 billion fraud on gold mining stock from 1996-97. Enron executives effectively pump-and-dumped their own company, dumping more than $1 billion in overvalued stock before the 2001 collapse. Same trick, different decades, different markets.

Today the same manipulation scheme lives mostly on-chain and on social media. The promoter hypes a token or a penny stock through Telegram, Discord, Twitter/X, or TikTok. Unsuspecting investors buy in at the inflated price. The fraudsters dump their shares and stop promoting. The chart collapses. Investors lose money. The cycle repeats on a new ticker the next week.

How a pump-and-dump scheme works

Every pump-and-dump scheme follows the same three-stage mechanic. Understanding it is the single most useful thing a trader can learn.

Stage one: accumulation. The organizers quietly buy up a target token or stock while the price is low and trading volume is thin. For a crypto meme coin, this often means minting the token themselves and pre-seeding it into a handful of wallets, sometimes 20 or 30 addresses controlled by the same operator. For a penny stock, it means buying up a chunk of the float before any promotion begins.

Stage two: the pump. The organizers launch coordinated hype. Telegram groups light up with "launch alerts." Paid influencers post on X. TikTok finfluencers feature the token in countdown videos. Fake partnership announcements and screenshots of exchange listings flood social media. Trading volume rises. Price climbs. Retail buyers show up, seeing a chart going straight up and news that looks positive.

Stage three: the dump. Once price and volume hit targets, the organizers sell everything. Their wallets dump into the retail flow. The chart collapses, usually 80-99% in hours or minutes. Promotion stops. The Telegram group goes silent or gets deleted. The token is abandoned within 6-7 days, per Chainalysis data on DEX pump-dump pools. The organizers net their profit; retail holders own a worthless ticker.

La Morgia et al's 2022 academic paper ("The Doge of Wall Street") and Kamps and Kleinberg's 2018 study documented this exact mechanic across hundreds of cases. The pattern is statistical, not anecdotal.

Three stages: pre-pump, pump, dump

To make the mechanic concrete, here is what each stage looks like from the outside if you are a retail trader scrolling X or Telegram.

• Pre-pump (days to weeks before): A new token ticker appears. A few small accounts mention it. An influencer might tweet "watching $XYZ." Volume is tiny, chart is flat or slowly rising. This is when the organizers load up.
• Pump (hours to days): The ticker trends. A "big reveal" video drops. Volume spikes 10-100x. Price climbs 5x, 10x, sometimes more. Telegram groups urge "don't miss this." Small timers count down to "listing."
• Dump (minutes to hours): The chart flattens, then falls. Retail keeps buying the dip. Price falls again. The chat goes quiet. Within 24 hours the token is worth a tiny fraction of its peak.

If you can identify which stage you are looking at before buying, you can avoid 90% of losses. The easiest version of this is the "is it still pumping or already dumping" question. On a chart with 10-20 consecutive green candles and almost no red candles, you are somewhere inside the pump. Entering near the top is where most retail money dies.

Famous pump and dump cases in cryptocurrency

A short catalog of the reference cases. Read these carefully because they are the blueprint for everything else.

Several of these trace back to one operator group. Court filings name Hayden Davis and Kelsier Ventures as the thread connecting LIBRA, MELANIA, and roughly 15 related tokens. That level of concentration is a specific pattern: a handful of professional operators running the same playbook on different brands.

UCL's Perseus research project, published in March 2025, identified 438 suspected masterminds behind 322 coordinated pump-dump coins on crypto markets. The industry looks decentralized from the outside. On the inside, it's a small guild.

Pump-and-dump scheme in the cryptocurrency market

The cryptocurrency market structurally rewards pump-and-dump activity in ways that the regulated stock market does not. Token creation on Solana or BNB Chain costs pennies. Liquidity pool setup takes minutes. Wash trading volume can be generated with a few wallets and a script. Telegram and X provide cheap distribution to millions of retail buyers. No listing committee decides if a token is legit. No SEC filing is required to launch one.

Solidus Labs' March 2025 analysis of Pump.fun put hard numbers on this. Of 11.9 million tokens launched since January 2024, 98.6% ended as pump-and-dumps or rug pulls. Raydium liquidity pools: 93% of 388,000 pools analyzed showed soft-rug behavior. Pump.fun alone accounts for 71-80% of all daily Solana token launches in a given month.

Chainalysis data aligns. 94% of DEX pump-dump pools get rugged by the pool creator. Rug-pull losses climbed from $1.3 million in 2022 to $94.8 million in 2024, and 2025 surpassed both as the highest year on record. Chainalysis's 2026 Crypto Crime Report put total illicit flows at $154 billion, with scam-related losses around $17 billion. The average scam payment jumped 253% to roughly $2,764. The cryptocurrency market is the single biggest pump-and-dump arena the world has ever hosted.

Red flags: how to spot a pump and dump early

A working red-flag checklist based on pattern data from 2024-2025. Any single one of these should slow you down; two or more should make you pass.

• A new token or low-float stock going parabolic within its first 24-48 hours.
• Trading volume spikes 10-100x without a real news catalyst.
• Heavy shilling from paid influencers or anonymous X accounts all posting the same screenshots.
• Anonymous or pseudonymous team with no LinkedIn, no public interviews, no product history.
• Wallet concentration: one address owns more than 20% of supply, or two or three addresses own more than 60%.
• Liquidity not locked, or lock expires in days rather than months.
• Urgency language: "last chance," "1000x this week," "only 1,000 wallets can mint."
• Telegram or Discord with thousands of members but conversations feel scripted and repetitive.
• No audits from a reputable security firm (Halborn, CertiK, Trail of Bits, SlowMist, PeckShield) or a fresh audit from a firm nobody has heard of.
• All-green candle chart with almost no sell transactions. Real tokens have both.
• Telegram admins deleting negative questions or banning skeptical users.
• A celebrity or politician promoting the token inside the first week of launch.
• The team suddenly announces a "partnership" with a major company that has not announced anything on its own side.

If three of these stack up at the same time, you are almost certainly looking at a pump-and-dump scheme.

On-chain signals of a crypto pump and dump

Beyond the qualitative red flags, on-chain data gives you harder signals. For any new token, check these before buying.

• Top 10 holders concentration. On Etherscan, BscScan, or Solscan, look at the top holders panel. If the top 10 wallets own more than 60-70% of circulating supply, the token is structurally a pump candidate. Organizers need concentrated supply to exit cleanly.
• Early wallet analysis. Look at the wallets that bought in the first block or first minute. If there are 10-30 wallets that all bought within 60 seconds of launch, you are looking at the operator's cluster.
• Liquidity pool status. Check the LP token. Is it locked on Unicrypt, Team Finance, or burned? If the deployer holds the LP tokens unlocked, they can pull liquidity at any moment.
• Buy-to-sell ratio. On DEXTools, the "all buys no sells" pattern is a tell. Either the token is a honeypot (can't sell) or the operator has not begun dumping yet. Both are bad news.
• Whale wallet behavior. Tools like Nansen let you watch specific large wallets. If known "insider" or "smart money" wallets are selling while a token is pumping, the retail top is near.

The academic paper by Xu and Livshits (2019) showed that combining these on-chain signals correctly predicted pump events more than 70% of the time. The signals are not secret. Operators know about them and still run the playbook, because most retail traders never check.

Detection tools for every pump and dump setup

Use these free or low-cost tools before committing to any new token. Run every new ticker through at least two of them.

None of these is perfect. Fraudsters specifically test their tokens against the main scanners before launch to dodge the automated flags. But combining two or three of them catches the vast majority of pump-and-dump setups.

Avoiding Telegram pump and dump groups

Telegram and Discord pump-and-dump groups are a specific sub-category of the scheme. The organizers promise participants that "we will all buy coin X at 3 PM EST Monday" in exchange for a paid subscription. The pitch is that early members will benefit from the pump before retail outside the group catches on.

What actually happens: the organizers bought the coin days earlier at a lower price. When "launch time" hits, group members buy at the inflated price. The organizers sell into that buying pressure. Group members are the dump, not beneficiaries of the pump.

CFTC and SEC have prosecuted Telegram pump operators in both the US and Europe. The FBI's NexFundAI operation in October 2024 was the first crypto-specific sting where the DOJ created a decoy token and watched pump operators recruit and pay for coordinated buying. Ten individuals and four crypto firms were charged.

The rule is simple: any Telegram or Discord group that says "we coordinate pumps together" is a scam, and the people running it are profiting from the members, not with them. A "pump signal" that costs $50 a month is extracting value from you on day one.

Legal action, SEC, CFTC, and the whistleblower path

The regulatory landscape in 2026 has specific teeth.

SEC and CFTC both run whistleblower programs paying 10-30% of collected sanctions above $1 million. The SEC's Office of the Whistleblower, under Dodd-Frank, has paid hundreds of millions to informants since 2011. FinCEN has its own parallel program for Bank Secrecy Act violations (also up to 30%). Oppenheimer & Co. paid a $20 million fine for failing to report 16 pump-and-dump schemes. Arbitrade's SEC case captured $36.8 million in proceeds. McAfee's estate settled a $300,000 CFTC fine on his first digital currency manipulation case.

In 2025, two major developments shifted the crypto-specific enforcement environment. On February 27, 2025, the SEC staff issued a formal statement that memecoins are "generally not securities," with Commissioner Crenshaw dissenting. That narrowed the SEC's direct jurisdiction over meme coin pump-and-dumps, pushing enforcement more toward the CFTC (via commodity fraud theories) and the DOJ (via wire fraud). In September 2025, the SEC launched a Cross-Border Task Force aimed at overseas ramp-dump rings, particularly Chinese-origin schemes. Nasdaq imposed a $25 million minimum float requirement partly to deter micro-cap pumps on its listings.

Criminal outcomes are real. Braiscompany defendants received 171 years of combined sentences in April 2025 across a $1.11 billion crypto Ponzi case. Jordan Belfort (Stratton Oakmont) did prison time. Stock-market operators Spear & Jackson paid $8 million; Morrie Tobin forfeited $4 million after a guilty plea. The tools exist. Whether victims of a specific pump-and-dump actually see money back depends on whether assets were traced and frozen quickly.

What to do if you got caught in a pump and dump

Honest answer first: recovery for retail pump-dump victims is unusual. But there are specific steps worth taking.

1. Stop the bleeding. Do not "average down" into a dumping token. The chart is not recovering. Exit any remaining position into the highest-liquidity moment you can find.

2. Document everything. Transaction hashes, screenshots of Telegram messages, dates, URLs, the wallet you sent funds from, the wallet you received tokens at. Keep copies off-device.

3. Revoke token approvals. Use Revoke.cash or Etherscan's Token Approval Checker to kill any lingering permissions you granted to the token contract.

4. Report the scheme. File with the SEC Complaint Center (sec.gov/tcr), the CFTC (cftc.gov/complaint), FinCEN if banking rails were involved, and the FBI's IC3 (ic3.gov). In the UK, Action Fraud. In the EU, the national equivalent.

5. Report the token. Post the contract address on Etherscan/BscScan/Solscan comments, Token Sniffer, and the token's Telegram or Discord if it still exists. Other buyers will see your warning.

6. File with stablecoin issuers. If stolen funds were moved in USDT or USDC, report to Tether and Circle. Their freezes are one of the few real recovery paths.

7. Ignore recovery services. If a random account messages you offering to recover your funds for an upfront fee, that is a second-stage scam. 100% of the time. Block, report, move on.

Recovery odds are below 10% for individual victims in most cases. Be honest with yourself, take the lesson, and make the next trade smarter.

Marco Lucchetti

Marco Lucchetti is a senior content strategist and blockchain analyst at Plisio. With over 7 years of experience in cryptocurrency research, DeFi protocols, and payment technologies, Marco specializes in creating clear, data-driven content for a global crypto audience. His work focuses on transaction tracing, crypto compliance, and the future of blockchain infrastructure.