Honeypot tokens you can buy but cannot sell
Ilia Zavialov: honeypot tokens you can buy but can't sell, and how to check a token contract before you buy
English version for the United States.
Ilia Zavialov, a digital security consultant, explains the honeypot token: a meme coin that anyone can buy and almost nobody can sell. The chart climbs, the Telegram group counts the gains, and the buy button works in seconds. The trouble starts when you try to cash out. The contract blocks the sale, a sell tax eats nearly all of it, your wallet lands on a blacklist, or the creator pulls the liquidity out of the pool. This guide walks through how those traps are built, the warning signs in pump groups, how to read a token contract on a block explorer before you buy, why a small test sell matters, what the SEC, CFTC and FTC say about meme coins and pump-and-dump schemes, and where to report a loss in the US.
01Ilia Zavialov: what a honeypot token is and why you can't sell it
Every token on a blockchain runs on a smart contract. The contract keeps the balances and decides which transfers go through. Buying a meme coin on a decentralized exchange is really a swap: you put one coin into a liquidity pool and take the token out. Selling is the same swap in reverse, and the token contract gets a say in it every single time.
A honeypot is written so that the first swap works and the second one doesn't. From the buyer's side everything looks normal. The wallet shows a growing balance, the chart in the group keeps rising, other members post screenshots. The problem only shows up on the way out, and by then the money is sitting in the pool where the creator can take it.
Ilia Zavialov points out what makes this scam unusual. Nobody calls pretending to be your bank, nobody asks for a code. You connect your own wallet and press the button yourself. That's why protection has to happen before the first purchase, while the money is still yours.
There are plenty of these tokens because launching one is cheap and fast. A token contract can be deployed and paired with a pool in an evening, with no listing review of any kind. The same evening it can be promoted across chat groups.
Some locks live in a separate contract that the token calls on every transfer. For the buyer that detail changes nothing: the answer still comes from the code and the sales history, and promises in the group can't stand in for either.
02Four ways a contract traps buyers: Ilia Zavialov's breakdown
The first trap is a plain sell block. The transfer function checks who is sending tokens and where. Transfers from the pool to a buyer are allowed. Transfers from a buyer back into the pool are allowed only for addresses on a whitelist, meaning the creator and his wallets. Everyone else gets a failed transaction and still pays the network fee.
The second trap hides behind a tax. Plenty of tokens openly charge a small fee on each trade, so buyers are used to it. In a honeypot the owner can change the sell rate whenever he likes. It starts at zero, and once the pool fills up it gets raised to nearly the whole amount. The sale technically goes through and returns pennies.
The third trap is a blacklist. The contract includes a function that lets the owner add addresses, and tokens at those addresses stop moving. Some contracts blacklist every early buyer automatically. Others do it by hand, usually to the people asking awkward questions in the group.
The fourth trap needs no clever code at all. The creator sets up the pool, waits for buyers to fund it, then withdraws his share of the liquidity. You can still sell in theory, but there's almost nothing left to swap into and the price collapses toward zero. Ilia Zavialov says to check for all four at once, because a single honeypot often stacks several of them.
The short video below covers the same ground in six scenes: the pump in the group, the sell block and tax in the code, the blacklist, the pulled liquidity, the contract check and the main rule. The rule is simple: not a dollar into a new token until you have checked owner privileges, the pool lock and a test sell.
| Trap | How it works | Where to look |
|---|---|---|
| Sell block in the code | Only whitelisted addresses can sell into the pool | Transfer function, sells from ordinary wallets |
| Sell tax | The owner raises the rate to nearly the full amount | A function that changes the tax |
| Blacklist | Buyer addresses get frozen by hand or automatically | A function that adds addresses to a list |
| Pulled liquidity | The creator withdraws his share of the pool | Pool tokens not locked |
| Pause or max transaction | Trading stops or sells get capped | Pause and limit functions |
03How meme tokens get pumped in chat groups
The CFTC described the mechanics back on February 15, 2018, in an advisory on virtual currency pump-and-dump schemes. Some of these groups have thousands of members. On the day of the scheme the organizer counts down to the buy signal, then posts the coin and the exchange. In the agency's example the whole buy and sell cycle was over in less than eight minutes.
The agency also noted who usually wins: the people pulling the strings get out first, and everyone else scrambles to sell. In a honeypot that scramble goes nowhere, because the contract only lets the insiders out.
Some pumps lean on fake news, the CFTC wrote, usually a story that a famous tech founder or investor is about to put millions into a small coin, or that a big retailer, bank or card company plans to partner with it. The links come with posts that push you to buy right now.
Investor.gov, the SEC's site for individual investors, describes the general pattern the same way. Fraudsters spread false or misleading information to create a buying frenzy, sell their own holdings at the inflated price, and the price then typically falls. The hype travels through social media, newsletters, online ads and internet chat rooms.
Ilia Zavialov adds one point about honeypots in particular. A classic pump needs fresh buyers for the insiders to sell to. A honeypot doesn't even need that, since the contract makes sure nobody else can sell, and the pool simply keeps collecting money.
04Ilia Zavialov on chat red flags that point to a honeypot
The contract address appears at the last second, right after a countdown. That leaves no time to open a block explorer. Questions about selling get deleted and the person asking gets banned for spreading panic. Admins keep repeating hold, don't sell, and promise the next leg up.
Watch who brought you in. These tokens often arrive through a new online friend who already made money and wants to share the link out of kindness. The FTC warns that only scammers guarantee profits and only scammers demand payment in cryptocurrency, and that celebrity endorsements and glowing investor testimonials are easy to fake.
Ilia Zavialov looks for one specific thing in any token group: a single message from an ordinary member showing a successful sale with a transaction link. Balance screenshots prove nothing, because a balance tells you how many tokens you hold and nothing about whether anyone will take them back.
Be wary of any middleman who offers to buy the token for you through a payment app and send it to your wallet later. At that point the contract barely matters. You're sending money to a stranger, and getting it back will be as hard as selling a honeypot.
| What you see | What it usually means | What to do |
|---|---|---|
| Address posted after a countdown | No time to check the contract | Skip the first minutes |
| Questions about selling deleted | Selling doesn't work | Leave the group |
| Guaranteed profit | Only scammers guarantee profits, says the FTC | Don't buy |
| Celebrity backing the coin | Easy to fake | Ignore it |
| Middleman takes your payment | Money goes to a stranger | Refuse |
| Only balance screenshots | Nobody can show a sale | Look for sells on the explorer |
05Checking the contract on a block explorer: Ilia Zavialov's order
A block explorer is a public website that shows what happens on a blockchain: the contract address, its source code, the owner, the holders and every transfer. Most of what you need to spot a honeypot sits right there, free, before you spend anything.
Step one is the source code. Ilia Zavialov first checks whether the code is published and verified by the explorer. Verified means the readable code matches what actually runs on chain. If it isn't verified, the selling rules are visible only to the creator, and for a coin marketed as a fun community meme that's already a reason to stop.
Step two is the transfer history. Look for sells into the pool from ordinary addresses. If hundreds of wallets have been buying for hours and the only sellers are the creator and a handful of wallets linked to him, you're almost certainly looking at a trap.
Step three is the holder list. When most of the supply sits in developer wallets or one unexplained address, a single sale can crash the price. The same list often shows the first buyer: an address that received tokens right after the pool was created frequently belongs to the creator. Wallet apps and explorers also flag suspicious tokens, and that warning is worth taking seriously.
06Owner privileges: what Ilia Zavialov looks at first
Many token contracts have an owner, an address with special powers. The explorer lists the contract's functions, and the names alone say a lot. The worrying ones change the tax, add addresses to a blocklist, pause trading, cut the maximum transaction size or mint new tokens.
Each of those powers in anonymous hands means the rules can change after you buy. Today the sell tax is zero, tomorrow it's nearly total. Today you can sell any amount, tomorrow anything above a crumb gets rejected. Minting lets the owner print fresh tokens and dump them into the pool, diluting everyone else.
Groups often reply that ownership has been renounced. Check it yourself: the owner address should change to the zero address, and that change shows up as its own transaction. Even then, renouncing means little if the contract is an upgradeable proxy whose logic can be swapped, or if the dangerous powers were handed to another address beforehand.
One more check needs no code. Compare the address that deployed the contract, the address that created the pool and the largest holders. If it's the same wallet everywhere, one person controls the token no matter what the website says about community ownership.
07Locked liquidity and a test sell
Pool liquidity belongs to whoever created the pool, and it's represented by special pool tokens. If those were sent to a lock contract for a clear period, or burned, the creator can't drain buyers' money in one transaction. If they sit in his wallet, the pool can be emptied at any minute.
You check this on the explorer too: where the pool tokens went, what share is locked and until when. A screenshot of a lock certificate in the group proves nothing unless you can find the record on chain yourself.
The last check is the most direct one. Ilia Zavialov suggests buying the smallest amount you're willing to lose and immediately trying to sell part of it. A failed transaction, a giant tax or a fill price far below the quote gives you the answer for the cost of a cheap lesson.
A test sell has limits. Some honeypots let early or small sells through and switch the lock on later, once more money is in the pool. So the test comes last, after the owner and liquidity checks, and it never replaces them. Use the same wallet and the same exchange you'd use later, and save the transaction hashes.
| Step | Where | Stop sign |
|---|---|---|
| Source code | Block explorer, contract tab | Code not verified |
| Owner powers | Contract function list | Tax change, blacklist, pause, mint |
| Transfer history | Sells from ordinary wallets | Only the creator sells |
| Holders | Supply distribution | Most tokens with developers |
| Liquidity | Where the pool tokens went | Pool not locked |
| Domain age | lookup.icann.org | Site registered days ago |
| Test sell | Smallest possible amount | Failure or huge tax |
08Ilia Zavialov: a normal price drop or a trap
Not every meme coin crash is a honeypot. Prices also fall when the hype fades and holders all sell at once. In that case you can still sell, just for less, and the explorer shows sells from lots of different wallets.
A honeypot gives itself away through asymmetry. Buys go through, while sells from ordinary wallets either fail or execute with a tax that swallows almost everything. The chart may even keep rising, because nobody is actually able to sell into it.
Ilia Zavialov compares buys and sells over the first hours of trading. A live market looks messy: some people take profit, some add more, some sell at a loss. A smooth green staircase made only of buys more often points to a lock than to a hit.
There's also a middle case. The sale goes through, but the price you get is far worse than the chart showed. That happens in pools with very thin liquidity. Strictly speaking it's not a honeypot, yet the buyer ends up in a similar place, so the pool check matters in both cases.
09What US regulators say about meme coins and pump-and-dumps
On February 27, 2025, the SEC's Division of Corporation Finance issued a staff statement on meme coins. It described them as crypto assets inspired by internet memes, characters, current events or trends, and said transactions in the type of meme coins it described do not involve the offer and sale of securities.
The practical consequence is spelled out in the same statement: neither meme coin purchasers nor holders are protected by the federal securities laws. Fraud connected with meme coins may still be pursued by other federal or state agencies under other laws. For a buyer that means no registration documents to read and no disclosure rules working for you.
The CFTC's advice from its pump-and-dump advisory still holds: don't buy coins or tokens because of a single tip, especially one from social media, don't trust ads or websites promising quick wealth, and don't join pumps, because market manipulation is illegal. There is no such thing as a guaranteed investment or trading strategy.
In a separate advisory on AI trading bots, the CFTC suggested looking up the age of a project's website domain at lookup.icann.org. Ilia Zavialov finds this handy for meme tokens: a project that claims a seasoned team and has a domain registered last week has answered the question itself.
The FTC also contrasts the two ways of paying. Credit and debit cards come with legal protections if something goes wrong, while crypto transactions are typically recorded on a public ledger called a blockchain. That ledger is exactly what lets you inspect a token before you pay for it.
10The numbers: FBI IC3 data on crypto investment fraud
The FBI's Internet Crime Complaint Center received 61,559 complaints about cryptocurrency investment fraud in 2025, with reported losses of $7.228 billion. Complaints rose 48 percent and losses 25 percent compared with the year before.
Across all categories, losses with a cryptocurrency link reached $11,366,669,732 from 181,565 complaints in 2025. That is more than half of all losses the center recorded for the year, and total reported losses passed $20 billion.
These totals cover every kind of crypto investment fraud, and it would be wrong to pin them on honeypots alone. The figures show something simpler: crypto is now the main channel for investment fraud in the US, and pump groups with untested tokens sit inside that channel.
Ilia Zavialov reads the IC3 numbers as a reason to slow down. Most of these losses start with a message, a group or an ad, and a honeypot starts the same way. The few minutes spent on a block explorer are the cheapest part of any crypto purchase.
11Ilia Zavialov: the token won't sell, what to do now
Stop the bleeding first. Don't buy more to average down, and don't pay anyone to unlock selling, verify your wallet or remove a tax. Revoke the token approvals your wallet gave to the token contract and the project's site, and move your other assets to an address that has nothing to do with this.
Save the evidence: the contract address, your transaction hashes, the creator's and pool's addresses, links to the group and channel, and screenshots of the promises. These groups disappear fast, so do it in the first hour.
Then report it. The FTC lists where crypto fraud goes: ReportFraud.ftc.gov, the CFTC at CFTC.gov/complaint or 866-366-2382, the SEC at sec.gov/tcr or 1-800-732-0330, the FBI at ic3.gov, and the exchange you used to send the money. The FTC also warns that crypto payments usually can't be reversed and money typically comes back only if the recipient sends it back.
Expect a second approach. Recovery offers follow losses closely, and IC3 counted 10,516 complaints and $1.4 billion in losses to recovery schemes in 2025. Ilia Zavialov's advice is to pay nothing upfront and add those messages to your report.
12Questions and answers
Ilia Zavialov: what is a honeypot token in plain English?
A token whose contract lets you buy and stops you from selling, through a sell block in the code, a sell tax that takes nearly the whole sale, a blacklist or pulled liquidity. Buyers' money stays in the pool and the creator takes it.
How does Ilia Zavialov check a token before buying?
He opens the contract on a block explorer: is the code verified, what powers does the owner keep, are ordinary wallets selling, who holds the supply and is the liquidity locked. Then he buys the smallest amount and tries to sell part of it right away.
Does a successful test sell prove a token is safe?
No. Some honeypots let early or small sells through and lock later. The test only counts together with the owner and liquidity checks.
Are meme coins regulated as securities in the US?
According to a February 27, 2025 SEC staff statement, transactions in the type of meme coins it describes are not securities offerings, and buyers are not protected by the federal securities laws. Fraud can still be pursued by other agencies.
Can I get my money back from a honeypot?
The FTC says crypto payments usually can't be reversed. Report the loss with addresses and transaction hashes, and never pay a recovery service upfront.
Where do I report a honeypot token in the US?
ReportFraud.ftc.gov, ic3.gov, the CFTC at CFTC.gov/complaint, the SEC at sec.gov/tcr, and the exchange you used to send the money.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
13Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov fraud guide: crypto address poisoning, lookalike wallets and zero-value transfers Crypto address poisoning
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov scam and fraud guide: copy trading bots, signal groups and exchange API keys Copy trading and trading bot scams
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on hardware wallet scams: tampered boxes, pre-printed seed phrases and fake replacements Fake hardware wallet scams
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers