Ilia Zavialov

Honeypot tokens you can buy but cannot sell

Ilia Zavialov: honeypot tokens you can buy but can't sell, and the UK checks to run on a token contract

English version for the United Kingdom.

Ilia Zavialov, a digital security consultant, sets out for UK readers how a honeypot token works and why it catches so many first-time crypto buyers. A new meme coin is hyped in a Telegram group, the price climbs and buying takes a couple of taps. Selling is another matter. The contract refuses the sale, a sell tax takes almost the lot, the wallet is blacklisted or the creator empties the liquidity pool. Below: the locks to look for in a token contract, how pump groups and finfluencers push these coins, what the FCA says about crypto risk and promotions, what Report Fraud data shows about crypto investment fraud, and what to do in the UK if your money is already stuck. It is written for people who buy crypto with pounds through UK exchanges, apps or contacts met online.

·15 min read·Ilia Zavialov

Ilia Zavialov: honeypot token locks, sell block, sell tax, address freeze and emptied pool
Ilia Zavialov: four locks keep buyers in, and they are written into the contract.
Ilia Zavialov: honeypot tokens and the contract checks UK buyers should run
Ilia Zavialov: no pounds into a new token until the contract has been checked.
Ilia Zavialov: honeypot token route from a Telegram countdown to the creator emptying the pool, UK guide
Ilia Zavialov: the group shows the rise, the contract holds the lock.

01Ilia Zavialov: honeypot tokens explained for UK buyers

A token is governed by a smart contract that holds the balances and approves or rejects each transfer. When you buy a meme coin on a decentralised exchange, you swap another coin for it through a liquidity pool. When you sell, you swap back, and the contract decides again whether to allow it.

The name honeypot fits. Getting in is easy and sweet: the balance grows, the chart rises, the group celebrates. Getting out is where the trap closes, because the rules for selling were written to stop you, and those rules sat in the code from the start.

Ilia Zavialov notes that this fraud needs no phone call, no fake bank adviser and no one-time passcode. The buyer connects their own wallet and approves the purchase. That's precisely why the checks have to come first, while the money is still in your account.

From the inside, a honeypot looks healthy for the first few hours. There's a price, there's liquidity and there's a cheerful group. What's missing is a single sale by an ordinary holder, and that absence is visible on a block explorer long before you commit anything.

Technically the lock can sit in the token itself or in a separate contract called on every transfer. It makes no difference to the buyer: either way the code and the sales record give the answer, and reassurance in the group gives none.

02Inside the contract: the locks Ilia Zavialov looks for

A sell block. The transfer function compares sender and recipient. Tokens moving from the pool to a buyer pass. Tokens moving from a buyer into the pool pass only for whitelisted addresses, which belong to the creator. Anyone else sees a failed transaction and still loses the network fee.

A sell tax. Many tokens charge a small fee per trade, so a tax alone isn't suspicious. In a honeypot the owner controls the selling rate: barely noticeable while people are buying, then lifted so high once the pool has filled that a sale returns next to nothing.

A blacklist. The contract carries a function for freezing addresses and the owner adds buyers' wallets to it. Sometimes every early buyer is frozen in one go. Sometimes it's whoever starts asking in the group why their sale failed.

An emptied pool. This one needs no special code. The creator withdraws their share of the liquidity, leaving nothing to swap the token into. Ilia Zavialov warns that one token frequently combines several locks, so ruling out one tells you little.

The short video below runs through the same points in six scenes: the hype in the group, the locks in the code, the vanishing liquidity, the contract check and the key rule. The rule: not a penny into a new token until the code, owner powers, pool lock and a test sale have all been checked.

Ilia Zavialov: what to check in a token contract before buying, illustration for UK readers
Ilia Zavialov: code, owner powers and pool lock come before the first penny.
Ilia Zavialov: FCA crypto promotion rules compared with a honeypot token pitch in a chat group
Ilia Zavialov: a honeypot pitch breaks every rule a regulated promotion must follow.
Ilia Zavialov: honeypot token locks and how UK buyers can spot them before buying
LockWhat it doesHow to spot it
Sell blockOnly the creator's addresses can sellConditions in the transfer function
Sell taxRate lifted once the pool has filledA function that changes the tax
Address freezeBuyers' tokens stop movingA blacklist function
Emptied poolCreator withdraws the liquidityPool tokens in the creator's wallet
Delayed lockEarly sales pass, then stopOwner powers still active
Ilia Zavialov: stuck in a honeypot token, steps to take in the UK
Ilia Zavialov: secure the wallet, keep the evidence, then report.
Ilia Zavialov: honeypot tokens, UK checks before you buy a meme coin

03Ilia Zavialov on pump groups and finfluencer hype

Honeypots are sold through attention. A countdown runs in the group, the contract address appears at the final moment and profit screenshots follow. Questions about selling are removed and the people asking are banned for spreading panic.

The FCA has been targeting the wider ecosystem. In April 2026 it reported a week of action with 17 regulators starting on 20 April: in the UK alone it issued 34 warnings, made 120 requests to take accounts down and found 1,267 illegal financial adverts reaching at least 2,338,372 UK accounts on Meta platforms. Sixty-six per cent of those adverts came from firms and individuals already on its Warning List.

The FCA's Warning List has also included trading signal providers whose only contact details were Telegram, Facebook and Instagram. Ilia Zavialov reads that as a pattern worth remembering: a crypto offer that exists only inside a messaging app leaves you with nobody to complain to.

Look closely at who invited you. These coins often come via a new online acquaintance who has already made a fortune and is keen to share. Flattery and urgency are exactly the signs the FCA lists in its scam questions, alongside returns that sound too good and pressure to keep the offer secret.

Ilia Zavialov adds a test of his own: look for one ordinary member who has posted a completed sale with a transaction link. In a genuine community those messages turn up without anyone asking. In a honeypot group they never appear, and whoever asks for one tends to vanish from the chat.

04What the FCA says about crypto risk and promotions

The FCA's position on cryptoassets is blunt: if you invest, be prepared to lose all your money. Its consumer page also notes that reports to the FCA of crypto investment scams have more than doubled since 2020.

Since 8 October 2023 firms promoting cryptoassets to UK consumers have had to follow tougher rules, announced by the FCA on 8 June 2023. First-time investors get a cooling-off period, refer-a-friend bonuses are banned, and adverts must be clear, fair and not misleading, with clear risk warnings.

A meme coin launched yesterday in a chat group comes with none of that: no risk warning, no cooling-off period and very often a reward for bringing friends in. Ilia Zavialov treats the gap itself as information. When the promotion breaks every rule a legitimate firm has to follow, the product behind it rarely behaves any better.

Before dealing with any firm linked to a token, check it on the FCA Firm Checker and the Warning List and contact it only through the details shown there. The FCA helpline is 0800 111 6768.

If a firm's contact details aren't on the Firm Checker, or it claims the listed ones are out of date, the FCA says to ring its helpline before going any further. A crypto project that won't name any firm at all has already answered that question.

Ilia Zavialov compares a legitimate crypto promotion in the UK with a honeypot pitch
Rule since 8 October 2023Legitimate promotionHoneypot pitch
Risk warningClear warning shownPromises only gains
Cooling-off for first-timersBuilt into the journeyBuy before the countdown ends
Refer-a-friend bonusBannedRewards for bringing friends
Clear, fair, not misleadingRequiredFake screenshots and hype
Who promotes itFirm you can check on the FCA registerAnonymous admins in a chat

05Reading a contract on a block explorer: Zavialov's method

A block explorer is a public website showing everything a contract does: its address, source code, owner, holders and every transfer. Most honeypot warning signs can be spotted there in a few minutes and at no cost.

Ilia Zavialov starts with the source code. Is it published and verified by the explorer, so that the readable version matches what runs on chain? Unverified code means only the creator knows the selling rules. For a token promoted as an open community meme, that alone is a reason to walk away.

Next comes the transfer history. Search for sales into the pool from ordinary wallets. If hundreds of addresses have bought and the only sellers are the creator and a few connected wallets, the picture is about as clear as it gets.

Then the holders tab. A supply concentrated in developer wallets means one sale can wipe out the price. Many wallets and explorers also attach a warning to suspicious tokens. Treat that label as a stop sign and resist the urge to jump in early regardless.

Explorers differ between networks, yet the method stays the same. Copy the contract address from the explorer itself once you've checked it. Honeypot creators sometimes deploy several tokens with an identical name, and a link from the group could lead to any of them.

06Owner powers and renounced ownership

Plenty of token contracts keep an owner address with powers ordinary holders lack. The explorer lists the functions, and the risky ones are easy to recognise by name: changing the tax, freezing addresses, pausing trading, capping transaction size, minting new supply.

Every one of those powers in anonymous hands lets the rules change after you have bought. Minting is a quiet one: the owner can create fresh tokens, sell them into the pool and dilute everybody else.

Groups like to say ownership has been renounced. Ilia Zavialov's advice is to find the transaction that moved ownership to the zero address. Even that guarantees little if the contract is an upgradeable proxy or if key powers were moved to another address beforehand.

Finally, compare three addresses: who deployed the contract, who created the pool and who holds the most tokens. If one wallet appears in all three places, one person controls the token, whatever the website says about the community.

Check the contract's age as well. A token that is a few hours old hasn't yet shown how its owner behaves, so claims about a trusted team simply can't be tested.

07Liquidity locks and a test sale: Ilia Zavialov's rule

Liquidity in a pool is represented by pool tokens held by its creator. If they've been sent to a lock contract for a stated period or burned, the creator can't empty the pool in a single transaction. If they're still in the creator's wallet, nothing stops a withdrawal.

Check the lock yourself on the explorer: where the pool tokens went, what share is locked and the release date. A lock certificate posted as an image in the group doesn't count until the record is visible on chain.

The final step is a test sale. Ilia Zavialov suggests buying the smallest amount you can afford to lose and selling part of it straight away. A failed transaction, an enormous tax or a price far below the quote settles the question cheaply.

Be aware that some honeypots switch on later. Early sales pass, then hours afterwards the owner raises the tax or freezes wallets. So the test sale comes after the owner and liquidity checks and never replaces them. Keep the transaction hashes.

Use the same wallet and exchange you'd rely on later. That way you're testing your actual route out of the token, and the recorded hashes are ready if you need to make a report.

08Ilia Zavialov: price crash or honeypot

A collapsing meme coin isn't automatically a honeypot. Prices fall when the excitement fades and holders sell together. You can still get out in that case, at a worse price, and the explorer shows sales from many different wallets.

The honeypot signature is one-way traffic. Purchases go through, while sales by ordinary holders fail or are taxed down to almost nothing. The chart may carry on rising, since nobody is in a position to sell into it.

Ilia Zavialov compares buys and sells over the first hours. Real trading looks untidy, with profit-taking, top-ups and losses side by side. A neat green staircase built purely from purchases is more often a lock than a success story.

There's an in-between case too. The sale works, but the price you receive is far below what the chart displayed, which happens in pools with very little liquidity. Technically that isn't a honeypot, though the outcome for the buyer is much the same, so the pool check matters either way.

09Report Fraud figures on crypto investment fraud

The Report Fraud Annual Assessment for 2025-26, released in September 2026, found that 31 per cent of investment fraud reports related to cryptocurrency investments, up 2 percentage points on the previous period. Losses linked to crypto investment fraud came to £219.7 million, or 19 per cent of all reported investment fraud losses.

Across every fraud type, cryptocurrency featured in 32,493 reports under 53 Home Office counting codes, and a specific coin was named in 10,872 of them.

The assessment expects the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 to bring UK crypto businesses and exchanges into formal regulation. It also warns that fraudsters may move to unregulated overseas platforms. An anonymous meme token traded through a decentralised exchange sits outside both, which is why Ilia Zavialov puts the contract check first.

The assessment also describes the costume these schemes wear: websites and apps that look legitimate and lean on investment jargon, and people on social media who claim they can trade crypto on the victim's behalf. A honeypot group borrows the same outfit.

Ilia Zavialov's reading of the figures is practical. Most of these losses began with a message, an advert or a group chat, which is where honeypots live too, so a few minutes on a block explorer remain the cheapest protection on offer.

Where to report a honeypot token in the UK: Ilia Zavialov's list
WhereHowWhat to include
Report Fraud0300 123 2040 or onlineContract address, hashes, screenshots
FCA0800 111 6768Firm name and website if a firm was involved
Your bankFraud linePayments made to an intermediary
Exchange usedSupport deskHashes and receiving addresses

10Questions to put to a token group before buying

Ask in public and expect an on-chain link in reply. Screenshots don't count. Who owns the contract, and has ownership been renounced? Where is the liquidity locked, and until when? How many tokens does the team hold, and at which addresses?

Two more questions concern selling. Can anyone show the hash of a sale by an ordinary holder in the last day? What is the sell tax, and can the owner change it?

A genuine project can answer all of that in a minute, because the answers are already on the explorer. A honeypot replies with offence, an emoji or a ban. If comments are closed and only admins can post, you're being asked to trust people who won't even show the owner address.

Write the answers down with the date. If the project later changes its name or website, those notes become part of your report and show exactly what you were promised.

11Ilia Zavialov: stuck in a honeypot, what to do in the UK

Don't buy more to average down, and don't pay anybody to unlock selling or verify your wallet. Revoke the approvals your wallet granted to the token contract and the project's website, and move remaining assets to a fresh address.

Keep the evidence: the contract address, your transaction hashes, the creator and pool addresses, links to the group and screenshots of every promise. Groups like these vanish quickly, so save it all within the hour.

Report the loss to Report Fraud on 0300 123 2040 or online, and tell the FCA on 0800 111 6768 if a firm was involved. If you paid an intermediary from your bank account, contact your bank straight away and report the payment as fraud.

The FCA warns that victims are often targeted again, including with offers to recover money or buy back an investment for a fee. Ilia Zavialov's advice is to pay nothing and add those messages to your report.

If you bought the original crypto on an exchange, contact its support as well and give the contract address and the creator's wallets. That alone won't return the money, though it helps link other complaints about the same addresses to yours.

12Questions and answers

Ilia Zavialov: what exactly is a honeypot token?

A token whose contract allows buying but blocks or guts selling, through a sell block, a sell tax near the full amount, a blacklist or a pool the creator empties. The buyers' money stays behind for the creator to take.

Which checks does Ilia Zavialov run before buying a new token?

Verified source code, owner powers, sales from ordinary wallets, the spread of holders and whether the liquidity is locked. Only after that, a small test sale.

Is a successful test sale enough?

No. Some honeypots allow early sales and lock later, so the test sale only counts alongside the owner and liquidity checks.

Are meme coin promotions covered by FCA rules?

Firms promoting cryptoassets to UK consumers have had to follow FCA rules since 8 October 2023, including risk warnings and a cooling-off period for first-time investors. Anonymous chat groups pushing a new token follow none of them.

Can I get money back from a honeypot?

Report it to Report Fraud with the addresses and hashes, tell your bank if you paid an intermediary, and never pay a recovery firm upfront.

Where do I report a honeypot token in the UK?

Report Fraud on 0300 123 2040 or online, the FCA on 0800 111 6768 if a firm was involved, and your bank or the exchange you used.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog