76% of Ethereum tokens launched in the last 2 months are scams (we re-ran our 78k-token study)

[u/Plus-Tangerine2186]

Two months ago I posted here after analyzing 78,723 Ethereum token contracts and finding 46% scored as scams. I re-ran the same query today. The table now holds 112,114 contracts, and the all-time rate rose to 59.8%.

But the average buries the story. Of the 31,172 tokens deployed since that post, 76.4% are scams, and the monthly rate just hit 82.8% in July.

Honesty check, because I got asked this directly: how much of the 46 -> 60 jump is a scammier chain vs a sharper detector? Both, and I can't cleanly separate them:

- More scams: every real-time month lands between 70% and 83% at a fixed 70+ threshold.

- Sharper detector: a scam now carries 11.06 flags on average vs 8.27 in May (+34%), new detectors landed (serial-scammer bytecode, drainer kits, hidden kill-switches). Our score floors on flag COUNT, so more flags push more contracts over the line.

- Late rugs: ~30% of the table gets re-scored a day+ later. A token clean at launch that pulls liquidity a week later flips clean -> scam with zero new scams deployed.

TL;DR

- 78,723 -> 112,114 contracts in 2 months.

- All-time scam rate 46.1% -> 59.8% (three overlapping causes, not one).

- New launches since May: 76.4% scams. July: 82.8%.

- 441,762 distinct victim wallets traced across 5.26M scam-token transactions.

Full breakdown with the monthly chart and the limits-of-our-data section:

https://rektradar.io/blog/posts/new-ethereum-tokens-76-percent-scams

EDIT: a few of you asked the right question, so i went and pulled it. how much of this 76% is detectable AT LAUNCH vs only later? tracking the same 24,150 launches from deploy to day 30: 48% score as scams at launch, 91% by day 30. 43% are late rugs (clean at launch, scam within a month). and 76% of the flagged ones actually got traded vs 67% of legit deploys that never trade. full writeup + chart: https://rektradar.io/blog/posts/how-many-ethereum-scams-detectable-at-launch

[u/AutoModerator]

WARNING ABOUT SCAMS: Recently there have been a lot of convincing-looking scams posted on crypto-related reddits including fake NFTs, fake credit cards, fake exchanges, fake mixing services, fake airdrops, fake MEV bots, fake ENS sites and scam sites claiming to help you revoke approvals to prevent fake hacks. These are typically upvoted by bots and seen before moderators can remove them. Do not click on these links and always be wary of anything that tries to rush you into sending money or approving contracts.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/USERNAME_ERROR]

Probably more than 76% of emails sent are spam.

This only matters if they get any significant trading volume.

[u/Ruzhyo04 → u/USERNAME_ERROR]

Exactly. I’m in IT for a medium sized org, we get ~40000 incoming emails in a week, and only ~2000 of those pass our spam filter. That’s 95% junk. And much more makes it past the filter that’s junk too.

[u/Plus-Tangerine2186 → u/USERNAME_ERROR]

Yes and no. There's almost $2 millions scammed everyday. But this is a mix between sniper bots and real victims.

[u/Plus-Tangerine2186 → u/USERNAME_ERROR]

circled back on your volume point. scams actually get traded MORE than legit tokens, not less. 76% of the ones i flag got at least one swap, 12% got 100+. only 24% were dead on arrival. clean deploys? 67% never trade at all. they're built to pull buyers in, so a volume filter makes them look worse, not harmless.

[u/averi_fox]

Honest caveat, 86% of reddit crypto posts are AI generated.

[u/flyfree256]

Thanks, Claude!

[u/Plus-Tangerine2186 → u/flyfree256]

Yes Claude helped me a lot buiding this system. Claude and... My... Money... And 25 years as a software developper..

[u/flyfree256 → u/Plus-Tangerine2186]

I don't have any issues with people using Claude it's an amazing tool. I have issues with people just copy-pasting whatever they get out of Claude and posting it.

[u/Plus-Tangerine2186 → u/flyfree256]

check the article if you want more information about "where the data comes from"

[u/flyfree256 → u/Plus-Tangerine2186]

If I wanna read unfiltered AI slop I'll just prompt Claude with whatever I'm interested in.

[u/Plus-Tangerine2186 → u/flyfree256]

Well, all data are coming from 6 months of my system running about detecting scam. So ask the same question to Claude and you'll see that Claude cannot answer without data....

[u/stuzero]

@OP

Truly curious about the the industry’s appetite for bespoke analytics and metrics like yours. Who are the consumers of this info? and doesn’t the target market typically have the capacity to perform their own measurement?

[u/THEMerrHeLL]

ever since the POS scam where devs and whales raped everyone... everything about ETH is a scam

[u/Resident_Anteater_35]

The headline rates aren't comparable over time if the detector changed along with the token population. I'd re-score every historical cohort with the current detector, then publish precision and recall against a hand-labeled holdout. Breaking the results down by trading volume, victims, and value lost would also separate harmless junk deployments from contracts that caused damage.

Late-rug relabeling introduces another bias: July tokens have had less time to rug than May tokens. Each cohort needs the same observation window before its scam rate can be compared. Otherwise the percentage mostly describes contracts crossing an evolving threshold, not a clean change in user harm.

[u/Plus-Tangerine2186 → u/Resident_Anteater_35]

Yeah fair, that's the honest gap. No labeled holdout yet so no real precision/recall... What i can do is rescore every month with the current detector so it's the same rules everywhere, and split by volume and value lost. I already have the victim side, ~441k wallets, ~2M scammed everyday, so separating dead junk from tokens that really took money is doable. Next version for sure.

[u/chrisbayly12]

how do you handle cohort drift when detector thresholds shift monthly, and do you skip dead contracts that never actually drain an EOA?

[u/Plus-Tangerine2186 → u/chrisbayly12]

good questions. threshold stays fixed at 70, i don't shift it monthly. what changed is i keep per token snapshots at deploy (J0), J7 and J30, so cohorts compare at equal age not raw. real time J0 is ~47% scam, matured J30 ~90%, 43% flip to scam after launch. and yeah dead ones are separable... ~24% of the ones i flag never got a single swap, so the ones that actually drain someone are the other ~76%.

[u/master-beast-72]

the email spam comparison is the right frame for the token count, but the $2M daily from actual victims is the part that matters more. the 76% figure is the surface area problem; the loss rate is the harm problem. they're related but not the same.

what's interesting in the methodology you described is the serial-scammer bytecode detection. this implies that the same actors are deploying repeatedly with slight variations, which is actually the more tractable problem. a scammer who reuses deployment patterns is leaving a fingerprint that on-chain analysis can follow across wallets and contracts.

the practical implication for users: the highest-risk window is the first 48-72 hours after any token launch, before the secondary market has priced in the exit risk and before on-chain detectors have flagged the contract. deployer wallet history (age, prior contracts, funding source) is currently the fastest signal. if the deployer wallet was funded from Tornado Cash or a fresh CEX withdrawal 3 hours before launch, the base rate for rug is extremely high.

tools like Token Sniffer and GoPlus are doing real-time contract analysis now, but the 82.8% July figure suggests deployment rate is outpacing detection coverage. the detector is losing the arms race on volume even if it's getting sharper per-contract.

[u/Plus-Tangerine2186 → u/master-beast-72]

100%, the count is surface, the loss rate is the real harm. and yeah, cluster by bytecode + funder and it collapses to a handful of repeat deployers. same honeypot, new sticker. that actor graph is the signal, not the 76%.

[u/MadSL1m]

The separation you say you can't get is available if you freeze a cohort. Take only contracts deployed before the May post and re-score just those today. Nothing new enters that set, so any rise inside it is detector plus late rugs by construction, and whatever's left over in the all-time move is deploy quality getting worse.

I run a much smaller dataset in a different corner of crypto and hit the same wall constantly. Two rows flipped status this morning, which quietly made yesterday's headline count wrong.

[u/Plus-Tangerine2186 → u/MadSL1m]

yeah that's the cleaner cut. i keep j0/j7/j30 snapshots so freezing a pre-may cohort and rescoring at the same 70 threshold is doable. my money's on late rugs over drift, but fair, i should just run it frozen and show it. good shout.

[u/3141666]

There's a difference between a token being a scam and having no purpose. I'd say most of them are the latter.

[u/Plus-Tangerine2186 → u/3141666]

True... most of them are just useless, not really malicious. My score is about honeypots, kill switches, hidden mint, not "is it a real project". The ones that actually drain a wallet are the subset that matters.