Before you buy a Pump.fun coin, run one short routine every time: read the creator's holdings, the first buyers, the holder spread, the socials and ticker, then curve depth and the platform's newer labels, because fewer than 1 in 100 coins ever graduate to a real pool. The routine's job is spotting the ones built to fail faster.
None of it needs an account, and the whole pass takes about a minute. The routine works in one direction, reading the coin and the people behind it with the cheapest and fastest checks first, so a clear red flag stops you before you spend time on the rest. It extends the general Solana memecoin safety checklist with the checks specific to this venue in 2026.
Every check has a blind spot, so the routine is about stacking the odds and knowing exactly what each step misses.
Read the creator and the first buyers before you read the chart
Open the coin page and read three things about supply before anything else: how much the creator kept, who bought in the first blocks, and how concentrated the top holders are. A creator sitting on a large stake, or a tight cluster of first-block wallets, is the clearest early sign a coin was built to be sold into your buy.
The coin page carries an audit panel that surfaces the numbers behind two of these checks: how much of the supply the developer kept, and how concentrated the top holders are. One fixed safe cutoff is impossible to name, but the direction is simple, since a large developer stake and a tightly held top-ten are both warning signs, and the larger each one is, the worse the risk. The same panel also shows the share held by snipers, the wallets that bought in the first blocks, and by bundlers, the wallets a creator uses to buy their own coin across many addresses at once.
Here is the limit worth holding onto. A bundler can split one position across enough wallets that a distribution check reads it as a spread-out crowd, while one person still controls most of the supply. So the panel is a first filter more than a verdict. It is far better at catching an obvious problem than at clearing a coin, because the schemes that matter are built to look clean. To judge the person rather than the snapshot, read the creator's own trading record on their wallet profile before you buy, where the closed positions show whether they have done this before and how it ended.
Do the socials and the ticker actually check out?
Check that the coin's linked socials are real and active, and that its name and ticker belong to the coin you actually meant to buy. Socials are optional and self-reported, and tickers repeat freely, so both are easy to fake and both are common ways a copycat coin rides another coin's attention.
A creator adds a name, a symbol, an image, and optional links to X, Telegram, or a website at launch, and coins with those links tend to get more attention in the discovery feed (source: Pump.fun create-coin docs). The name and symbol are immutable once set, but nothing stops a second creator reusing them, so two coins can share a ticker while pointing at completely different mint addresses. The check is to click through: open the linked account, see whether it predates the launch by more than a few hours, and confirm it actually references the coin's mint rather than just the theme.
Say a coin uses the ticker of a token trending that morning, with a fresh X account posting only that day. That is the shape of a coin borrowing recognition it did not earn. What none of this reveals is intent behind a clean-looking account: an aged or purchased handle can look legitimate on every surface check, and a matching ticker can be a careful impersonation rather than a coincidence. Treat active, coin-specific socials as one weak point in the coin's favor, never as proof.
How does curve depth affect your exit?
Read how much liquidity sits in the bonding curve, because that depth sets how badly your own exit moves the price. A thin curve means a small sell crashes the quote, so you can be right about the coin and still lose on the way out.
The Pump.fun curve is a constant-product market maker, where two virtual reserves multiply to a fixed value. Every buy moves the price up and every sell moves it down. Price impact scales with trade size, so large trades pay a worse fill than small ones (source: Pump.fun bonding-curve docs). A fresh curve is usually very thin, which means the same sell that barely moves a deep pool can drop a new coin's quote sharply, and thin liquidity punishes size in both directions.
Picture buying a few hundred dollars into a coin whose curve holds only a little SOL. Your buy alone lifts the price, and when you try to leave, your sell walks the quote back down through everyone who bought after you. The check is to read the curve's depth and imagine your exit before your entry. Depth still says nothing about whether the creator is honest: a coin can have a healthy curve and still be run by someone waiting to sell their own stack into the next wave of buyers. The same exit math applies to PUMP itself, whose PUMP/USDT market has its own depth, and the fees on each trade are part of the round trip you just pictured.
Why mint and freeze authority matter less on Pump.fun
On most Solana tokens you check whether the creator can still mint new supply or freeze your wallet. On a standard Pump.fun launch that classic rug vector is largely closed before you arrive, because the platform sets the mint authority to null by default, and the real risk moves to who holds the coin and whether they sell.
Memecoin launchpads like Pump.fun set the mint authority to null specifically to stop creators minting new tokens and draining liquidity. An un-revoked freeze authority is the other side of that: it can build a honeypot, where buyers purchase a token and are then blocked from selling it (source: Helius Solana token-authority docs). Because a standard bonding-curve launch already answers the mint-authority question, the general Solana checklist's headline check is mostly pre-resolved here, and distribution, curve depth, and the newer labels are where the real risk sits.
On a random Solana token you lead with the authority checks; on a bonding-curve Pump.fun coin you can usually assume the mint is capped and move on. A null mint authority still says nothing about the thing that empties most wallets anyway: a creator quietly selling the stack they already hold, or a coin simply being abandoned. The one place the assumption breaks is an imported coin from another chain.
Check the Mayhem badge and the cashback setting
Two launch-time settings show as labels on the coin page and change what you are actually buying. A Mayhem badge means an automated agent doubled the supply to trade the coin for its first day. A cashback setting means the creator's trading fees are redirected to buyers. Both are locked at creation, and neither can be judged from the price alone.
Enabling Mayhem Mode mints an extra one billion tokens, taking total supply to two billion. An autonomous agent then trades that supply in a random walk for the coin's first 24 hours and burns whatever supply it leaves unsold, and the docs flag the trap plainly (source: Pump.fun Mayhem Mode docs). If that agent ends up a net seller and holders then try to exit, some may be unable to sell into the bonding curve, because the added supply drained the liquidity that would have bought them back. A coin that graduated to PumpSwap escapes this, but one still on the curve can leave late sellers stuck. Separately, a Cashback Coin redirects the creator's fees to traders, and this choice is fixed at launch and permanent (source: CoinMarketCap cashback model write-up).
Read both labels for what they are. Mayhem is a permissionless beta feature, not proof of a scam, but it adds a specific late-seller risk you should price in before buying a coin still on the curve. Cashback is a fee arrangement that changes who earns from your trades; it is not a safety rating, and a coin can route fees to traders and still be dumped by its creator.
Agent deposit addresses and paid callouts change the read
Two newer features turn deposits and attention into a creator's edge, and both sit outside the price chart. A tokenized-agent coin has a unique deposit address where anyone can send funds toward buybacks. A callout is a promotion the person posting it can be paid for. Pump.fun vets neither, so treat each as a motive you can see rather than a signal you can trust.
Each tokenized agent has a unique deposit address that any user can fund with SOL or stablecoins for buybacks. The platform's disclaimer is blunt about the risk: deposits are non-refundable and final, any leftover assets can be claimed by the token creator, and the platform treats these agents as unverified and outside any escrow (source: Pump.fun tokenized agent disclaimer).
Callouts work the same way on the promotion side. Publishing one sends notifications to followers and can earn the poster rewards, yet the terms state that Pump.fun does not endorse, verify, or vet any callout or the coin behind it, and posters are only required to disclose when they hold or are paid to promote the asset (source: Pump.fun callout terms). This is exit-scam territory, where the pitch is engineered and the person making it has a position.
The worked case is a coin promoted through a callout by a wallet that already holds it, pointing you at an agent deposit address for a supposed buyback. Every piece of that is a documented, permissionless feature, and every piece serves the person on the other side. What a deposit address or a callout can tell you is the incentive; what it cannot tell you is the outcome, because a real feature used honestly and a real feature used to drain buyers look identical until the money moves.
How do imported cross-chain coins differ from Solana launches?
Since Pump.fun went multichain in 2026, some coins shown in the app trade on Ethereum, Base, or BNB Chain rather than on a Solana bonding curve. On an imported coin the curve, the capped supply, and the automatic graduation you assume from the Solana version may not apply, so the whole routine above can read differently or not at all.
Pump.fun added multichain trading across those Ethereum Virtual Machine (EVM) chains, letting users trade with SOL while the app sponsors gas on the supported networks, so the familiar interface now also wraps EVM assets that were never launched on a Solana bonding curve (source: Yahoo Finance). An imported token is a different instrument: the mint-authority-null default, the audit panel built for Pump.fun launches, and the curve-depth read are Solana-launch properties, and they do not transfer to a token that only borrowed the logo. The check is to confirm the chain and whether the coin is an actual bonding-curve launch before you apply any of the steps above.
The danger is carrying trust earned on Solana onto something with a different, often looser, structure, one of the failure modes laid out in the wider ranking of Pump.fun risks. What the interface hides at a glance is what the asset underneath actually is. An imported token may behave like any other unaudited token on its chain, priced by whatever external pool it trades in, carrying a supply you must verify by other means, and lacking the protocol-owned pool that waits at a Solana graduation.
Run the whole routine in order
Before you buy, run the checks in the order they cost you time, from the fastest supply reads to the newer labels. The whole pass takes about a minute, stays account-free, and its value is knowing when to walk away more than when to buy.
- Read the creator's holdings and the first-block buyers; a large stake or a first-block cluster is a reason to stop.
- Check the holder concentration, and remember it can be spread across wallets to look clean.
- Click through the socials and confirm the name and ticker are not copying another coin.
- Read the curve depth and picture your own exit, not just your entry.
- Read the Mayhem, cashback, agent, and callout labels for what each one locks in.
- Confirm the coin is a Solana bonding-curve launch and not an imported EVM token.
None of this predicts whether a coin goes up. It tells you who is selling into your buy, what the platform has already fixed, and what it has left open, which is the part a price chart hides. Barely 1 in 100 coins ever reach a standing pool, so the base rate here is failure before any bad intent enters the picture (source: survival analysis of Pump.fun graduation rates). Even a coin that passes every step is still a memecoin, and the app listing says these coins "do not possess any intrinsic value and do not have any utility," so size any position as money you can lose in full (source: Pump.fun app listing).
Looking to trade PUMP? To get started, you'll need to first create a BloFin account, fund your account with cryptocurrency, and navigate to the PUMP/USDT Spot trading page or PUMPUSDT Perpetual page.
Frequently asked questions
Can a coin pass every check and still turn out to be a rug?
Yes. The routine lowers the odds, it does not remove them. A patient creator can hold a small, clean-looking stake, wait for buyers, and sell in pieces that never trip a concentration flag. A coin can also just be abandoned, which is not a scam but ends the same way for your position. The checks describe what is visible now; they cannot see a creator's future decision or an off-platform plan, which is why sizing money you can lose in full still matters even after a clean pass.
If I only have thirty seconds, which check comes first?
Read the supply distribution first: how much the creator kept and who bought in the opening blocks. It is the fastest read on the coin page and the single check most likely to kill a bad candidate, because a large creator stake or an early cluster is hard to explain away. A clear red there ends the decision before you look at anything else. It still cannot confirm a coin is safe, only that this particular danger is or is not obvious at a glance.
Does a coin that has graduated to PumpSwap still need these checks?
Yes, though the emphasis shifts. Graduation closes the bonding curve and moves liquidity to a standing PumpSwap pool, so the thin-curve exit trap eases and the curve-depth read matters less. What does not change is the creator, the holder spread, the socials, and the launch labels, which still describe who is on the other side of your trade. Treat graduation as one risk reduced rather than the routine cleared, and keep reading the human signals the pool depth cannot touch.
Where on the coin page do these tells actually show up?
The supply metrics, creator holdings, holder concentration, snipers, and bundlers, sit in the audit panel on the coin page. The Mayhem status shows on the same page and in the app and Terminal, and an absent badge means the coin did not enable Mayhem at creation, since it can only be set then. Socials, when a creator adds them, appear near the top of the page, while the callout and agent features surface through the profile and the Explore feed rather than the price chart.
Are these checks any use once I already hold the coin?
Yes, as a monitoring habit. The same creator and holder reads that vetted the buy will show a creator starting to sell, a concentration that shifts, or first-block wallets heading for the door, often before the price fully reflects it. Re-running the supply and wallet reads on a coin you hold turns the routine into an early-warning system rather than only a pre-buy filter. What it still cannot do is call the top; it flags the behavior, and the timing of your own exit stays your decision.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources include the Pump.fun documentation for the bonding curve, Mayhem Mode, tokenized agents, and callouts, Helius developer documentation on Solana token authorities, and a large-scale study of Pump.fun graduation rates. All facts independently verified against cited documentation current as of September 2026.
This article is for informational and educational purposes only. It is not financial, investment, trading, or legal advice. Memecoins are extremely high-risk and most lose all of their value. Anyone can create a coin, add socials, or promote one, and no on-chain check is a promise of safety. Platform features and settings change frequently; verify current details against primary sources before acting. Do your own research and never risk funds you cannot afford to lose.