Tokens that Quantum Audit rated High risk were more than 100 times as likely to have their liquidity pulled as tokens it rated Low. Of the tokens recorded on the public dashboard between June and mid-October 2026, 21 of 114 rated High or Critical later had every pool emptied, against 2 of 1,272 rated Low. And of the 26 tokens in the study whose pools were emptied, 21 (81%) had been rated High before it happened.
This report is built from the public Quantum Audit token security dashboard and its open audit corpus. Every number below can be checked against a public record.
Key findings
- High-rated tokens lost all liquidity 117 times as often as Low-rated ones. 18.4% of tokens rated High or Critical at the time of their record later had every pool emptied; 0.53% of Medium and 0.16% of Low tokens did (measured on 1 November 2026, at least 15 days after each record).
- 81% of emptied pools had been flagged in advance. Of 26 tokens whose pools were emptied, 21 were rated High when they were recorded, and 24 (92%) were rated Medium or higher.
- The risk rises with the score. Below a score of 50, 0.12% of tokens had their pools emptied; at 65–74, 13.8%; at 75 and above, 23.2%.
- 17 of the 21 emptied High-rated tokens followed one pattern on Arbitrum: a token named after a known crypto or AI company, under a day old, one pool, and its liquidity held unlocked by a single wallet.
- On 1 November 2026, 8.5% of the tokens on the dashboard scored High or Critical.
- 40% of tokens have liquidity that is neither locked nor burned. The share ranges from 8% on Solana to 94% on Base.
- More than half of all tokens were under a week old when they were recorded (56%), and 37% were under a day old.
What a risk score measures
A risk score is not a price forecast. It measures how much power a token's contract and market structure give someone over holders' money: whether an owner can still mint, freeze, upgrade or tax; whether the liquidity can be withdrawn and by whom; how concentrated the supply is; and how deep the market is.
Static analysis of the verified source and on-chain checks produce the facts; a deterministic function computes the risk score from them; a language model explains the findings. The same contract gets the same score, whoever asks. Every score on the dashboard comes with a public breakdown of the factors that drove it, and the full method is published on the methodology page.
So a High score says the levers are there. It does not say they will be pulled. The question this report answers is simpler: when liquidity was pulled, had the score seen it coming?
What happened after the score was recorded
The study takes every dashboard record dated on or before 17 October 2026 that had a market when it was recorded, and checks each token's pools again on 1 November 2026.
| Rating at the time of the record | Tokens | Every pool later emptied | Share |
|---|---|---|---|
| High or Critical | 114 | 21 | 18.4% |
| Medium | 563 | 3 | 0.53% |
| Low | 1,272 | 2 | 0.16% |
Most High-rated tokens kept trading. A High rating is exposure, not a verdict. But the pools that were emptied came almost entirely from the top of the scale:
| Score at the time of the record | Tokens | Every pool later emptied |
|---|---|---|
| 0–49 | 1,657 | 0.12% |
| 50–64 | 178 | 1.7% |
| 65–74 | 58 | 13.8% |
| 75–100 | 56 | 23.2% |
Across all tokens in the study, about 1 in 75 (1.3%) had all of their liquidity withdrawn within the window. For a buyer, the practical reading is this: four out of five of those tokens were marked High before it happened, on a public page anyone could open.
The pattern behind most emptied pools
Seventeen of the 21 emptied High-rated tokens were one recurring pattern on Arbitrum, recorded between 15 August and 16 October 2026:
- each token carried the name of a known crypto or AI company, and no independent source listed it;
- each was less than a day old when it was recorded;
- most launched with one pool holding $66,000 to $125,000;
- where the record shows who held the pool's liquidity, a single wallet held 99.7% to 99.9% of it, unlocked, and the ten largest holders owned 79% to 95% of the supply;
- each scored between 69 and 84, High.
Today every one of those pools holds $0. Nothing in that pattern needs a code exploit. The contract can be ordinary; the risk is in who holds the liquidity and who holds the supply. That is why the score reads the pool and the holders, not only the code.
What the dashboard shows today
A snapshot of every token on the public dashboard on 1 November 2026:
| Share of tokens | |
|---|---|
| Rated High or Critical | 8.5% |
| Liquidity neither locked nor burned (where readable) | 40.3% |
| Supply can still be minted | 22.5% |
| Owner in control, mint open and liquidity unlocked, all three at once | 7.4% |
| Ten largest holders own more than half the supply (where readable) | 61.3% |
| Ten largest holders own more than 80% of the supply (where readable) | 34.2% |
The networks are very different places:
| Network | Liquidity not locked or burned | Supply can still be minted | Rated High or Critical |
|---|---|---|---|
| Solana | 8.4% | 4.6% | 2.2% |
| BNB Chain | 56.7% | 24.6% | 12.6% |
| Ethereum | 65.6% | 33.3% | 10.1% |
| Base | 93.5% | 59.3% | 13.8% |
| Arbitrum | 88.8% | 34.4% | 40.9% |
On BNB Chain, 32.5% of tokens charge a buy or sell tax; on every other network it is 2% or less.
One result runs against intuition: the deeper the market, the more often its liquidity is unlocked. Under $10,000 of liquidity, 16% of tokens have unlocked pools; above $1 million, 79% do. Most small Solana launches burn their pool tokens, while large tokens draw liquidity from many independent providers, whose positions are rarely locked. Unlocked liquidity spread across independent providers is a market-depth question; unlocked liquidity held by the deployer is a way to empty the pool. The score treats them differently, which is why "not locked" alone does not make a token High risk.
Why fast tokens need a different kind of check
More than half the tokens on the dashboard were under a week old when they were recorded, and 37% were under a day old. The median was three days.
A manual audit by an established firm takes one to eight weeks and costs from about $5,000 to over $100,000 (see the 2026 pricing comparison). A published budget tier takes three to four days. That is the right tool for a lending protocol, a bridge or a vault, where the danger lives in complex code. It is the wrong tool for a token whose decisive moments happen in its first day, and whose risk sits in on-chain state rather than in clever logic: who owns it, whether supply can grow, whether the liquidity can leave.
That gap is what Quantum Audit exists for. It does not replace a manual audit. Quantum Audit reads the facts that decide whether a fast-moving token can be used against its holders, the same way for every token, early enough to matter, and publishes the result where a buyer can find it before buying.
What a Low score means, and what it does not
A Low score means the contract and the pool give nobody an obvious lever over holders' money: no open mint, no withdrawable liquidity in an insider's hands, no owner who can change the rules. In this study, 1,270 of 1,272 Low-rated tokens kept their liquidity.
It does not mean the price will hold. Tokens rise and fall on attention, and a Low score is no promise about the market. It is a statement about who can take the money, not about what the money will be worth.
How this study was done
- Records. Every token record in the open Quantum Audit audit corpus dated on or before 17 October 2026 with a market at the time of the record. The score and rating are the ones published at that time; nothing was re-scored.
- Outcome. "Every pool emptied" means that on 1 November 2026 the token had no pool left on its network, or every pool held $0. Pools were read from DEX Screener and, for any token it no longer listed, from GeckoTerminal. Two tokens could not be checked and are left out.
- Rating scale. Low below 35, Medium 35–64, High 65–84, Critical 85 and above.
- Limits. An emptied pool can also mean a planned migration to a new contract; the study does not separate the two. The snapshot of the dashboard covers every record on 1 November 2026; some checks cannot be read for some tokens (for example, holder data), and those shares are given "where readable".
The October launch-week report covers a related question, what new tokens look like in their first week: New token launch risks: what 368 October launches show.
FAQ
How accurate is the Quantum Audit risk score at spotting rug pulls?
In this study, 81% of the tokens whose liquidity was later withdrawn had been rated High beforehand, and High-rated tokens lost all of their liquidity more than 100 times as often as Low-rated ones. The score measures exposure, not intent: most High-rated tokens kept trading, but nearly every emptied pool came from the High end of the scale.
What percentage of new tokens are rug pulls?
Among tokens recorded on the Quantum Audit dashboard between June and mid-October 2026, about 1 in 75 (1.3%) had every pool emptied by 1 November 2026. Among tokens rated High or Critical, it was nearly 1 in 5.
Does a High risk score mean a token is a scam?
No. It means the contract or the pool gives someone the power to hurt holders, for example by withdrawing liquidity or minting new supply. Whether that power is used is up to whoever holds it. The score shows the power; the history on each record shows what happened next.
Which blockchain has the most unlocked liquidity?
On the Quantum Audit dashboard on 1 November 2026, Base: 93.5% of Base tokens had liquidity that was neither locked nor burned. Solana had the least, 8.4%, because most Solana launch pools burn their pool tokens.
How do I check a token before buying it?
Look the token up on the Quantum Audit dashboard and read three things: who can withdraw the liquidity, whether the supply can still be minted, and how much of it the ten largest holders own. The step-by-step guide shows where each of them is on the page.