Every cycle, a fresh wave of BSC tokens arrives promising returns measured in zeroes. Half are bad bets. The other half are honeypots, where you can buy but cannot sell. This is the panda's least favorite genre of magic trick.
Most honeypots collapse under five minutes of inspection if you know where to look. This guide shows you the cheap checks before you ever click Confirm.
Time to complete: 5 to 8 minutes per token. Faster once it becomes a reflex.
What is a honeypot token, exactly?
A honeypot is a token whose smart contract is engineered to let buyers in but block sells. The mechanics vary: a hidden blacklist function, a 100% sell tax, a transfer flag the deployer can flip at will, or simulated liquidity that vanishes. Buyers watch a green chart. Buyers try to exit. Buyers cannot.
According to DefiLlama's BSC dashboard, Binance Smart Chain holds $5.50B in DeFi TVL, down 3.32% over the past 7 days. The chain is busy and unfortunately also one of the cheapest places to deploy a trap contract. The decent news: BscScan indexes every contract, Honeypot.is simulates buy-and-sell paths, and DexScreener exposes liquidity in near real time. The information is free. People just skip the step.
Prerequisites
You do not need to be a developer. You do need:
- A browser, ideally not on a phone (BscScan is painful on small screens).
- The token's contract address (not the ticker symbol, which is easy to spoof).
- 5 minutes of patience.
- A working assumption that anything advertising "guaranteed gains" is the trap.
No wallet connection is required for the audit itself.
The 5-step honeypot detection workflow
The order matters. Start with the cheapest checks, escalate only if the token survives.
Step 1: Get the contract address from a primary source
Do not copy the address from a random Telegram group or a stranger's tweet. Find it via the project's pinned post, official website, or BscScan search. If you cannot find a primary source in two minutes, that is already information. Spoiler: we saw this one coming.
Step 2: Run the address through Honeypot.is
Open honeypot.is, select BSC in the chain dropdown, and paste the contract. The tool simulates a buy and a sell in the same transaction and reports:
- Is honeypot: yes / no.
- Buy tax and sell tax: the actual on-chain numbers, not the marketing ones.
- Transfer state: whether transfers are paused or restricted.
If the result is red, stop. Do not "verify by buying $20 to test". That is how the trap funds itself.
Step 3: Check BscScan for real successful sells
A clever honeypot can sometimes fool a simulator by whitelisting it. Cross-check on BscScan: open the token, then the DEX Trades or Token Transfers tab. Filter for "Swap Exact Tokens For BNB" or equivalent sell events. You want many unrelated wallets successfully selling, not 800 buys with three sells from the deployer. No real sells in the history equals a one-way door.
Step 4: Inspect liquidity on DexScreener
Go to DexScreener BSC and load the pair. Three numbers matter:
| Metric | Healthy signal | Honeypot signal |
|---|---|---|
| Liquidity (USD) | $50K+ and locked | Under $10K, unlocked |
| LP lock | Locked via Pinksale or Team.finance | "No lock detected" |
| Liquidity age | Days or weeks | Minutes |
If liquidity is unlocked, the deployer can pull it whenever. "Locked for 24 hours" is, in practice, not locked.
Step 5: Sanity-check holders, taxes, and the deployer
Back on BscScan, open the Holders tab. If one wallet holds 40% of supply and it is not a known burn or LP address, the entire chart is at the mercy of one human. Then check the Contract tab: unverified code means you are buying a black box, and the panda raises an eyebrow at black boxes. Verified code, with a buy tax under 5% and a matching sell tax, is the boring (and correct) profile.
For a broader BSC security workflow, see our BSC topic hub and the companion guide on how to revoke dangerous token approvals on BSC.
Common traps and troubleshooting
A few patterns trip people up even after the five steps.
- Honeypot.is shows "ok" but BscScan shows no unrelated sells. Trust BscScan. The simulator can be gamed.
- Sell tax 99%. Technically not a honeypot. Practically, identical outcome.
- Liquidity locked... for 24 hours. A stalling tactic, not a lock. Look for 6 months or more.
- "Renounced ownership" badge. Useful, but a renounced contract with a hidden mint function is still dangerous.
- The token has a cute mascot. Mascots do not audit code.
If a contract passes all five steps but still feels wrong, walk away. According to CoinGecko, BNB trades at $640.62 today with a market cap of $86.35B. The chain is busy. The traps are busy too. Pick carefully.
For a complementary checklist on team and tokenomics red flags, see our 15-minute memecoin team vetting guide. New to the chain itself? Start with our beginner's guide to BSC in 2026.
Frequently asked questions
Are all low-liquidity tokens honeypots?
No, but low liquidity makes them easy to rug. Honeypots and rug pulls are different mechanics with the same outcome for the buyer.
Can a token become a honeypot AFTER I buy?
Yes. Some contracts contain a deployer-only function that flips the sell flag mid-life. This is why renounced ownership matters more than people think.
Does Honeypot.is work for tokens on other chains?
Yes. It supports Ethereum, Base, Arbitrum, and BSC. Always select the correct chain in the dropdown before running the check.
I bought a honeypot. Can I recover my funds?
Almost never. Do not pay any "recovery service" that contacts you on Telegram. Those are second-stage scams targeting the same victim list.
How long should I spend on each audit?
Five minutes for the basics. For meaningful position sizes, escalate to reading the contract yourself or paying a real audit firm.
What to watch next
The next 12 months will likely bring wallet-side AI tools that flag honeypots before you sign. Until those land, the manual checks above stay the cheapest insurance on a BSC trade.
Dadacoin, our satirical BSC project, is built on the assumption that the audience can read a contract. We prefer it that way. The panda says: read before you click.
