I’ve been investigating DeFi scams on BNB Chain for a while now, and one thing keeps surprising me: how many people see a liquidity lock and stop asking questions. A lock exists, so the project must be safe, right? That logic has cost people real money.

Bad actors have gotten creative. They don’t just skip locking liquidity anymore. They lock it in ways that look convincing but leave them a back door. This guide is for people who already understand what a liquidity lock is and want to know how projects fake, weaken, or sidestep them.

The partial lock trap

One of the most common tricks is locking a tiny fraction of the total liquidity while promoting the lock like it covers everything. A project locks 10% of LP tokens and plasters the lock certificate across its website. Most people see the lock and move on. They never check the percentage.

Here’s what you actually need to do: compare the locked amount against the total LP token supply for that pool. If the pool has 100 LP tokens outstanding and only 10 sit in the locker contract, the other 90 can be pulled at any time. A lock certificate covering a trivial portion of liquidity is decoration, not protection.

Short-duration locks: the 24-hour illusion

Some projects lock liquidity for laughably short periods. Twenty-four hours. A few days. Technically, yes, the liquidity is locked. Practically, it’s worthless protection because the team can drain everything the moment the lock expires.

I’ve seen this pattern play out dozens of times. Project launches with a 48-hour lock, just long enough to pass automated scanner checks. Investors see the confirmation and buy in. Two days later, the lock expires, the team pulls liquidity, and the price goes to zero. Always check the unlock date. Anything shorter than three months should make you nervous.

Proxy wallet tricks and indirect ownership

This one is more subtle. The LP tokens go into a locker contract, but the owner of that contract is a proxy controlled by a wallet the team holds. On the surface, it looks fine because the tokens aren’t sitting in someone’s personal wallet.

To dig into this, trace the ownership chain of the locker contract on BscScan. Check who deployed it. Is the owner address a multisig? A known locker platform contract? Or just another externally owned account? If the locker contract was deployed by the same wallet that created the token, that’s a major red flag. Legitimate locker platforms have well-known deployer addresses and factory contracts that you can verify.

Migrating liquidity to bypass locks

This tactic is clever and I’ll admit it took me a while to catch on to it. The project locks TOKEN/BNB liquidity on PancakeSwap V2. Investors verify the lock. Everything checks out. Then the team quietly creates a TOKEN/USDT pair on a different exchange or on PancakeSwap V3, shifts trading volume there, and abandons the locked pool.

The original lock is still valid and verifiable. But it protects a pool nobody trades on anymore. To spot this, check whether the locked pool is still where the action is. If trading volume has moved to a different pair or platform, that lock on the original pool is protecting nothing.

Honeypot contracts that make locks irrelevant

This is probably the most frustrating scenario. A project can lock 100% of liquidity for ten years, and it still won’t save you if the token contract itself is designed to trap buyers. Honeypot tokens let you buy but block or heavily tax sells. Your tokens sit there, worthless, while the liquidity stays locked and technically “safe.”

Check the token contract for sell restrictions before you even look at the lock. Functions that modify transfer fees, blacklist wallets, or pause trading can all turn a locked-liquidity token into a honeypot. Both the lock and the token contract need to be clean. One without the other gives you a false sense of security.

Fake locker contracts and cloned interfaces

Some projects deploy their own smart contracts that mimic how a real locker platform looks. Similar function names, similar events emitted, but with a hidden withdraw function or an owner override baked in.

The fix here is straightforward: verify the locker contract address against the official factory contract of a recognized liquidity locker platform. Real lockers create lock contracts through a factory, and every valid lock address traces back to that factory. If the lock contract was deployed independently and doesn’t show up in the platform’s official records, treat it as unverified. It doesn’t matter how clean the contract code looks on the surface.

The investigator’s checklist

If you’ve confirmed that a lock exists, run through these before deciding whether it actually protects anything.

• Percentage check: Is more than 80% of total LP supply locked, or just a token amount?
• Duration check: Is the lock at least three months, or is it expiring next week?
• Ownership trace: Does the locker contract belong to a recognized platform, or was it deployed by the project team?
• Pool relevance: Is the locked pool still where people are actually trading?
• Token contract audit: Does the token contract have mint, blacklist, fee-change, or proxy upgrade functions?
• Factory verification: Can you trace the lock contract address back to the platform’s factory contract?
• History review: Has the project let a previous lock expire and re-locked for a shorter duration?

Each item here targets a specific scam tactic that basic verification misses. Running through the full list takes a few extra minutes, but it catches the majority of fake or inadequate locks.

Skepticism is your best tool

DeFi runs on the premise that you don’t need to trust anyone because the code is transparent. But transparency only works if you actually read and verify what the code does. A lock certificate, a Telegram announcement, or a checkmark on a scanner is not the same as real on-chain security.

I’ve gotten into the habit of assuming every lock needs verification. Every project has an incentive to make its security look better than it is. The techniques in this article won’t make you immune to scams, but they’ll catch the tricks that fool most people. And honestly, if a project can’t survive this level of scrutiny, that tells you something.