A team launches a token, often with aggressive marketing and a promising roadmap, and builds a liquidity pool so people can trade it. Once enough money has flowed in, the team executes the rug pull in one of two ways.
A hard rug pull happens instantly: the team drains the liquidity pool directly, or uses a hidden function built into the token's own smart contract (sometimes called a "mint" or "backdoor" function) to create a massive new supply of tokens and sell it all at once, crashing the price to near zero within minutes.
A slow rug pull is quieter: the team simply stops building, stops communicating, and sells their own large pre-allocated holding gradually over weeks, so the token's value fades away rather than collapsing instantly — making it harder to pin down exactly when the scam happened.