RUGINT: Early Detectability of DeFi Rug Pulls Depends on Rug Type — A Leakage-Controlled Study with a STIX 2.1 Threat-Intelligence Pipeline

Rug pulls dominate fraud in decentralized finance (DeFi): a developer attracts liquidity to a newly launched token and then extracts its value, either by draining the pool or by code that silently blocks victims from selling. Machine learning detectors report high accuracy against this threat, but two problems undermine their operational value: reported metrics are frequently inflated by temporal data leakage (features computed from post-collapse data), and their output, an opaque probability, is neither explainable nor shareable between defenders. We present RUGINT, a six-module framework that converts leakage-safe, first-hour on-chain behavioural indicators into standardized, actor-attributed cyber threat intelligence (STIX 2.1). Using a leakage firewall that restricts features to a fixed observation cutoff, we evaluate detection on a same-cohort dataset of 203 Ethereum/Uniswap-V2 tokens (150 confirmed rug pulls, 53 same-window survivors). First-hour detection attains a cross-validated ROC-AUC of 0.985; permitting post-collapse information raises this only to 1.000 (+0.015), and extending the observation window to 24 hours yields +0.014. Diagnosis attributes the signal to the honeypot mechanism itself: victims can buy but not sell, producing an extreme first-hour buy/sell asymmetry (median 41:1 vs. 2:1 for survivors; 0% vs. 22% round-trip traders). Since 91% of 2,290 confirmed Ethereum rugs in public data are honeypots, we argue that early-detection results must be interpreted by rug type: honeypots are detectable at launch, whereas liquidity-pull rugs are indistinguishable from legitimate launches. RUGINT emits validated STIX 2.1 bundles with TTP mappings and deployer-level attribution, a capability absent from prior rug-pull work.