Rug Pull
When the people behind a token remove the money backing it, or sell their own large holding, leaving buyers with something they cannot sell.
The usual mechanics are visible in the contract and the on-chain history: the deployer withdraws the paired asset from an automated market maker pool so no buyers remain; a retained mint function creates unlimited new supply; a transfer restriction or blocklist lets buying but blocks selling, a design commonly called a honeypot; or a privileged function drains the contract outright. A slower variant is a large insider allocation with no lock-up, sold gradually into whatever liquidity arrives. Checks that address this include reading who holds privileged roles, whether the contract is upgradeable, whether pool liquidity is locked and for how long, and how supply is distributed across addresses. None of this is a guarantee, because ownership can be transferred and locks eventually expire.
In practice
In a liquidity-removal rug, the deployer withdraws the paired asset from the trading pool, after which the token's quoted price collapses because there is nothing left on the other side of the pool.
The common misunderstanding
That a rug pull requires a hack, when most are executed using powers the contract explicitly granted its owner and which were visible in the code the whole time.