How to Handle Unknown Tokens That Appear in Your Wallet

Key Takeaways

1. Receiving an unknown token does not mean your wallet is hacked. Any address can send assets to any other address on a public blockchain. The arrival of a token gives the sender no power over your funds.
2. The token is not the attack. Your reaction is. Most losses happen after the user tries to sell, swap, claim, or research the token by visiting a website printed inside its name.
3. The correct response is deliberately boring. Do not interact, hide the asset in your wallet interface, verify by contract address if you must, and audit your token approvals on a regular schedule.

Why Unknown Tokens Appear in the First Place

A public blockchain address works like an open mailbox. Anyone who knows the address can send something to it, and you cannot stop them. Wallet software simply displays what the chain says you hold, so unrequested tokens and NFTs appear next to assets you actually bought.

Most of these deliveries fall into a small number of categories.

Security firm Scam Sniffer recorded roughly $83.85 million lost to wallet drainer phishing across about 106,106 wallets in 2025, down from around $494 million and more than 332,000 wallets in 2024. The tactics did not disappear. These are widely reported estimates rather than audited totals.

The Golden Rule: Do Not Interact

Trezor, Phantom, and MyEtherWallet all tell users the same thing: treat unsolicited tokens as spam and leave them untouched.

The reason is mechanical. A signature is the only thing that can move your assets, and interacting with a token means signing. A scam token cannot take anything by sitting in your wallet. It only profits if you:

• Approve a malicious contract while trying to sell or swap it
• Visit a website whose URL is written into the token name or NFT image
• Enter your recovery phrase on a fake claim page
• Send a transaction that fails while the gas still reaches the attacker
• Copy a poisoned address out of your transaction history

Every one of those is a user action. That is the whole attack surface.

Step by Step: The Safe Response

Step 1: Pause

There is no deadline and nothing is expiring. Urgency is manufactured in almost every scam of this type.

Step 2: Confirm your balances are untouched

Check that your real assets are still present. If they are, nothing has been stolen. The token appearing is not evidence of compromise.

Step 3: Never open a link inside the token

Scam tokens often carry a website address in the token name, the NFT image, or the transaction memo. Treat any such link as hostile. No legitimate project delivers instructions this way.

Step 4: Verify by contract address, not by name

Token names and tickers are not unique. Anyone can mint a token called USDC. If you genuinely expected an airdrop, get the official contract address from the project's own documentation, then compare it to the address shown in your wallet or on a block explorer. If they do not match exactly, the token is fake.

Step 5: Hide or mark it as spam

Most modern wallets support this. In Phantom, opening the asset and selecting More then Report as Spam hides it and feeds the wallet's spam detection. MetaMask, Trust Wallet, and Trezor Suite offer equivalent hide or spam filter options. Hiding is a display change only. It touches nothing on chain and costs no fee.

Step 6: Audit your token approvals

This is the step most people skip. A token approval is standing permission for a smart contract to move a specific token out of your wallet. Old approvals from dapps you no longer use are a live risk. Two widely used tools are Revoke.cash, which covers many EVM networks, and the Etherscan Token Approvals checker, which added batch revoking in early 2026.

Type the address manually or use a saved bookmark. Never reach an approval tool through a search advertisement, a direct message, or a link in a token name. Fake revocation sites exist precisely because worried users go looking for them.

Hide, Burn, or Ignore: Choosing an Approach

A note on burning. On Solana, every token you hold occupies its own token account, and each account locks a refundable rent deposit of roughly 0.002 SOL. Burning a spam token and closing its account returns that deposit, which is why Solana cleanup tools exist and can pay you a small amount.

This mechanic is specific to Solana. On Ethereum, Base, and other EVM chains there is no such deposit, so there is nothing to reclaim. Any site offering to recover locked ETH or refund gas for holding spam tokens is describing something that does not exist. Burning is also irreversible, so verify what you are destroying before signing.

Address Poisoning: The Variant That Costs the Most

Address poisoning deserves separate attention because it does not require you to touch the scam token at all.

The attacker sends a near worthless transfer from an address engineered to share the first and last characters of an address you use often. It sits in your transaction history looking familiar. Later, moving funds in a hurry, you copy the wrong entry.

Blockaid reported flagging more than 65 million address poisoning transactions since January 2025, with attempts rising from around 628,000 in November 2025 to about 3.4 million in January 2026. In one widely reported December 2025 incident, a victim sent roughly $50 million in USDT to a poisoned address about 26 minutes after making a small test transfer.

Three habits defeat it:

1. Never copy a destination address from transaction history. Use a saved address book entry or the recipient's own message.
2. Check the full address, not the first and last four characters. That shortcut is exactly what the attack targets.
3. Send a small test transaction, then verify receipt through a channel outside the chain before sending the full amount.

If You Already Interacted

Mistakes happen. Speed matters more than embarrassment.

1. Stop signing anything from that wallet immediately.
2. Disconnect the wallet from all dapps.
3. Open an approval checker and revoke every approval linked to unfamiliar contracts.
4. Move remaining assets to a wallet with a different seed phrase, not just a different account under the same phrase.
5. If you entered your recovery phrase anywhere, treat that wallet as permanently compromised. Approvals cannot be revoked fast enough to matter once the phrase is exposed.

Revoking does not recover funds already taken. It prevents further withdrawals.

Building a Setup Where This Stops Mattering

• Separate wallets by purpose. Keep long term holdings in a wallet that never connects to dapps, and use a lightly funded burner wallet for claims and experiments.
• Use a hardware wallet for meaningful balances and read approval details on the device screen, not only in the browser.
• Prefer limited approvals over unlimited ones where the interface allows it.
• Schedule a monthly approval audit as a recurring calendar reminder.
• Keep an address book so you never copy a destination from history.

Unknown tokens are best understood as untrusted input. They arrive uninvited, they carry no authority, and they only become dangerous when curiosity turns into a signature.

Frequently Asked Questions

Does receiving a scam token mean my wallet is compromised? No. Anyone can send assets to a public address. The token's arrival tells you nothing about the security of your keys. Your wallet is only at risk if you sign something.

Can I just sell the unknown token for a small profit? This is the single most common way people lose funds. Selling requires an approval or a swap, and that is exactly the interaction the attacker is waiting for. Some scam tokens are also built so that buying works and selling always fails.

Is it safe to send an unknown token to another wallet? No. Sending is still an interaction with the token contract, and on UTXO chains such as Bitcoin, spending dust can link your addresses together and reduce your privacy.

Why can I not delete the token from my wallet? Blockchains are append only, so the record cannot be erased. Hiding removes it from your view. Burning removes the balance, but the transaction history remains visible forever.

Do spam tokens increase my transaction fees? Not on EVM chains, where fees depend on the computation in the transaction you send. On Solana, each token account locks a small refundable rent deposit, which is why closing unused accounts returns SOL to you.

Related Terms

• Dusting attack: Sending tiny amounts of crypto to many addresses to track and cluster their activity.
• Token approval: Standing permission granted to a smart contract to spend a specific token from your wallet.
• Wallet drainer: Malicious software or contract that empties a wallet after a user signs a crafted transaction.
• Honeypot token: A token designed so buying succeeds and selling fails.
• Burner wallet: A low value wallet used for risky interactions, kept separate from long term holdings.

Sources

• Trezor, "Dusting attacks and airdrop scam tokens": https://trezor.io/support/troubleshooting/coins-tokens/dusting-attacks-airdrop-scam-tokens
• Phantom Help Center, "What if I see an unfamiliar token or NFT in my wallet": https://help.phantom.com/hc/en-us/articles/38409446731539-What-if-I-see-an-unfamiliar-token-or-NFT-in-my-wallet
• MyEtherWallet Help Center, "Why are random tokens appearing in my wallet": https://help.myetherwallet.com/en/articles/5899839-why-are-random-tokens-appearing-in-my-wallet
• Revoke.cash Learn, "How to revoke token approvals and permissions": https://revoke.cash/learn/approvals/how-to-revoke-token-approvals
• Ledger Academy, "Ethereum token approvals explained": https://www.ledger.com/academy/ethereum-token-approvals-explained
• Cointelegraph via TradingView, "Crypto phishing losses fell 83% in 2025" (Scam Sniffer data): https://www.tradingview.com/news/cointelegraph:39a3338ca094b:0-crypto-phishing-losses-fell-83-in-2025-but-drainer-ecosystem-remains-active/
• Blockaid, "Address poisoning: the growing threat draining millions from crypto users": https://www.blockaid.io/blog/address-poisoning-the-growing-threat-draining-millions-from-crypto-users
• CoinLaw, "Crypto wallet ecosystem statistics 2026": https://coinlaw.io/crypto-wallet-ecosystem-statistics/
• Sol Incinerator, "Can you burn tokens on Base": https://sol-incinerator.com/blog/can-you-burn-tokens-on-base
• CryptoAdventure, "Etherscan adds batch revoke token approvals tool": https://cryptoadventure.com/etherscan-adds-batch-revoke-token-approvals-tool/

Figures cited are widely reported industry estimates and were accurate as of publication. This article is educational and is not financial or security advice.