Scam tokens and NFTs that appear in your wallet
Why strangers send you free tokens and NFTs, how interacting with them can lead to a drainer, and what to do instead.
On this page
If you have used a public wallet for any length of time, you have probably received tokens or NFTs you never asked for. Some carry a website in their name, some show a huge dollar value, and some look like a real project's token. Almost all of them are bait.
Why scammers send them
- Advertising a drainer. Token names and NFT images such as "Claim your reward at ..." or a fake voucher push you to visit a phishing site.
- Fake value. The token shows a high price in your wallet because someone created a fake market for it. When you try to sell it, the site asks for an approval that drains your real tokens.
- Honeypot contracts. The token can be bought but not sold, or selling requires a "fee" or an approval.
- Address poisoning. Tiny or zero-value transfers from addresses that look like ones you have used, so you copy the wrong one later. See address poisoning.
Is it dangerous just to have them?
On EVM chains, simply holding an unknown token or NFT does not give anyone access to your wallet. The danger starts when you interact with it: visiting the site in its name, trying to sell or swap it, approving it or "claiming" a matching reward.
What to do
- Ignore it. Do not visit the website in the token name, and do not try to sell it.
- Hide it. Most wallets let you hide tokens or mark NFTs as spam. Many already filter obvious spam.
- Do not try to "burn" or send it away through unfamiliar sites. A transfer of a malicious token can call unexpected code.
- Check through a block explorer if you want to know what it is. Explorers often label known spam and phishing tokens.
When an unexpected token is real
Sometimes a legitimate project does airdrop tokens directly into wallets. Even then:
- Confirm it on the project's official site and channels, reached through your own bookmark.
- Swap only through a well-known exchange interface you already use, not through a link attached to the token.
- If the token's value seems too good to be true, assume it is fake until proven otherwise.