Security
Tokens you never bought: dusting, fake airdrops, and approval traps
Unknown tokens appear in wallets for a reason. Usually to make you interact with them.
Tokens you never bought: dusting, fake airdrops, and approval traps
One day your wallet shows a token you have no memory of acquiring. Sometimes it claims to be worth a striking amount. This is not luck, and it is not a bug. Anyone can send anything to any public address, and some people send things specifically to see what you do next.
Why strangers send you tokens
Dusting. Tiny amounts distributed to many addresses. If the recipient later combines that dust with other funds, it can help an observer link addresses together. The goal is analysis, not theft.
Bait tokens. A token appears with an inflated displayed value, along with a name or memo pointing at a website. The value is fictional—anyone can mint a token and label it anything. The purpose is to get you to visit the site.
Approval traps. The site asks you to connect your wallet and approve a transaction, framed as claiming, unlocking, or verifying. The approval you sign may grant permission to move tokens you actually own. This is where real loss happens.
The token itself is rarely the weapon. The weapon is the action it persuades you to take.
Why approvals are the dangerous part
Approving a contract can grant it ongoing permission to move a specific token from your wallet. That permission persists until revoked. A single careless approval can be drained later, at a time of the attacker's choosing—which is why the loss sometimes arrives long after the interaction and feels unconnected to it.
Signature requests can be equally costly, and they are harder to read. A request you do not fully understand is a request to decline.
The safe response to an unexpected token
- Do nothing. Not interacting is a complete and sufficient response.
- Do not visit the site named in the token, memo, or transaction.
- Do not attempt to sell, swap, or "clean up" the token—those actions are interactions.
- Hide it in your wallet interface if it bothers you; hiding is local and safe.
- Do not connect your wallet anywhere to investigate it.
- Do not ask for help in public forums—that reliably attracts people offering to fix it.
Leaving an unknown token untouched in a wallet costs nothing. Almost every loss in this category comes from trying to do something about it.
If you already interacted
- Stop using that wallet for anything valuable
- Move remaining assets to a wallet whose seed phrase has never been entered anywhere
- Review and revoke token approvals using tooling you sourced yourself, reached by typing the address, not from a search ad or a link
- Assume anything reachable by an existing approval may still be at risk
- Do not accept help from anyone who contacts you afterwards
A seed phrase that was ever typed into a website should be treated as compromised. See seed phrase backup mistakes and custody vs seed phrase wallets.
Failure modes
- Treating a displayed token value as real
- Visiting the URL "just to look"
- Approving a transaction to claim something free
- Signing a request you cannot read
- Trying to swap the token to get rid of it
- Reusing the affected wallet afterwards
- Entering a seed phrase to "validate" or "restore" anything
The framing that keeps you safe
Free things that require you to sign something are not free—signing is the price, and you cannot see what you are paying until later. There is no legitimate airdrop that requires your seed phrase, and none that cannot wait until you have verified it through an official channel you reached yourself.
How this page connects to the rest of CLIDM
Use the security hub for controls and the learning path for sequence. Related: social media crypto scams, how to spot fake crypto exchange apps, API keys for beginners, and cold storage vs exchange balance.
CLIDM quality standard
We optimise for checklists, failure modes, and operating order—not trade signals or return guarantees. Tooling and interfaces change; verify through official channels you reached yourself. Last reviewed: 2026-08-25.
Educational only. Not investment, legal, or tax advice. Digital assets can lose value. Availability varies by region.