Scam Tokens in Your Wallet: Why They Appear, What to Do

You open your wallet and there's a coin you've never heard of, sometimes "worth" thousands of dollars. That's the bait. The token isn't the attack. It's an invitation to the attack, and the attack only works if you take a step toward it.

Why do random tokens show up in your wallet?

Because receiving a token needs no permission. On EVM chains like BNB, Ethereum and Robinhood Chain, a token balance is just a number in the token's own contract, and the deployer can write your address into it. The sender pays the gas, you pay nothing and approve nothing.

Spammers send to thousands of active wallets in one go, usually ones that recently traded, held a popular coin or claimed a real airdrop. Being active on-chain is what puts you on the list. It doesn't mean your wallet was hacked or your seed phrase leaked.

What are the scam tokens actually trying to do?

Almost all of them fall into three jobs:

• Send you to a drainer site. The name or ticker is the message: a URL, "visit ... to claim", "$2,000 reward". The site asks you to connect and sign. What you sign is an approval or permit that lets their contract spend your real tokens.
• Bait a sell. A fake stablecoin or a coin with a big displayed value makes you want to cash out. Selling means approving the token to a router, often one the scammer points you to, or the token is a honeypot that won't sell at all. Either way you spend gas and gain nothing, and a bad approval can cost far more.
• Poison your history. A zero-value or fake-token transfer from an address that looks like one you use, so you copy the wrong one next time you send funds. That trick is covered in how to spot a copycat token.

Is it safe to hold a scam token?

Yes. A token sitting in your wallet can't take anything from you. A contract can only move your other tokens if you have approved it, so as long as you never interact, the spam is just clutter.

The tell people miss is the "free" signature. Many drainers don't ask for a transaction at all. They ask you to sign a message, which costs no gas and feels harmless, but a permit-style signature (EIP-2612 permit or Uniswap's Permit2) can grant spending rights just like an on-chain approval. If a site you reached through a random token asks you to sign anything, close it.

How do you tell a fake USDT from the real one?

By the contract address, the same way you'd check any coin. Real USDT on Ethereum is 0xdAC17F958D2ee523a2206206994597C13D831ec7. Tether lists its official addresses per chain on its own site. A token called USDT at any other address is not USDT, whatever your wallet shows.

A hypothetical example. Your wallet shows 50,000 USDT you never received from anyone you know. The contract address doesn't match Tether's list. The token's holders page shows thousands of wallets that each got the same amount, sent in batches from one address, and no pool on any DEX with real money in it. That's a mass airdrop of a worthless clone, and the "$50,000" is your wallet guessing a price from the name.

Three checks settle almost any unknown token:

1. Address. Does it match the project's official address? If it claims to be a known coin and doesn't, you're done.
2. Market. Is there a pool with real liquidity, or no pool at all? A coin with no market has no value, whatever the number says.
3. How it spread. On the explorer, did holders buy it, or did one address send it to thousands of wallets? Mass transfers in with no buys is spam.

What should you do with spam tokens?

Hide them and don't touch them. You can't delete a token from the chain, but every major wallet lets you hide one from the list. MetaMask has a hide option per token, and some wallets filter obvious spam automatically.

Don't try to sell, swap or "burn" a spam token through a website. Don't send it back. Don't visit the link in its name. Each of those is an interaction, and interaction is what the token was sent to get.

Solana is the one place a cleanup step pays you. Each token you hold there sits in its own token account with a small SOL deposit, about 0.002 SOL. Some Solana wallets, Phantom included, can burn a spam token and close its account from inside the wallet, which returns that deposit. Use your wallet's own feature, never a site that offers to do it for you.

What if you already approved or signed something?

Act fast and assume the approval will be used. Open an approval checker such as revoke.cash, or the token approval checker on the chain's explorer, connect the wallet, and revoke every approval you don't recognise. Revoking costs a little gas per approval.

If you entered your seed phrase anywhere, revoking won't help: whoever has the phrase has the wallet. Make a new wallet and move everything you can to it right away. If funds have already left, they're almost never coming back, and anyone offering to "recover" them for a fee is usually the next scam.

How does MoonRadar handle spam in your wallet?

MoonRadar's My coins tab shows what your connected wallet holds on Robinhood Chain, BNB Chain and Ethereum, read on-chain and priced live from DexScreener. It only lists coins with a live price, a trading pair on DexScreener and a value of at least $1. Coins whose ticker carries a link or claim bait, like a web address, a Telegram link, "claim", "airdrop" or "reward", are filtered out too.

Filtered coins are never shown as tradeable, so they never get a Sell button to tempt you. The tab tells you how many it hid, so nothing disappears silently. It hides them from the view only. They stay in your wallet, and MoonRadar doesn't check or revoke approvals, so use an approval checker for that.

If an unknown coin looks real, paste its address into the free scanner. It runs the sell check, reads the buy and sell tax, owner status, liquidity and the deployer's history, and shows a shield score. It's non-custodial: MoonRadar never holds your funds or keys. For the full pre-buy routine, see the token safety checklist.