Unknown Token in Your Wallet: Spam Tokens, Dust and Address Poisoning

An unknown token appeared in your wallet — one named after a website, one showing a balance of thousands of dollars, or a zero-value transfer you definitely never made. This is one of the most common causes of panic, and in most cases it is groundless: a spam token in a wallet is harmless on its own. The danger begins when you start interacting with it or, in the case of address poisoning, copy an address from your transaction history. This article explains where other people's tokens come from, how each scheme works, and which actions are safe.

This describes common spam and address-substitution mechanisms and general safety rules. It is not an exhaustive list of threats and not financial or legal advice; in a doubtful situation the best action is to do nothing.

Where other people's tokens in your wallet come from

Any address on a public blockchain can receive a token without the owner's consent: sending does not require the recipient's signature. Three types of senders take advantage of this.

Spam distributions. A token contract sends itself to thousands of active addresses. The goal is attention: the token's name or description embeds a website where you are offered to «swap» or «claim» the gift. Sometimes the token shows a large fictitious dollar balance because its «price» is set on a fake liquidity pool.
Dust attacks. A tiny amount of a real asset arrives at the address. The goal is not to lure but to trace: if you later move that remainder together with other funds, an analyst will link the addresses. In an airdrop context it is also a way to «attach» someone else's wallet to your cluster.
Address poisoning. A zero-value or spam-token transaction from an address that begins and ends with the same characters as an address you actually work with. The goal is to land in your transaction history and wait for you to copy the address from there.

What they have in common: none of these transactions gives the sender access to your wallet. They paid gas to show you something. What happens next depends on your actions.

Why interacting is the risk, not receiving

Receiving a token is a passive event. Risk arises in three cases, and all of them require your signature.

Visiting the site in the name. The token is called something like «Claim at ...» or «Visit ... to swap». The site is a standard phishing page: connect your wallet, sign a «verification», get the reward. The signature turns out to be an approval on real tokens or a transfer. How such pages are built is covered in the article on spotting fake claim sites.

Trying to sell or swap it. It seems logical: the token shows a balance of thousands of dollars, why not swap it. But for a DEX to swap it you have to grant an approve to the token contract, and the contract was written by the scammer. On approve or transfer it can execute arbitrary logic — for example, demand a «fee» in the native coin, or simply refuse to sell after you have paid gas. There is no real liquidity behind such a token.

Interacting with the contract directly. Calling any function of a spam contract — burn, claim, unlock — is a transaction to code you have not audited. The only safe call is none.

Separately: hiding a token in the wallet interface is not a transaction. The wallet simply stops displaying it; nothing changes on-chain, and it is safe.

Address poisoning: swapping the address

This scheme deserves a detailed look because it requires neither a signature on a fake site nor an attempt to sell spam — only one habit.

How it works. You regularly send funds to an address, say your exchange deposit: 0x1a2b…9f8e. The scammer generates an address with the same first and last characters — a brute-force search that takes seconds or minutes — and sends a zero-value or spam-token transaction from it to your wallet. Now your history contains two addresses that look identical in the shortened form that wallets and explorers display.

The next time you want to send to the exchange and open your history to copy the address «like last time», there is some probability that you copy the scammer's address. The transaction goes out; it cannot be reversed.

Protection comes down to three rules. First: never copy addresses from transaction history — only from the source (the exchange interface, the wallet's address book, a verified document). Second: before sending, compare the whole address, not the first and last four characters; wallets with an address book and labels for verified addresses reduce the risk substantially. Third: for large transfers to a new address, send a test amount first and confirm it arrived where intended.

What to do with an unknown token

The sequence is the same in every case:

Sign nothing. Do not follow links in the name, do not try to sell, do not call contract functions.
Hide the token in the wallet. Most wallets let you hide an asset from the list. This is cosmetic and involves no transaction.
Look up the contract in an explorer. Open the token contract address in a block explorer: age, number of holders, verified code or not, «spam» or «phishing» labels that explorers often apply. This is reading, not interacting.
Check approvals. If there is any doubt that you already signed something, review active approvals and revoke unfamiliar ones. How to do it is covered in the article on revoking token approvals.
Leave it as it is. A spam token can sit in a wallet for years without creating risk. It does not need to be «disposed of».

If the token is dust in a real asset (a small amount of a stablecoin, for example), it is also better left alone: moving it will merge your address with the sender's on the graph.

Safe-action checklist

The recipient address is copied from the primary source, never from transaction history.
Before sending, the address is compared in full, not by its edges.
A large transfer to a new address starts with a test amount.
Tokens with websites in their names are hidden and not opened.
Spam tokens are not sold, swapped or «burned».
Active approvals are reviewed regularly, not only after an incident.
The wallet used for airdrop activity is separate from the main one so that any mistake has a limited cost — how to set that up is described in the article on wallet setup for airdrops.

A stranger's token in your wallet is a letter someone dropped in your mailbox. It does not open the door; you open it when you follow the link or sign the transaction. Real distributions happen differently: the team announces them, and the project's status changes based on official data — exactly the changes CoinDropster tracks for every project. See tracked airdrops →