Why Does My Wallet Show a Token I Never Bought, and What Should I Do?
If your wallet shows a token you never purchased, you have almost certainly received an unsolicited airdrop - a deliberate transfer of tokens to your address, often with malicious intent. The immediate action is: do not interact with it. Do not try to sell it, swap it, or even click "approve." This article explains how these tokens appear, why they are dangerous, and the exact steps to protect your funds.
How unsolicited tokens land in your wallet
Airdrops are common in crypto. Legitimate projects send tokens to reward early users or promote a new protocol. But unsolicited tokens you never claimed are almost always part of a scam. Here is how they get there:
- Direct transfers from a burner address. Anyone can send any ERC-20 token to any Ethereum address. Scammers send worthless tokens to thousands of wallets at once, hoping someone will try to trade them.
- "Dusting" attacks. A tiny amount of a token (often a fraction of a cent) is sent to many wallets. The scammer then tracks which wallets interact with the token to link them together, potentially deanonymizing you.
- Fake airdrops with hidden contracts. Some tokens have approval functions built in. If you interact with them - even just to "sell" or "transfer" - you may unknowingly approve a smart contract that can drain your other tokens.
The key point: receiving a token does not put your existing funds at risk. The danger begins when you take any action with it.
Why You Must Never Sell, Swap, or Approve an Unknown Token
The scam works because of token approvals. When you swap a token on a decentralized exchange (DEX), you first approve the DEX's smart contract to spend that token. If the unsolicited token's contract is malicious, it can trick you into approving a different token - like ETH or USDC - instead.
Here is a common attack pattern:
- You see a token appear in your wallet, worth a few dollars.
- You try to swap it on a DEX like Uniswap.
- The token's contract contains hidden code that, when you execute the swap, approves the scammer to spend a high-value token from your wallet.
- The scammer immediately transfers that token out.
The token you see may have a fake price on a shady DEX pair, but you cannot actually sell it for that value. The "liquidity" is fake and set up only to lure you.
Another variation: the token's name and ticker closely mimic a legitimate project (e.g., "USDC" with a slightly different contract address). Do not trust the name - always verify the contract address on Etherscan or a block explorer.
Step-by-Step: What to Do (and What Not to Do)
Follow these steps exactly. Do not skip any.
1. Ignore the token completely
Do not click on it. Do not try to send it to another wallet. Do not check its price on CoinGecko. The moment you interact with the token's contract - even to reject an approval - you may trigger the malicious code.
2. Hide the token in your wallet
In MetaMask, click the three dots next to the token and select "Hide." In other wallets, there is typically an option to remove or hide the token from your view. This prevents accidental clicks later.
3. Revoke any accidental approvals
If you have already approved the token (even by mistake), go to a revoke tool like Revoke.cash or Etherscan's token approval checker. Connect your wallet and revoke approval for that specific token contract. This is urgent if you interacted with the token at all.
4. Never share your seed phrase or private key
No legitimate airdrop requires you to enter your seed phrase or connect your wallet to a "claim" website. If a token's official-looking website asks for this, it is a phishing attempt.
5. Report the token to a block explorer
On Etherscan, you can flag a token as a scam. This helps protect others. But do this from a separate device or after you have secured your wallet - do not click any links on the token's page.
When an unsolicited token is legitimate
Very rarely, a real project airdrops tokens to active wallet addresses. Examples include Uniswap's 2020 UNI airdrop or Arbitrum's ARB airdrop. These are announced publicly beforehand, and you can verify the contract address on the project's official website or social media. If you have not heard of the project, it is almost certainly a scam.
Even for a legitimate airdrop, never claim it through a link sent to you. Go directly to the project's official site. Do not trust a direct message, email, or social media post claiming you have an airdrop waiting.
The Bottom Line
An unknown token in your wallet is a trap, not a gift. The safest action is to do nothing. Hide the token, never interact with it, and revoke any approvals if you already did. Your existing funds remain safe as long as you do not sign any transaction involving that token.
Not financial advice. brooder.tech publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.