Random tokens in your wallet: spam, dusting or scam?
A token you never bought just showed up in your wallet, sometimes with a tempting dollar value or a website in its name. It can’t take anything from you as long as you leave it alone. Here’s what it’s after, and how to tell it apart from the real thing.
Random tokens showing up in your wallet are about the most common thing on Ethereum, Base or Solana, whether you use MetaMask, Phantom or Coinbase Wallet. Anyone who knows your address can send you anything. On my own wallets, 23 of my 46 on-chain positions are tokens I never asked for, received across six wallets in a year and a half. I never did anything with them, which was exactly right.
Why you get tokens you never asked for
Creating a token and sending it to thousands of addresses is cheap, especially on a low-fee network like Base. The sender sprays every active address and waits for a few to bite. Here are mine:
| What I received | How many | What it’s after |
|---|---|---|
A fake SHIB and a fake DOGE, on Ethereum | 1 and 2 units | passing for the real coin, and its price with it |
REKT, KING, WAR, BEAR | 1 unit each | curiosity |
A token named T.ME/S/US_POOL, on Base | 750 units | sending you to a Telegram group |
KPER, PF, NOODLE | 162 to 2,400 units | looking like an airdrop worth something |
The name is the message: it sends you to a website or a group. That’s where the trap is, never in the token.
Spam, dusting or address poisoning: three different traps
“Dusting” actually covers three techniques, and they’re not after the same thing.
Spam tokens, or fake airdrops
This is the vast majority. The token’s name promises a reward, or shows a web address. The website asks you to connect your wallet and sign to “unlock” the token. That signature gives a contract the right to spend your real tokens, or moves them right away. Ethereum.org describes this scenario step by step.
Dusting, mostly on Bitcoin
A few worthless satoshis (“dust”), sent to follow you. Spend them with your other bitcoin, and the transaction tells the sender those addresses all belong to you. That dust is real bitcoin. Freeze it if your wallet allows (coin control), or never spend it with the rest.
Address poisoning
The nastiest of the three. The scammer generates an address that starts and ends like one of your usual recipients. From it, they send you a zero-value transaction, which sits in your history right next to the real one. The day you copy “the last address I used”, you copy theirs.
The transaction can also carry a speck of a real token. On my wallets, seven look-alike addresses sent me between 0.00001 and 0.0004 USDC, or a millionth of a SOL, anywhere from two seconds to six weeks after the transfer they were copying.
MetaMask documents address poisoning and gives the fix: copy addresses from your address book, never from your history. On my Arbitrum wallet, several fake USDC play the same role, some spelled with a Cyrillic S and C.
What you should never do
A token sitting in your wallet is inert. The danger always comes from something you do:
- don’t swap it, whether on the site it points to or on a well-known platform: the swap runs its contract’s code, written by the scammer;
- don’t approve it, and don’t sign anything on a site that claims to “unlock” or “claim” it;
- don’t visit the address written in its name, or the Telegram group it mentions;
- don’t send it away to “clean up”: you pay fees and run its contract again;
- never copy an address from your history;
- never give out your recovery phrase, to anyone, for any reason.
What you should do: nothing. Most wallet apps (MetaMask, Phantom, Rabby…) let you hide a token, with no transaction and no fee.
What if it’s a real airdrop?
Real ones exist, but you recognise them by what surrounds them, not by the token:
| A real airdrop | A fake one |
|---|---|
| Announced on the project’s official website, found on your own | Announced by the token, in its name or on the website it mentions |
| Its contract is the one the project and a price site such as CoinGecko list | Unknown contract, or a famous coin’s name without its contract |
| You know why you got it (you used the protocol) | It shows up for no reason |
| Never asks for your recovery phrase | Always ends with a signature or something to type in |
The thousands of dollars sometimes displayed are just as fake. The creator seeds a tiny market at an absurd price, and the only “sale” on offer goes through the rigged website.
Why spreadsheets and portfolio apps get fooled
A spreadsheet, or an app that copies blockchain balances, counts these tokens like everything else. On my wallets, every other line was noise. A sheet that sums by ticker gives my fake DOGE the price of real Dogecoin, and a fake USDC a dollar per unit. Hold a few thousand units of a fake stablecoin, and your total is off by that much.
You can’t sort them by name either: a fake SHIB is impossible to spot by eye, and a word blocklist is easy to dodge. Finally, a real airdrop you haven’t touched yet looks exactly like a pushed token.
What Crypto Master does instead
Crypto Master judges a token by what you did with it, not by its name. A token received, unknown to the price catalogue by its contract, and never swapped, approved or sent, is presumed unsolicited.
It’s greyed out, left out of every total, and hidden by a box ticked by default, which says how many it holds back: 21 tickers on my account. Your call wins both ways, and the presumption clears if you swap the token. Imitations of a coin in the same wallet, like my fake USDC, are filtered out at import.
Look-alike addresses get flagged too. Their dust carries a “look-alike?” badge, and the wallet’s page puts the real address and the fake one on top of each other, with the middle underlined, where they differ. Pushed NFTs are judged the same way, listed separately on the wallet’s page and left out of every total.
Crypto Master reads your wallets from their public address and signs nothing. See how to track a Ledger from its public address or xpub, and what we keep, and what we never ask for. In the demo, untick the box: three pushed tokens come back. The free plan covers 3 connected accounts and 500 transactions.
Frequently asked questions
Why do I have random tokens in my wallet?
Anyone can send a token to any address, without your consent. Scammers spray thousands of addresses at once, hoping a few recipients will sign something.
Can a spam token drain my wallet?
Not while it stays where it is. The signature it pushes you to make, to “claim” it, is what gives access to your real funds.
Should I sell, send or burn random tokens?
No: that runs its contract’s code and costs fees. Hide it in your wallet app instead, with no transaction.
What is a dusting attack?
Sending tiny amounts, mostly of bitcoin, to link your addresses the day you spend them along with your other funds. Don’t spend that dust, or freeze it.
What is address poisoning?
A lookalike of an address you’ve used, planted in your history by a zero-value transaction. Copy addresses from your address book, never from your history.
The token shows thousands of dollars: is it real?
Almost never: its creator can display any price by seeding a tiny market.
See three pushed tokens greyed out and kept out of the total, on a sample portfolio, without creating an account.
Open the demo
