Spam Token
Unwanted token sent to a wallet for advertising, tracking, or fraud.
A spam token is an unsolicited cryptocurrency or NFT sent to a public wallet address for advertising, manipulation, tracking, or fraud. It may imitate a legitimate asset, display a fake high value, or include a name and website designed to attract attention. Receiving one does not by itself mean the wallet's private key is compromised.
Public addresses can receive tokens from anyone under many blockchain standards. Attackers automate small transfers to thousands of wallets because creation and distribution can be cheap. Portfolio trackers then discover the token from on-chain data and may display its symbol, image, or manipulated price. A visible balance is not proof that a liquid market or legitimate redemption exists.
The main danger is interaction. A token may direct users to a phishing site that requests a recovery phrase or malicious signature. Attempting to sell it can require approving a harmful contract, while a fake claim page may drain valuable assets. Some tokens use unusual transfer behavior to generate errors containing promotional links. No legitimate support process needs a seed phrase to remove an unwanted asset.
Spam tokens can also support address poisoning and tracking. An attacker may create lookalike transaction history or observe which recipients interact, linking active wallets and behavior. Copying an address from recent activity without checking every character can send funds to an attacker. Users should obtain destinations from trusted records and confirm them on a hardware-wallet screen.
Burning or returning spam is often unnecessary. The blockchain record remains, the transaction costs gas, and the interaction confirms activity. Wallets can hide assets locally or filter known spam. Filters can make mistakes, so users should verify exact contract addresses before hiding a legitimate token or trusting an automatically recognized one.
When an unexpected asset appears, do not click its links, import unfamiliar contracts into a dapp, or raise slippage to force a sale. Verify any claimed airdrop from the project's established official channels. Review existing approvals if a suspicious site was already used. Spam tokens exploit curiosity and misleading interface data, so ignoring them is usually safer than trying to clean the public address itself.
Frequently asked questions
- Anyone can often send a token to a public blockchain address, so scammers distribute cheap assets widely. Names, symbols, metadata, or attached websites advertise fake claims, support pages, or high apparent values. Some transfers also test whether an address is active. Receiving the token does not mean the wallet was hacked, and the displayed balance may have no real market value.
- Hide or ignore it through the wallet interface without visiting links or approving contracts. Do not attempt to swap, claim, validate, or sell an unfamiliar token merely because a dashboard shows value. Verify legitimate airdrops through independent official sources and exact contract addresses. Keep wallet software updated and report mislabeled assets to the interface provider when appropriate.
- Blockchain records usually cannot be deleted. Sending or burning the token creates another transaction, costs fees, and may expose the wallet to a malicious contract or tracking. Hiding it changes only the interface and is normally safer. A token cannot take other assets simply by appearing, but interacting with its website, approvals, or custom transfer logic can create risk.