Security & Anti-Scam
Unknown Tokens Appeared in Your Wallet? Don't Touch Them - How Poison Airdrops Work
Tokens you never bought showing up in your wallet - sometimes with an impressive 'value' - are bait. Three mechanics: approval phishing, scam-site token names, and dust tracking. The correct response is simpler than you think: nothing.
Checked July 13, 2026. Scam mechanics evolve, but the principle here is durable: assets of unknown origin are safest untouched.
You open your wallet and find tokens you never bought - names that look like URLs, or a displayed "value" that looks like free money. The short version: this is not luck, it is bait on a hook. Anyone can send tokens to any public address, yours included, and scammers spray them in bulk.
The three mechanics
Mechanic 1: approval phishing. You try to sell or move the tokens, which routes you to the scammer's site or contract. Somewhere in the flow a signature request appears that actually grants transfer rights over your real assets. Sign it, and the USDT and ETH drain.
Mechanic 2: the token name is the ad. The token's name is a URL, luring you to a fake "claim" page that asks you to connect a wallet and sign - or to enter your seed phrase. Entering a seed phrase hands over the entire wallet, permanently.
Mechanic 3: dust attacks. Tiny amounts ("dust") are sent so that your subsequent transactions help link your addresses and identity through chain analysis - groundwork for targeted scams later.
The only correct response: nothing
- Do not sell, transfer, or swap them;
- Do not visit any URL embedded in a token name;
- Do not sign or approve anything on their behalf;
- Hide the token in your wallet UI (most wallets support this) and move on;
- Sitting in your address, the token cannot harm your other assets by itself.
If you already interacted
- Revoke suspicious approvals now, using a token-approval checker (block explorers have them);
- Move assets to a brand-new wallet with a new seed phrase - not a new address under the same seed;
- If you typed your seed phrase anywhere, treat that wallet as fully compromised and abandon it;
- If an exchange account might be exposed too, change its password immediately, audit the device list, and switch on every security notification.
Does this happen on exchange accounts?
Exchange balances are platform ledger entries - nobody can push tokens into them the way they can on-chain. The variant that does exist: phishing emails and texts announcing an "airdrop credit" that link to a fake login page. Identification guides: fake apps and phishing sites and the fake support playbook.
FAQ
Q: The tokens show a value of thousands of dollars. Real? The "price" is set in a pool the scammer controls. You cannot realize it; it exists to trigger greed.
Q: Will hiding them stop new ones from arriving? No - a public address cannot refuse deliveries. Hide and ignore; the cost stays on the scammer's side.
Q: Is keeping funds on an exchange the fix? It does remove this vector, but custody is a broader trade-off - see exchange account vs your own wallet.
This article is for educational purposes only and is not investment advice. Crypto assets are volatile; assess the risks yourself before acting. All rules and fees are subject to what OKX officially displays in your account. This site is not affiliated with OKX.