Spam Tokens: Why They Appear and What to Do

Spam tokens are unsolicited balances that appear in a wallet without any action from its owner. They are not a glitch in the wallet software and not a sign that the address has been compromised — they are addressed to you on purpose, because the sender wants you to look.

The reason spam tokens work is economic. Writing an entry to a token contract is cheap, and a wallet that displays unsolicited balances gives the sender free screen space in front of exactly the person they want to reach. Understanding that trade is most of the defence.

• Nothing was hacked. These tokens arrive because a contract can credit any address without permission. The wallet is only reporting what the chain says.
• The token is the message. Its name, ticker, or amount often carries a URL or instruction. Reading it is the interaction the sender wants.
• Do not approve, swap, or “claim”. Most harm comes from a signature or approval you grant afterwards, not from the token arriving.
• Hide, do not burn. Hiding is a display setting. Sending the token to a burn address still requires a transaction and can cost more than it removes.

Why spam tokens arrive in the first place

Token standards on most smart-contract networks allow any address to call a transfer function and credit any other address. There is no allowlist, no acceptance step, and no way for a wallet to refuse a balance at the protocol level. A spammer needs one transaction per recipient and can batch thousands of them.

The address book is public

Every address that has ever interacted with a contract is visible. So is every address that received a transfer from a large exchange withdrawal wallet, every address that holds a well-known token, and every address that appears in a public airdrop list. Address lists are compiled once and reused. Being targeted says nothing about you beyond the fact that your address is active.

Cheap credits, expensive attention

A transfer that only writes a balance entry is usually far cheaper than a transfer that moves value between parties, because no liquidity is involved. That asymmetry is the whole business model: near-zero cost per impression, and a small conversion rate is enough to make it worthwhile. Some of these tokens are also designed so that the first person to trade them pays a fee that flows to the creator.

How the token is built to be touched

Most spam tokens are engineered so that curiosity produces a specific action. Recognising the pattern is more useful than memorising ticker names, which change weekly.

Names that impersonate something

Common patterns include a ticker that closely matches a well-known asset, a name that references a claim or a reward, and an amount chosen to look like a rounding error rather than a lure. A balance of a few thousand units of an unfamiliar token is designed to look like a mistake you might want to correct.

Contract behaviour that punishes selling

Some token contracts restrict who may transfer. An address can receive the token but cannot send it, or can send it only to a specific contract. Others apply a fee on transfer that is routed to the deployer. In these cases the token has no market at all — the only exit the contract permits is the one the creator controls.

The safest assumption about an unsolicited token is that its contract was written by someone who wants you to sign something. Treat the balance as an advertisement, not as an asset.

Sites that appear when you look it up

Searching the ticker of an unsolicited token often leads to a site that offers a swap, a “migration”, or a claim. That site is the actual payload. The token exists to make the search happen. Bookmarking a small set of venues you trust, and reaching them only through those bookmarks, removes most of this risk.

Comparing what you might receive

Not everything unsolicited is hostile, and not everything named like a reward is real. The table below separates the common cases by what the sender appears to want.

The last row is the one that requires judgement. Real distributions exist, and they are announced through channels you can check without touching the token itself. The test is not whether the token looks professional — it is whether you can confirm the claim through a source you already trusted before the token arrived.

Handling spam tokens without interacting

The procedure below is deliberately passive. Almost every step avoids a transaction, because a transaction is the part that can cost you something.

1. Do not open the token’s contract through a link inside the token name or a search result.
2. Note the contract address and set the token to hidden in your wallet’s display settings.
3. Check your approval list for that contract address. If nothing is approved, there is nothing to revoke.
4. If an approval exists, revoke it from a block explorer or approval tool you reached by typing the address yourself.
5. Ignore any instruction to “burn” or “return” the token. Burning requires a transaction and gains nothing.
6. Review connected sites for anything unfamiliar, and disconnect what you do not recognise.
7. Repeat the review after any period of inactivity, since approvals can be granted by a single signature months later.

If a wallet already shows an approval to an unfamiliar contract, treat that as the real event and the token as the doorbell. Revoke first, investigate second.