Unknown Token in Your Crypto Wallet? A 4-Step Look, Don't Touch Check (2026)

By CoinX Editorial (GSPTeck) · Published 2026-11-04 · Last verified 2026-11-04

What should you do when an unknown token shows up in your crypto wallet?

Look at it, but do not touch it. Do not sell, swap, send, approve or "claim" it, and do not open any link or website it points to. MetaMask's help centre says plainly that no one can get access to your funds simply by depositing tokens into your wallet. The danger starts when you interact: the scam depends on you trying to sell or swap the token, or on a link that sends you to a fake site. Trezor goes further and advises that you assume any asset you were not expecting is a scam. This guide gives a 4-step "Look, Don't Touch" check, explains what each type of unexpected asset is trying to do, and shows how to clean up if you have already clicked something.

Educational content, not financial or security advice for your specific setup. Wallets differ, so check the official documentation for the wallet you use.

Four steps for an unknown token in your wallet: look at the network and contract address, hold and do not sell, swap, send or approve, verify on a block explorer you typed yourself, and hide it and revoke if you signed — Look, Don't Touch.

The 4-step "Look, Don't Touch" check

Look. Note the network and the token's contract address or ID, and where in your wallet it appears. Do not tap through to "details" links inside the token or transaction. The only thing you need at this stage is the address.
Hold. Do not sell, swap, send, approve or claim it. Do not connect your wallet to any website mentioned in the token's name, in a transaction memo or on a token page. Never type your recovery phrase anywhere.
Verify. Look the token up yourself on the block explorer for that network, by typing the address into the explorer, not by following a link from the token. Known scam tokens are often flagged there. MetaMask's checklist also asks whether the token appears with token detection on, whether it has a real website and community, whether its creators are named, and whether there is a white paper. If you cannot confirm the token is what you expected, treat it as a scam.
Hide. Use your wallet's hide or "Hidden" feature so you are not tempted later. Hiding does not delete anything on-chain, but it removes the temptation. If you already approved something or connected to a site, move on to the clean-up section below.

Grid of unexpected assets and what to do: dust on Bitcoin or Litecoin, XRP or XLM memos, tokens and NFTs, fake USDT, approval prompts and never typing a recovery phrase — Unexpected assets.

Why a token you did not ask for is not a gift

Scammers send tokens to many addresses at once because it costs them little. MetaMask describes two common mechanisms. In the first, the token appears to have value on a block explorer or listing site, so you try to swap or sell it. In the second, viewing or adding the token shows an error message that directs you to a fraudulent site, where you are asked to approve a transaction, approve access to a token or hand over your recovery phrase. Trezor describes the same pattern: if you try to sell or transfer a scam token, you can end up interacting with a malicious smart contract that drains your wallet.

MetaMask also notes that it does not automatically display all tokens, only established ones, and only if token detection is turned on. A token that does not appear there is not proof of a scam, but it means that nobody has vouched for it.

Three kinds of unexpected asset

What you see	What it is trying to do	What to do
A tiny amount of coin on Bitcoin, Litecoin or Dogecoin	A dusting attack: tracking you by waiting for you to combine it with your other coins. Trezor says to avoid spending or consolidating that specific UTXO	Leave it alone. Do not include it in a transaction. Coin control, where your wallet offers it, lets you choose which coins to spend
A tiny transaction with a memo or link on XRP or XLM	Trezor says scammers embed messages with links to phishing websites that ask for wallet backups	Do not visit the link. Never write your wallet backup into a website
A token or NFT you did not expect on Ethereum, Solana or BNB Smart Chain	A token that looks valuable so you will interact with a malicious contract. Some are fake tokens posing as USDT	Do not sell or transfer. Hide it. Check the contract on a block explorer

For small balances that you did expect, see our guide to small crypto balances, dust and minimums. That is a different problem from unsolicited dust.

Approvals are where the real damage happens

MetaMask defines a token approval as permission for a dapp to access and move a specific type of token from your wallet. Approvals are normal when you use decentralized exchanges, but they are also, in MetaMask's words, one of the most common attack vectors for scams, especially unlimited ones. Trezor's advice is similar: watch for token approval transactions, verify the spender address and limit the approval amount. Neither wallet gives you a reason to approve anything in order to receive a token.

If a prompt appears after you tap a mystery token, stop and reject it. If you have already signed one, act quickly: MetaMask recommends revoking access, for example in MetaMask Portfolio, where you can review existing approvals. Our guide to checking and revoking token approvals walks through the process. If funds have already been taken, MetaMask says there is unfortunately little you can do, so the earlier you stop, the better.

Two columns of safe moves, such as looking at the address, hiding the token, verifying on an explorer and revoking approvals, and risky moves, such as selling, claiming, clicking memo links and typing a recovery phrase — Safe moves and risky moves.

How to clean up if you already clicked

You opened a link but did nothing else. Close the page. Do not connect your wallet. Run a malware scan if your device offers one.
You connected your wallet or signed an approval. Disconnect and revoke the approval at once, then check what else the wallet has approved.
You typed your recovery phrase into a site. Treat that wallet as compromised. Create a new wallet with a new recovery phrase on a device you trust and move what remains. Read seed phrase vs private key vs password for what that phrase controls.
You sold or swapped the token. Check your balances and approvals straight away. A swap that required you to approve access to your other tokens is the case to look at first.

Report phishing sites to your wallet provider where it offers a form, and never pay anyone who promises to "recover" funds. If you are not sure whether an offer was real, our guide to fake free crypto offers lists the signs.

Is it a scam or a real token you forgot about?

Some tokens that appear are real: you took part in a distribution, you received a payment or you used a service that sent a reward. Before you decide, work through these questions:

Did you ask for it? Did you sign up, hold a particular asset or use a protocol that announced a distribution?
Can you find an official announcement? Type the project's site address yourself and look for its announcement and its contract address. Compare the contract address with the one in your wallet, character by character. Our guide on verifying a token contract address has the full check.
Is the wallet missing something you expected? That is a separate problem. See crypto not showing in your wallet.

As a worked example of an official source, the CoinDrop page on the $DROP token publishes the project's own mint address, so you can compare a token in your wallet against it. For swaps, do not try to sell a token that a website or block explorer pushes you towards. Use the official Swappr app from Google Play for coins you chose and verified yourself, and check that GSPTeck is shown as the developer.

Four cases if you already clicked: link only, so close the page; signed an approval, so disconnect and revoke; typed a recovery phrase, so move funds to a new wallet; swapped, so check balances and approvals — If you already clicked.

Sharing your address does not expose you

People sometimes worry that sharing their address caused the unwanted token. Dust and scam tokens are sent to many addresses on a chain, and a public address is, by design, visible to everyone. What matters is what you do with the token, not who sent it. See is it safe to share your wallet address for the details.

Vertical Pinterest graphic with five points on what to do with an unknown token in a crypto wallet — Pinterest pin: unknown token in your wallet.

FAQ

Can a random token steal my crypto just by appearing in my wallet?

No. MetaMask says no one can get access to your funds simply by depositing tokens into your wallet. The risk starts when you sell, swap, approve or claim the token, or follow a link or site that it points to.

Should I delete or burn an airdropped token I don't recognise?

Hide it instead. Hiding is a display setting and does not remove it on-chain. Sending it anywhere, including to a burn address, is an interaction you do not need, and on some chains it can trigger a malicious contract.

What is a dusting attack, and should I be worried?

It is the sending of tiny amounts of crypto to many wallets, often to track your transactions. Trezor says receiving dust is normal and poses no risk if handled correctly. The one rule on Bitcoin-style chains is not to spend or consolidate the dust with your other coins.

What if I already approved something or entered my recovery phrase?

Revoke the approval straight away, for example in MetaMask Portfolio. If you typed your recovery phrase into a website, treat the wallet as compromised and move what remains to a new wallet with a new phrase.

Sources

MetaMask Help Center: How to tell the difference between a regular airdrop and airdrop phishing scams (checked 2026-11-04)
MetaMask Help Center: What is a token approval? (checked 2026-11-04)
Trezor Support: Dusting attacks and airdrop scam tokens (checked 2026-11-04)