An Unknown Token Appeared in My Wallet — Is It Safe?

Short answer

Do nothing. Specifically: do not click, do not "sell" or "swap" the unknown token, do not interact with any URL claimed by the token's metadata. Unknown tokens appearing in your wallet are a known attack pattern — the token contract often has malicious approval or transfer functions that drain wallets when interacted with. Just ignore them. Most wallets let you "hide" the token from your interface; that's the right action.

What's actually happening

Anyone can deploy an ERC-20 token contract on Ethereum or any EVM chain. The deployer can mint tokens to any address — including yours — without your consent. Etherscan shows the airdrop in your transaction history. Your wallet displays the token because the wallet just lists every ERC-20 you've received.

Three motivations for the deployer:

Phishing. The token's name or metadata embeds a URL like "claim-100-FREEBIES.com." Click → fake claim page → connect wallet → sign malicious approval → wallet drained.

Address poisoning prep. The deployer is setting up a future attack by establishing a fake "interaction" with your address. Later, when you copy an address from history, you might accidentally copy the attacker's similar-looking one.

Wash trading. The attacker creates fake volume by sending tokens between wallets, then claims "this token has trading volume" on suspect DEX listings.

What not to do

Do not visit any URL associated with the token. Do not try to sell it on Uniswap or any DEX — the contract's "sell" function may trigger an approval that drains your wallet. Do not "burn" it — that requires a transaction that costs gas and may also trigger malicious code.

If the token shows a nonzero "value" in your wallet, that value is fake — the wallet inferred it from the token's reported supply and a fake liquidity pool the attacker created. The token is worthless.

What to do

Most wallets support "hide token" — Trust Wallet, MetaMask, Rabby all have it. Click the token's three-dot menu, select hide. The token remains in your address's on-chain history (you can't change that), but it disappears from your wallet UI. That's all the action needed.

For ongoing prevention, consider using Rabby Wallet — its built-in scam-token filter automatically hides most known scam tokens before you see them.

Further reading: Dusting attack, Phishing.