Someone sent that token to your address. Sending a token to any address needs no consent from the recipient, so its turning up in your wallet does not mean anyone has been inside the wallet. Sitting in your list it does no harm. The loss comes from what you do next: following the token's name or its website to “claim” or “swap” it and, once there, signing an approval for your real USDT or USDC or typing in your seed phrase. So leave it alone: no clicking links, no swapping, no sending it out, and hide it in the wallet if it bothers you.

Why would a stranger send me tokens?

Sending a self-issued token to a great many addresses costs only a little gas, and it pays off for the sender if even a few recipients follow the instructions. The usual disguises:

  • A token named USDT or USDC whose contract is not the real USDT or USDC contract. Anyone can give a token any name; the same name does not make it the same token.
  • A “claim” URL written straight into the token name.
  • The name of a well-known protocol with a word like Reward or Airdrop added.
  • A balance shown as a neat round number, so that it looks like a windfall.

It shows up in your asset list unprompted because the wallet scans for tokens on your behalf. According to the MetaMask help page How to display tokens in MetaMask, token autodetection is on by default on EVM networks and Solana. The same page advises being wary of airdropped tokens you do not recognize and researching them before you interact.

If leaving it alone is harmless, where does the loss happen?

When you follow its instructions to “claim” it, or try to turn it into ETH or USDT. There are three common routes:

  • Signing an approval for a real token. The page asks you to sign an approve for a real token such as USDT, USDC or WETH, or a Permit off-chain signature presented as mere “verification”. Whichever token the approval covers can then be moved out with transferFrom.
  • Handing over the seed phrase or private key. Some pages ask you to “import your wallet to verify eligibility”. Typing it in hands over the whole wallet.
  • Interacting with the unknown token itself. Its contract was written by the sender, so sending it, selling it or approving it runs code you have never seen. The MetaMask page above adds a warning: if a transaction with such a token fails and the error message in the block explorer points you to a website, that is most likely a phishing site, so do not click it.

ERC-20 approvals are kept separately for each token, inside each token's own contract: even if you signed an approve for the unknown token, that gives the sender no access to your real USDT. The step that loses coins is signing an approval for a real token, or giving up the seed phrase. Which kinds of signature get abused this way is covered in the section on which approvals scammers go after in How to Check and Revoke Token Approvals.

Unknown token, zero-value transfer or tiny deposit: telling the three apart

What turns up in a wallet is not always a named unknown token. Two other things look similar, have different aims, and are often lumped together with it.

  • An unknown token with a name or URL (a fake airdrop). A token you never bought appears in your list. The sender wants you to go to their website and sign an approval or enter your seed phrase. What to do: leave it alone.
  • Address poisoning. A transfer appears in your history, usually for zero, from an address whose first and last characters match one you use often. According to the MetaMask help page Address poisoning scams, scammers use vanity address generators to create the look-alike address and then plant it in your history with this transfer. The transfer itself is harmless; the loss comes when you later copy that address from your history and send coins to it, and what is sent cannot be recovered. What to do: check the full address before sending, middle characters included; do not copy addresses from transaction history; save the addresses you use often in the wallet's address book and pick from there.
  • Dusting attack. A tiny amount of a real coin arrives. The sender does not expect you to click anything. They watch which other addresses' funds that amount is later spent with, to infer which addresses belong to the same person ahead of targeted fraud. It steals nothing directly. What to do: leave it where it is, and do not combine it with other funds in a transfer.

The three have one thing in common: the arrival alone does not cost you any coins, and there is nothing you need to “handle”, “activate” or “revoke”. A token someone airdropped to you was never approved by you, so there is nothing to revoke. When someone uses it as a reason to hurry you to a website, that step is the scam; see the warning about fake revoke tools in How to Check and Revoke Token Approvals.

Can I sell it, send it away or delete it?

  • Swapping it for ETH to see what happens. Don't. These tokens tend to steer you to a swap page of their own, and that page asks you to sign an approval or a Permit signature for your real USDT or USDC.
  • Sending it to another address. There is no need. A transfer calls the token's own contract, written by the sender, and may simply fail and cost you the gas. It cannot touch real tokens you never approved, but there is no reason to sign any transaction for it either.
  • Deleting it from the wallet. What you can do is hide it: MetaMask's documentation says a token can be removed from the asset list by switching it off in the token list. Hiding only stops it being displayed; the on-chain record remains, and that does not matter.
  • Opening its contract in a block explorer for a look. Viewing triggers no transaction. Do not click any URL shown on the token page or in an error message.

What if I already clicked the link or signed something?

It depends on how far you went:

  • You only opened the website, without connecting the wallet or confirming anything in a pop-up: close the page and you are done.
  • You connected the wallet and confirmed an approval or signature in a pop-up: check the address's approvals straight away and revoke any you do not recognize. For an off-chain signature such as Permit, follow Can a suspicious Permit signature still be cancelled? and move the affected token to another address as well. The steps for checking and revoking are in How to Check and Revoke Token Approvals.
  • You typed your seed phrase or private key into the page: treat it as a leak, create a new seed phrase and move the assets over, in the order given in Seed Phrase or Private Key Leaked? What to Do.

Other ways the same kind of scam reaches people are in the guide to crypto phishing scams.