Airdrops and surprise tokens: why ignoring them can be safest

Receipt is not an invitation

A token can appear in a public address because someone sent it there. That does not prove endorsement, eligibility, a real prize or saleable value. A name, image, or wallet display is not independent evidence of who issued it. The FTC warns that promises of free cryptocurrency can be a scam; that warning is not proof that every unsolicited token is fraudulent.

The risk is usually in an invitation to interact, not in the token merely appearing. An unsolicited NFT may include a claim link or message that leads to phishing or a malicious signing request, as MetaMask's NFT airdrop guidance explains. On Ethereum, an ERC-20 approve request authorizes a named spender to use up to a specified amount of that token; the ERC-20 standard defines this allowance. Other networks and wallet requests work differently. Never infer what a signing request will do from the token's name, image or displayed value.

How the trap works

An unfamiliar token shows a large dollar estimate and tells you to redeem it on a website. A displayed estimate is not proof that you can sell the asset or withdraw value. Its “claim” button may lead to a wallet connection and then ask for an ERC-20 allowance or a different transaction. The exact action depends on the selected network and the request shown by the wallet—not on the token's appearance.

Pause before clicking, connecting or signing. If a campaign might be genuine, find the project channel independently, then compare the exact network, contract or mint, and eligibility rules. The Ethereum security guide describes airdrop lures on Ethereum; it is one network-specific example, not a universal transaction model.

A closer check

The safest first move is to leave the unexpected asset alone. Do not click, connect, approve, swap, claim, move or burn it just because its metadata tells you to. If you need to investigate, start from information you find independently and inspect the network and complete token identifier there. Use a wallet's documented hide or report controls only when that wallet provides them.

If you already interacted

Stop signing. Keep non-sensitive details such as the network, token identifier, site address and transaction record; never share a recovery phrase, private key, password or signing code. Use the affected wallet or network's official incident guidance, and do not pay a stranger to unlock or recover the balance. For the permission distinction, read token approvals explained and phishing links and fake support.