How to Spot Spam Tokens and Dusting Attacks
A token you never bought has appeared in your wallet. In most cases your wallet is fine. What matters is what you do next.
Updated October 14, 2026 • Dust Sweeper Team
What spam tokens are
Attackers send worthless tokens to many public addresses at once. The token name or metadata usually contains a link or a message such as a claim prompt, hoping you will visit a site or try to sell the token.
Warning signs
- A token you never traded, appearing on several networks.
- A name that includes a website address or urgent wording.
- A “claim” or “verify” page that asks you to connect a wallet and sign.
- A token that can be bought but not sold, a common honeypot pattern.
- A displayed value that looks too good to be real.
Dusting and address poisoning
Some attackers send tiny amounts to many wallets to try to link addresses together. Another pattern is address poisoning: a tiny transaction from an address that looks similar to one you use, hoping you copy it from your history later and send funds to the wrong place. Always compare the full address, not just the first and last characters.
What to do
- Do not click links or visit sites tied to the token.
- Hide the token in your wallet app. It is free and needs no signature.
- Do not try to sell or swap it until you have verified the contract.
- Review your token approvals and revoke any you do not recognise.
- Never share a seed phrase or private key with any site.
Does a spam token mean I was hacked?
No. Receiving a token needs nothing from you. Danger starts when you sign an approval, connect to a malicious site or send funds to a poisoned address.
Frequently asked questions
Can a token drain my wallet just by arriving?
No. A token arriving does not give anyone permission to move your funds. Signing an approval does.
Should I try to sell a token I did not buy?
Not before researching it. Failed sells waste gas, and some tokens bait you into harmful approvals.
How can I check if a contract is risky?
Review it on a block explorer and use a contract risk scanner as one signal. No automated check is a guarantee.
Dust Sweeper is a non-custodial tool: it reads your public address and every swap or bridge is a transaction you review and sign yourself. It never needs your seed phrase.
SCAN YOUR WALLET