You open your wallet one day and notice a token you do not remember buying. Maybe it has a name that sounds official, a dollar value that looks surprisingly high, or a message baked into it telling you to visit a website to claim more. It is easy to feel a small jolt of excitement or worry. This article explains where these tokens come from, why most of them are bait, and the simple habits that keep you safe.
What an airdrop actually is
An airdrop is when a project sends tokens to many wallet addresses at once, usually for free. Because a blockchain like Base is a public ledger, anyone can send a token to any address without asking permission. That is the same property that lets you receive a payment from a friend. It also means a stranger, or an automated bot, can drop tokens into your wallet whether you want them or not.
Some airdrops are legitimate. A project might reward early users of an app, or distribute governance tokens to people who used a protocol before a certain date. But those real airdrops are the minority of what most people see. Far more common are tokens sent out in bulk by scammers, hoping that curiosity does the rest of the work.
The token itself is usually not the danger
Here is the part that surprises many newcomers. A token simply sitting in your wallet cannot drain your funds. It has no power on its own. Receiving it does not give anyone access to your balance, your other tokens, or your recovery phrase. So if you notice a strange token and do nothing, you are generally fine.
The danger almost never comes from the token. It comes from what the token tries to convince you to do next.
How the scam usually plays out
Scam tokens are designed as advertisements. The trick is in the details attached to them.
- A name that mimics something real. The token might be named to look like a well known project, a stablecoin, or an official reward. The goal is to make you trust it.
- A fake dollar value. Some scam tokens are set up so a wallet or price site shows a large balance, for example a few thousand dollars. This is a display trick, not real money. You cannot sell it for anything.
- A built in message or link. Many of these tokens carry a name or symbol that reads like an instruction, such as a website address where you can "claim" a reward or "unlock" the value you see.
If you follow that link, you land on a page that looks polished and legitimate. It asks you to connect your wallet, then to sign a transaction or approve a token. That approval is the real payload. Instead of claiming a reward, you may be granting a smart contract permission to move your genuine tokens, or signing a message that authorizes a transfer. This is the same mechanism behind most wallet drains, and it works because you came looking for it rather than the scammer chasing you.
What to do when a strange token appears
The safe response is almost boringly simple.
- Do not interact with it. Do not tap it to see options, do not visit any website printed in its name, and do not try to sell or swap it. Just leave it alone.
- Do not connect your wallet to any site the token points to. No real reward requires you to approve access to your existing funds.
- Hide it if your wallet allows. Many wallets let you hide or mark a token as spam so it stops cluttering your balance. Hiding it changes nothing on the blockchain, it just cleans up your view.
- Treat any surprise value as fake until proven otherwise. If you genuinely think an airdrop might be real, verify it through the project's official channels that you find independently, not through a link inside the token.
You generally cannot remove a token from your wallet on the blockchain itself, because the record of the transfer is permanent and public. That is normal. Hiding it in your wallet interface is the practical fix.
A note on dust and address poisoning
A related trick is called address poisoning. A scammer sends you a tiny amount of a token, or even zero, from an address that is made to look almost identical to one you use often. The first and last characters match, and only the middle differs. The hope is that later, when you copy an address from your transaction history to send a payment, you grab theirs by mistake.
The defense is the same discipline that helps everywhere in self custody. Always check the full destination address before sending, not just the first few characters, and paste it from a source you trust rather than from your history.
The mindset that keeps you safe
Unsolicited tokens are a good reminder of how self custody really works. No one can reach into your wallet from the outside. Every loss requires a signature or an approval that you provide. That is a heavy responsibility, but it is also a form of protection, because it means slowing down and reading before you sign is almost always enough.
When something free appears out of nowhere and asks you to take action to claim it, treat that as the warning sign, not the reward. Leave it be, keep your recovery phrase offline, and verify anything important through official sources you found on your own. The quiet, uneventful approach is the winning one here.