An Unknown Token Appeared in Your Wallet: How to Investigate Without Interacting

Do not click the token's website, call a number in its symbol, scan an attached QR code, or follow a claim instruction. Do not attempt a test swap, transfer, approval, burn, or close-account transaction simply to remove the item. Any proposed transaction can contain additional instructions beyond the action shown in a button label.

Use the wallet's hide or spam-report feature if it operates locally and does not request a signature. Lock the wallet before researching, and open a separate browser profile if convenient. Never enter a recovery phrase into a site. Wallet support does not need that phrase to inspect a public address.

Copy the contract address or Solana mint address from the wallet's asset details without opening embedded links. Search that address in a reputable block explorer. Confirm the network, token standard, creator or deployer, creation transaction, total supply, holder count, and the transaction that delivered the asset. Names and symbols are not identifiers and can copy established projects.

On EVM networks, note whether the address is verified and whether it is a proxy. On Solana, confirm the owning token program and decode mint authorities and Token-2022 extensions. Inspect metadata as untrusted text. If an explorer automatically renders remote media, disable previews when possible because the remote host may log requests.

Search the exact address in established market-data and security APIs such as CoinGecko and GoPlus. A missing listing is common for new or insignificant assets and is not a conclusion. A listing confirms that the provider tracks an address under its methodology; it does not validate every contract permission or external link.

Compare the address against the project's independently located official documentation, not a URL supplied by the token itself. Review deployment age, holder distribution, liquidity pools, source verification, owner or role permissions, and recent transfers. Keep observations address-specific because assets with the same name may exist on several chains.

Receiving a standard ERC-20 transfer does not create an allowance from your wallet to the sender. Receiving a Solana token does not authorize arbitrary access to SOL or unrelated token accounts. The important question is whether you separately signed an approval, permit, delegation, account-authority change, or broader transaction around the same time.

Review recent wallet transactions and token allowances through a trusted explorer or established approval checker reached independently. If an unfamiliar approval exists, use a trusted revocation interface and inspect the revocation transaction carefully. Disconnecting a site from a wallet only removes the site's connection session; it does not revoke on-chain allowances.

• Record chain, asset address, receipt transaction, sender, and timestamp.
• Inspect public data without signing or connecting the affected wallet.
• Check prior approvals and signatures separately from the incoming transfer.
• Keep metadata links and remote media untrusted.

Explorers, token lists, wallet labels, and security APIs can be incomplete or stale. Contract verification does not establish the safety of associated websites, and simulation covers only selected calls and state. An unsolicited token can also be unrelated to any earlier wallet activity, so temporal proximity alone does not prove a connection.

If you already entered a recovery phrase, signed an unclear transaction, or observe unauthorized outgoing activity, stop using the affected account for new activity and follow the wallet provider's documented incident process from a known official domain. Preserve transaction hashes and timestamps. Avoid unsolicited recovery services and direct messages, which add another trust dependency during a sensitive investigation.