Prevent a New Type of Token Transfer Scam¶
Some token transfers arrive without your asking, take nothing from you, and still end with an empty wallet. The token is bait, the trap is the step you are asked to take next, and the defense is to separate a token appearing in your wallet from a token having value.
Who this is for¶
Anyone who finds an unfamiliar token in their wallet and considers selling it, swapping it, or claiming a reward linked to it.
How the scam works¶
An attacker deploys a token contract and sends an amount of it to your address. Your wallet lists the token because it watches the contract or because the token was added automatically. The balance looks like a windfall, and the name may copy a well-known project.
The trap is the next step: when you try to sell or claim, the token's contract runs code written by its author. One version asks you to approve the token, and the approval you sign covers a valuable asset you already hold. Another asks for a signature that grants spending rights without a visible transaction; a third cannot be sold at all, because transfers out fail and the value was never there.
The callback pattern is the subtle one. A function that looks like claim or transfer calls back into your wallet's approval path, and the result is a permission you did not mean to give. By the time the site reports that the claim failed, the approval already exists.
Appearance and value are separate things. Anyone can create a token, choose its name, symbol, and supply, and open a tiny pool so a price appears somewhere. A row in your wallet is a claim by a contract, not an endorsement by Bitgold or by the wallet; receiving a token needs no gas and no permission from you, which is why an unexpected one deserves suspicion.
No fee to receive
Receiving BTG or a token does not require a payment. A "claim" that asks you to send gas, a deposit, or an unlock fee to another address is a payment request, not an airdrop.
Warning signs¶
- A token you never bought appears, often with a large nominal balance or a familiar brand name.
- A site, DM, or comment tells you to claim, sync, migrate, or validate the token.
- The next step needs an approval, a signature you cannot read, or a fee in BTG sent to a different address.
- The token has a price on one obscure pool, and a swap fails or returns almost nothing.
- The approval request is for an unlimited amount, or for a token you actually hold.
- Urgency: the offer expires, or the balance will be "burned" if you wait.
If it happens to you¶
- Do not interact with the token. Do not approve it, claim it, or swap it.
- Open your wallet's approval list and revoke anything granted to an address you do not recognize.
- If you signed a message, move the assets that approval can reach to a new wallet.
- If you paid a fee to claim, stop; do not pay a second fee to "release" the first.
- Save the token contract address and report it to your wallet vendor.
Next steps¶
- Fake Token Scam — honeypots and tokens that cannot be sold.
- DApp Approval Scam — how an approval becomes a withdrawal later.
- How to Check and Cancel Approvals — find and revoke what a trap obtained.
Self-check¶
- Do I check what an approval covers before I confirm it?
- Do I treat an unexpected token as a claim to verify rather than a payment received?
- Do I know which of my tokens a single unlimited approval could move?
- Can I find my wallet's approval list without help?