Does Receiving a Scam Token Give It Access to Your Wallet?
Pricing and capability evidence checked September 3, 2026.
Rent update checked September 3, 2026: Every fixed per-account rent or payout figure in this older article is a historical example under the legacy 6,960-lamports-per-byte setting, not a current quote. Account size, the active rent stage, prior withdrawals, operation fees, and network costs can change the result. Read Solana Rent Reduction 2026 and use the live transaction preview for your wallet.
A random token can appear in a public Solana wallet without warning. Its symbol may imitate a known project, and an NFT image may claim you won an airdrop. The arrival is annoying, but it is not the moment the sender gains control of your wallet.
The typical attack depends on convincing you to take the next step.
Can a scam token drain your wallet just by arriving?
No. Receiving an unsolicited Solana token does not reveal your private key, connect a website, or grant its sender authority over your other assets. The common risk is the link or claim attached to the token: visiting it and approving a malicious message or transaction can create real access or transfers.
Solana addresses and token holdings are public. A sender can create or use the receiving token account and transfer an asset to your address without obtaining your signature. That does not cause the asset to execute code in your wallet.
Receipt alone does not:
- expose your recovery phrase or private key;
- connect your wallet to the sender's website;
- approve a delegate on unrelated token accounts;
- sign a message or transaction for you; or
- transfer SOL or existing tokens out of your wallet.
The token is better understood as a billboard. Its name, image, or metadata points to a fake claim page, support account, or urgent warning. The malicious site then asks you to connect and approve something.
Never visit a URL advertised by an unsolicited token or NFT, and never enter a recovery phrase into a website. A legitimate wallet support agent will not need your recovery phrase. If you already exposed it, create a new wallet with a fresh phrase and move trusted remaining assets.
What can happen after you interact with the token's website?
A normal connection shares your public address and lets the site request signatures; it does not expose the private key. The danger increases if you sign an unknown message, approve a transaction, or enter a wallet secret. A signed transaction can transfer assets or change token-account permissions in one atomic request.
Treat each event separately:
| Event | What it permits | Response |
|---|---|---|
| Token received | The asset appears at your public address | Ignore its links; identify it independently |
| Site connected | Site sees the public address and can request signatures | Disconnect it and reject prompts |
| Message signed | May authenticate you off-chain | Save the message and monitor the affected service |
| Transaction signed | May execute transfers or authority changes | Inspect the signature, revoke approvals, and consider migration |
| Recovery phrase entered | Attacker can sign as the wallet | Move trusted assets to a fresh phrase immediately |
A Solana transaction can contain multiple instructions. The absence of a visible SOL transfer does not prove it was harmless, and a delegate scan cannot prove that no other protocol-specific authority changed. Open the confirmed signature in an explorer and review the full effects.
Can an unsolicited token create an approval?
No. An account-level delegate is a separate field on a specific SPL Token or Token-2022 account. The owner authorizes an Approve instruction that names the delegate and allowance. A Revoke instruction clears the current delegate and remaining amount.
A malicious transaction can include an approval if you sign it, which is why the scam token's claim page is dangerous. After a suspicious interaction, disconnect the website and run the Revoke Approvals tool. These are separate actions: disconnecting does not erase an on-chain delegate.
The revoke scan covers revocable account-level delegates, not every authority. It cannot clear a Token-2022 PermanentDelegate stored on a mint, rotate an exposed key, reverse a confirmed transfer, or inspect every DeFi position. Read Disconnecting a dApp vs Revoking Token Approvals for the boundary.
Should you hide, burn, or leave a scam token alone?
If you can safely ignore the asset, doing nothing is valid. Hiding it removes the lure from the wallet interface but does not change anything on-chain. Burning permanently destroys the selected balance and can close an ordinary token account, releasing approximately 0.00204 SOL in rent; Sol Incinerator pays the user a flat 0.002 SOL per supported token-account close after its cleanup fee.
Compressed NFTs do not have individual token accounts and hold no rent, so burning a cNFT returns 0 SOL. That can still remove the visual lure.
Before burning, confirm that the asset is actually spam. An unfamiliar token could be an LP receipt, staking receipt, governance token, or another position you need. If you do not know what it is, do not burn it.
Use the full scam and spam token cleanup guide when the asset has been identified and you want it removed.
What if you already signed something?
Close the site, reject pending prompts, and disconnect it from the wallet's connected-app list. Review the wallet activity and confirmed explorer transaction. Scan for account-level token delegates and revoke only suspicious approvals after identifying them.
Move trusted assets to a fresh wallet if you exposed the recovery phrase or private key, suspect malware, or cannot confidently limit the effects of a signed transaction. Creating another account under an exposed recovery phrase is not enough; it must be a new wallet with a fresh phrase.
Preserve transaction signatures, suspected addresses, the exact site URL, screenshots, dates, messages, and amounts. Be wary of anyone offering paid recovery after the incident.
Sol Incinerator
Inspect unwanted Solana assets, close safe empty accounts, and remove identified scam tokens without following links embedded in their metadata.
Related Reading
Frequently Asked Questions
Can a scam token drain your wallet just by arriving?
No. An unsolicited Solana token can appear without your signature, but receipt alone does not reveal your private key, connect a website, or approve the sender as a delegate over your other assets. The usual danger starts when you follow its link and sign a malicious message or transaction.
What should you do with a random token in Phantom?
Do not open links in its name, image, or metadata. Verify the mint independently, leave it alone if you are unsure, or use a trusted cleanup tool after careful review. If you already visited its site or signed something, disconnect the app, inspect activity, and scan for token approvals.
Does hiding a scam token remove it from Solana?
No. Hiding is a local wallet display choice. The token and its account remain on-chain, and an ordinary token account can continue holding its refundable rent deposit. Burning is permanent and must be reviewed carefully; compressed NFTs have no individual token-account rent and return zero SOL when burned.
Can a token create a delegate approval without my signature?
Receiving a token does not automatically approve its sender as a delegate on your other token accounts. A delegate approval is a separate on-chain instruction authorized by the token-account owner. However, a malicious transaction you sign can include several instructions, so inspect any suspicious confirmed signature rather than relying only on a delegate scan.