An unexpected token or collectible in Phantom is not free money and is not proof that the wallet has been hacked. In many scams, the asset is only bait: its name, image or description pushes the recipient toward a fake claim page, a malicious swap or an impersonated support account. The dangerous step is usually the interaction that follows. This guide explains how to classify unsolicited assets, avoid wallet-drainer requests, clean up the interface without turning spam into a transaction and respond proportionately if something has already been signed.

Last reviewed: October 15, 2026. Phantom controls, supported networks, spam detection, transaction previews and NFT-burning availability can change. Confirm current behavior in the verified Phantom app and official documentation. This independent guide is educational, is not affiliated with Phantom and is not financial, legal or security incident-response advice.

Quick answer: do not click links embedded in an unexpected token or NFT, do not visit a claim site from its description, and do not try to sell, swap or send the asset merely to remove it. Hide or report it using Phantom’s current controls. If you connected to a suspicious site, disconnect it and review approvals; if you signed an unknown transaction, inspect the address on the relevant explorer and move remaining assets when risk is credible. If a recovery phrase or private key was disclosed, treat that wallet as permanently compromised and migrate to a newly created wallet with new recovery material.

What this guide covers

  1. Why unsolicited tokens and collectibles appear in a public wallet.
  2. The difference between receiving spam and authorizing a harmful action.
  3. How fake airdrops, NFT offers, mint pages and support accounts create urgency.
  4. Why an asset name, image, verified-looking logo or price is not proof.
  5. How to inspect a contract or mint address without following attacker-controlled links.
  6. When to hide, report or burn an unwanted asset—and when to do nothing.
  7. Why trying to sell, swap, send or “unlock” spam can increase risk.
  8. What transaction previews and simulations can reveal, and what they cannot guarantee.
  9. How to respond after opening a link, connecting, signing, approving or exposing a recovery phrase.
  10. How account separation and small-purpose wallets reduce the impact of future mistakes.

Receiving an unknown asset is not the same as being compromised

Public blockchain addresses can receive assets without the owner’s permission. An attacker can distribute low-value tokens or collectibles to thousands of addresses because the transfer itself creates advertising inside wallet interfaces and explorers. Seeing one in Phantom does not mean the sender knows the private key, recovery phrase or app password.

The risk changes when the recipient acts. Opening a website, connecting a wallet, signing a message, approving token access or confirming a transaction can expose information or authority. Keep these events separate during diagnosis: receipt is an inbound blockchain event; connection reveals an address to an app; signature proves control or authorizes data; and a transaction can change onchain state.

The safest default for an unexpected token or NFT

  1. Do not use a URL, QR code, phone number or social handle shown by the asset.
  2. Do not search the asset name and click the first advertisement.
  3. Do not attempt to sell, swap, transfer or claim it as an experiment.
  4. Record the network and contract or mint address only if investigation is necessary.
  5. Use Phantom’s built-in hide or report control when available; otherwise leave the asset untouched.
  6. Verify any real campaign from a separately navigated official domain and official announcements.

Ignoring spam may feel incomplete because the item remains onchain. That is normal. Hiding changes the wallet display, not blockchain history. The objective is to avoid granting the sender another opportunity to influence a decision.

How the fake-airdrop funnel works

A typical campaign begins with an unsolicited asset carrying a reward amount, deadline or “official” brand. The description points to a claim page. The page asks the visitor to connect Phantom and then presents a signature or transaction as verification. The visible story is a reward; the actual request may transfer assets, grant token authority or route through unfamiliar programs and contracts.

Other funnels begin in social media, direct messages, search advertisements or fake support chats. The destination may copy the colors and layout of a legitimate project. Attackers benefit when the user treats visual familiarity as identity. A domain, contract address and transaction effect are stronger evidence than a logo.

Common bait patterns

Bait Pressure tactic Safer response
Unexpected airdrop “Claim before expiry” Verify the campaign independently; do not use the token’s link
Free NFT or mint pass Artificial scarcity Check the collection through known official channels and the exact mint address
Account or wallet warning Threat of suspension Open Phantom through the installed app, never through the warning
Refund or reimbursement Promise to recover losses Assume unsolicited recovery offers are hostile
Support message Urgency and authority Contact support from Phantom’s official Help Center
Token showing a large value Fear of missing profit Verify liquidity and contract identity; displayed value may be meaningless

Why a displayed price can be misleading

A token can have a familiar ticker, a copied icon and an apparent market value while being unrelated to the legitimate asset. Wallet interfaces obtain metadata and prices from external systems; attackers can exploit naming collisions or create markets with little usable liquidity. A quoted value does not guarantee that a holder can sell the position at that price.

Some tokens are designed as honeypots: buying or receiving may be possible while selling is restricted, taxed heavily or dependent on malicious approval flows. Do not “test” an unknown asset using a wallet that holds valuable tokens. Confirm the network and exact contract address through the project’s independently verified channels.

A ticker and logo do not identify a token

Names and symbols are not unique on public networks. Two assets can both display the same ticker while using different contracts. The meaningful identifier is the contract or mint address on the correct network. Even then, identity does not establish that the project is safe, liquid or suitable; it only helps determine which asset is being examined.

Copy an address only from a trusted interface, then compare the complete value—not a shortened prefix and suffix. Search results, screenshots and direct messages can all point to substituted contracts. If no independent reason exists to investigate an unsolicited asset, leaving it alone is safer than performing detective work through its promotional material.

Fake collectibles and copied collections

A copied NFT may reproduce artwork, collection names and descriptions from a legitimate project. The counterfeit can link to a fake marketplace, claim page or “verification” form. Ownership of copied artwork does not create membership in the genuine collection, and a familiar image does not establish provenance.

Check the chain, collection identifier and mint address through a reputable marketplace or the project’s established official channel. Be cautious when metadata itself supplies the only evidence. Attackers control the metadata of their own counterfeit assets and can make it say almost anything.

Never trust links embedded in NFT metadata

Phantom’s official help guidance warns that links in NFT names and descriptions can lead to malicious sites. Metadata is supplied by the asset creator; it is not an endorsement by Phantom. A link rendered inside a wallet can still be attacker-controlled.

If a legitimate project announces a claim, navigate from a bookmark or manually verified official domain. Compare announcements across more than one established channel. Do not let the collectible choose the website at which the wallet will sign.

Fake Phantom support is part of the attack

Scammers monitor public posts for people reporting missing funds, failed transactions or strange NFTs. They reply as “support,” offer a recovery form and request a recovery phrase, private key, QR code or remote-screen session. Legitimate support does not need secret recovery material to inspect a public transaction.

Use the Help & Support route in the verified Phantom app or navigate directly to Phantom’s official Help Center. Never install remote-control software, paste diagnostic commands from a stranger or move assets to a “secure” address supplied by support. A wallet address chosen by someone else is controlled by someone else.

Search advertisements and cloned apps

A sponsored result can appear above the real website. A cloned extension or mobile app may copy Phantom’s branding and then ask for an existing recovery phrase. Start from phantom.com, verify the browser-store publisher and examine the full domain before installation or connection. Bookmarks reduce repeated exposure to search results.

An update prompt delivered through an NFT, token, pop-up or message is not a trustworthy update channel. Use the extension store, official app store or documented in-app process. Do not sideload wallet software merely to claim an asset.

Connection, signature, approval and transaction are different

Action What it can do Response if suspicious
Open a webpage Expose IP, browser data and referral information Close it; inspect downloads and browser permissions
Connect Phantom Reveal the selected public address and enable requests Disconnect the app and clear its site permissions
Sign a message Prove address control; sometimes authorize offchain login or intent End the session and assess exactly what was signed
Approve token authority Permit a contract or delegate to act within defined limits Review and revoke applicable approvals
Sign a transaction Change onchain state, transfer assets or alter permissions Inspect the confirmed transaction and protect remaining assets
Reveal recovery phrase/private key Give permanent wallet control Create a new wallet and migrate; revocation cannot fix exposed keys

Read every request as an instruction, not a button label

A webpage can label a button “Verify,” “Claim” or “Connect,” while the wallet request performs something different. The wallet confirmation is the meaningful instruction. Check the active account, network, requesting domain, assets leaving, assets arriving, spending authority, destination and fees.

Cancel when the request is unclear, contains an unexpected asset transfer, requests broad authority or differs from the task you intended. A legitimate opportunity can survive a pause for verification. An irreversible transaction cannot be made safe by the webpage’s reassuring text.

Transaction previews and simulations help, but are not guarantees

Phantom may preview balance changes or simulate supported transactions. A warning, failed simulation or unexplained outflow is a reason to reject. An apparently normal preview is not a guarantee: simulations can be incomplete, contract behavior may depend on changing state and sophisticated attacks may obscure intent.

Use the preview as one control in a chain that also includes a verified domain, known contract, appropriate account and sensible transaction purpose. Never override a warning merely because a chat account says it is a false positive.

Hide, report, burn or leave untouched?

Option What it means Key caution
Hide Removes clutter from the wallet view Does not erase the onchain asset or punish the sender
Report Sends a spam signal through available Phantom controls Use the in-app action, not a link supplied by the asset
Burn Executes an onchain destruction action where supported It is a transaction and may not exist for that network or asset type
Do nothing Leaves the asset onchain without interaction Often the safest choice when controls or identity are uncertain

Phantom’s published guidance describes burning for supported Solana NFTs, while burning EVM NFTs is not supported in the same way. Availability and eligibility can change, and some verified collections may be protected from burning. Confirm the current in-app option and official documentation before acting.

Why sending spam away is not necessarily cleanup

Transferring an unknown token creates another signed transaction and can expose the wallet to token-specific behavior, fees or deceptive follow-up prompts. Sending it to a random burn address is not equivalent to using a supported burn function. On some networks, transfer restrictions or taxes can make the attempt fail or behave unexpectedly.

Cleanup should minimize interaction. A clean-looking interface is less important than preserving control of legitimate assets. Use hide/report where supported; otherwise tolerate the unwanted entry.

Why swapping an unknown token is dangerous

A swap may require approval, route through an attacker-selected contract or fail because the apparent market has no accessible liquidity. Scam pages sometimes manufacture an “unlock” or “verification fee” after the first attempt. Each additional step creates another chance to sign harmful authority.

If a token appears valuable, independently confirm the contract, market, liquidity and official documentation. Do not rely on a price shown only in the wallet or a link embedded in the token. A safe decision can be to accept that an unsolicited balance has no realizable value.

Scenario 1: an unknown asset appeared, but nothing was clicked

This is the lowest-risk scenario. Do not interact with the asset. Use Phantom’s current hide/report control if available, or leave it untouched. No wallet migration is normally required merely because a public address received spam.

Check recent activity only if there are other signs of compromise, such as outgoing transactions you did not authorize, changed account settings or unfamiliar extensions. Avoid turning routine spam into an emergency that leads to rushed transfers.

Scenario 2: the link was opened, but Phantom was not connected

Close the page. Check whether the browser downloaded a file, installed an extension, requested notification permission or opened a login prompt. Remove permissions granted to the site and scan the browser profile for unfamiliar extensions. Opening a page does not by itself reveal a recovery phrase or authorize a blockchain transfer, but web tracking and malware remain possible.

Do not return to the page to “disconnect.” If no wallet connection or signature occurred, there may be no onchain permission to revoke. Change unrelated passwords only when credentials were entered or the device shows broader compromise.

Scenario 3: Phantom was connected, but nothing was signed

Disconnect the site in Phantom’s Connected Apps controls and remove the site’s browser permissions. Connection normally reveals the selected public address and lets the site send requests; it does not give away the private key. Expect possible follow-up targeting because the address is now associated with that visitor.

Review the wallet activity and token approvals as a precaution, but do not sign a “disconnect transaction” offered by the suspicious site. Disconnection should be initiated from the trusted wallet interface.

Scenario 4: a message was signed

A signature can be used for login, proof of ownership or application-specific authorization. Its impact depends on the exact content and protocol. Save the domain, timestamp, address and displayed message. Disconnect the site and consult official support or a qualified responder when the meaning cannot be established.

Do not assume every message signature transfers assets, but do not assume every signature is harmless. If the request resembled an authentication challenge, end active sessions with the affected service and review its security controls.

Scenario 5: an approval or transaction was confirmed

Locate the transaction through Phantom activity or a reputable explorer for the correct network. Compare the sending address, destination, token movements and authority changes. Revoke applicable token approvals using trusted tools documented for that network. Disconnect the site after onchain permissions are addressed; the two controls solve different problems.

If an unexplained transfer occurred or valuable assets remain exposed, prepare a new wallet on a clean device or browser profile and move assets carefully. Prioritize assets that can be transferred safely, account for network fees and avoid signing through the suspicious page. An attacker may monitor the address, so seek specialist help when timing or delegated authority is uncertain.

Scenario 6: the recovery phrase or private key was entered

Treat the wallet source as permanently compromised. Changing the Phantom app password, reinstalling the extension, disconnecting a dApp or revoking approvals cannot make an exposed recovery phrase secret again. Create a completely new wallet with new recovery material using verified software and a clean environment.

Move remaining assets to addresses derived from the new wallet, verify each destination on screen and transfer a small test amount where practical. Do not import the exposed phrase into the new wallet as an additional account. Preserve transaction evidence, but never include the phrase in screenshots, tickets or messages.

A proportionate incident-response checklist

  1. Stop interacting and preserve the suspicious URL and transaction identifiers.
  2. Identify the exact account and network involved.
  3. Separate what happened: viewed, connected, signed, approved, transacted or disclosed keys.
  4. Disconnect suspicious apps from the trusted Phantom interface.
  5. Review and revoke relevant onchain approvals where applicable.
  6. Inspect outgoing transactions on the correct explorer.
  7. Secure email, device and browser accounts if credentials or malware may be involved.
  8. Create a new wallet only when the risk justifies migration; use new recovery material.
  9. Report the site or asset through official channels without sharing secrets.
  10. Document losses and seek local professional or law-enforcement guidance when appropriate.

Revoking approvals is not the same as rotating keys

An approval grants defined authority to a contract or delegate. Revoking it can remove that authority. A recovery phrase or private key is the root secret that controls the wallet; once copied by an attacker, it cannot be “unshared.” This distinction determines whether approval review is sufficient or complete migration is required.

Also distinguish a dApp connection from an onchain approval. Disconnecting removes the application’s active wallet connection but may leave blockchain permissions intact. Revoking an approval changes onchain authority but may leave the site listed as connected. Review both layers.

Use account separation to reduce the blast radius

Keep long-term holdings away from experimental mints, airdrop claims and unfamiliar dApps. A purpose-limited account with only the amount needed for one task reduces potential loss and makes transaction previews easier to interpret. It does not make a malicious signature safe, but it limits what that account can expose.

For stronger isolation, use a separate wallet source or hardware signer for long-term assets and a separate browser profile for active dApps. Document recovery procedures before funding either environment. Separation that cannot be recovered safely creates a different risk.

A safer workflow for a legitimate airdrop

  1. Begin from the project’s known official website or established announcement channel.
  2. Confirm the exact domain, network, eligibility method and contract address.
  3. Use a purpose-limited account rather than a vault account.
  4. Read the wallet request and expected asset changes before signing.
  5. Reject unexpected approvals, transfers, network changes or additional fees.
  6. After completion, disconnect the app and review any permissions created.
  7. Record the transaction for tax, accounting and later security review.

A legitimate campaign can still carry market, smart-contract and tax risk. Verification reduces impersonation risk; it does not guarantee the token’s value or code quality.

Red flags that justify an immediate stop

  • a recovery phrase, private key, QR export or cloud-backup credential is requested;
  • “support” contacts you first or asks to move funds to a protected wallet;
  • the domain uses misspelling, extra words, unusual subdomains or a shortened link;
  • the site says a transaction is required to connect, synchronize or validate the wallet;
  • the wallet preview shows an unexplained transfer, approval or destination;
  • the page insists that a warning must be ignored or time will expire;
  • the only proof of legitimacy is the NFT description, token logo or search advertisement;
  • a small initial payment is followed by new release, tax or verification fees.

What not to do after a scam

Do not pay a recovery service that promises guaranteed reversal. Confirmed blockchain transfers are usually irreversible, and victims are often targeted again. Do not share seed words with Phantom, an investigator, a marketplace or law enforcement. Public addresses and transaction hashes are usually sufficient for initial investigation.

Do not delete evidence before recording it, and do not continue testing the malicious site from the affected wallet. Avoid broadcasting sensitive details about remaining balances or the migration schedule. Urgency should lead to a controlled checklist, not improvised signatures.

Frequently asked questions

Can a scam token drain Phantom just by appearing?

No. An unsolicited inbound asset does not by itself reveal private keys or authorize outgoing transfers. Risk usually begins when the recipient follows its instructions, connects, signs, approves or transacts.

Should I send an unknown token to a burn address?

Not as a default. Sending is another transaction and may interact with unknown token behavior. Use Phantom’s supported hide/report controls, or leave the asset untouched. Use a documented in-app burn feature only where Phantom supports it and the asset is eligible.

Does hiding a token remove it from the blockchain?

No. Hiding changes the local or provider-managed display. The asset and inbound transaction remain part of the public blockchain record.

Is disconnecting a suspicious dApp enough?

It is enough only when connection was the sole event and no other compromise occurred. If an approval or transaction was signed, inspect and revoke relevant authority. If the recovery phrase or private key was exposed, migrate to a new wallet.

Can Phantom reverse a malicious transaction?

Phantom cannot unilaterally reverse a confirmed decentralized blockchain transaction. Support can provide product guidance and accept reports, but it cannot recreate secrecy for exposed keys or guarantee asset recovery.

Is a verified collection always safe?

Verification can help establish collection identity, but it is not a promise of future value or freedom from every risk. Confirm what the badge means on the platform displaying it and still review each requested transaction.

Final checklist

  • Treat unsolicited assets as untrusted messages, not rewards.
  • Never navigate from a link embedded in token or NFT metadata.
  • Verify network and full contract or mint address independently.
  • Do not sell, swap or send spam merely to remove it.
  • Use hide/report controls from the verified Phantom interface.
  • Read every signature and transaction request before approval.
  • Separate vault holdings from experimental dApp activity.
  • Disconnect suspicious apps and separately review onchain approvals.
  • Move to a new wallet when recovery material has been exposed.
  • Never give recovery words or private keys to support or a recovery service.

Official Phantom references

The following first-party resources explain Phantom’s current warnings and controls. They are documentation links, not links supplied by an unsolicited token or collectible:

Visit Phantom ↗Official website