Is This the Intended Token—or Only a Contract Using the Same Name?

A token can be real in one narrow sense—it exists on-chain—while still being the wrong asset, an impersonation, worthless spam or unsafe to trade. Do not verify it by name, symbol or wallet logo. Verify the network and exact contract or mint address, then compare that identifier with an independent issuer source before approving, swapping or visiting any link attached to the token.

Use four verdicts, not real or fake

Classify the token as matched, mismatched, unconfirmed or unsolicited spam. Matched means the network and address agree with a primary issuer source. Mismatched means the name is familiar but the address or chain differs. Unconfirmed means evidence is incomplete. Spam means it arrived without a requested transaction and is trying to provoke interaction.

Do not touch the token while identifying it

Do not click a website embedded in the name, use a claim button, approve spending or test a swap from the main wallet. Merely receiving an unsolicited token does not usually grant it authority over other assets. The dangerous step is often the website or contract interaction that follows.

Build the Token Identity Packet

Record each field from independent sources.

• Network or chain where the balance exists
• Exact contract address or Solana mint address
• Token name, symbol and decimals shown by the explorer
• Issuer's official documentation or verified project domain
• Explorer source-code status, creator and creation transaction
• Transfer history, holders and liquidity route
• How the token arrived and whether the user expected it

Step one — prove the wallet address owns the balance

Open the correct block explorer by entering your public wallet address, not the token's promotional link. Find the token transfer and confirm the receiving account, network, amount and contract. A wallet interface can hide, rename or misprice assets; the explorer record establishes what the address actually received.

Step two — identify by contract, never ticker

Token names and symbols are not unique. Anyone can deploy another contract using a familiar ticker. Copy the complete contract or mint address from the explorer and compare every character. The network is part of the identity: an address on Ethereum does not identify a token on BNB Smart Chain, Base, Polygon, TRON or Solana.

Step three — find a primary issuer source

Use the project's official documentation, official website reached independently or an issuer-controlled repository. Do not begin with a search advertisement, Telegram reply or website written inside an unsolicited token. Confirm that the issuer publishes the same chain and exact address.

Step four — use a second independent record

Compare the address with the correct explorer and a reputable market or ecosystem record. Agreement between two pages that copied the same user-submitted metadata is not strong confirmation. The primary issuer address remains the anchor.

Verified source code means transparent code, not a safe asset

Etherscan explains that source verification matches published source code with deployed bytecode and allows public inspection. It does not certify the operator, business model, liquidity or future behavior. A malicious or worthless token can publish perfectly verified code.

Wallet verification labels are useful but limited

MetaMask states that a verified label means the token matches an address recognized by the ecosystem, while warnings can indicate impersonation, unusual behavior or spam. It also states that these signals are informational rather than an endorsement or guarantee of value.

Check mint and control properties on Solana

On Solana, verify the mint address rather than relying on the symbol. Review the explorer's verified status and token metadata. Where visible, examine mint and freeze authority because an authority can affect future supply or account restrictions. Absence of an obvious warning is not investment approval.

Separate authenticity from transferability

An authentic project token may have no active market, may be locked or may require a specific claim process. An impersonation can also show fabricated value from a thin pool. Check recent transfers and the intended trading venue, but do not prove sellability by signing an unknown transaction from a valuable wallet.

Check liquidity without treating it as legitimacy

A pool shows that a pair exists, not that a safe exit exists. Inspect the correct contract in the pool, recent trades, depth relative to the displayed wallet value and whether one address controls most liquidity or supply. A large displayed price multiplied by negligible liquidity is not a realizable balance.

Holder concentration changes the risk conclusion

Explorer holder pages can show whether the deployer or a few addresses control most of the supply. High concentration does not automatically prove fraud, but it means the displayed market value can be highly dependent on those holders. Record it as a risk, not as proof of authenticity.

Worked mismatch: familiar symbol, different address

A wallet shows a token named USDC on an EVM network. The user compares its contract with the address published by the issuer for that network and finds a mismatch. The explorer confirms that a contract exists and has transfers, but that only proves an on-chain token using the symbol. The correct verdict is mismatched, so the user hides it and does not swap.

Worked unconfirmed reward token

A faucet claims to send a new token and the balance appears under the expected network. The faucet provides no official contract documentation, the project domain is newly created and the only market is a tiny pool. The token is not proven fake, but authenticity and usable value remain unconfirmed. The user should not connect a main wallet or pay gas merely to investigate.

An unexpected token is not evidence that the wallet key leaked

Public addresses can receive transfers from anyone. If there are no unauthorized outgoing transactions or approvals, the arrival alone does not show key compromise. Hide or ignore the asset. Investigate account compromise only when the wallet signed something, granted authority or shows unknown outgoing activity.

If you already approved a suspicious contract

Disconnecting a site does not necessarily remove token allowances. Review approvals with a trusted wallet or explorer tool on the correct network and revoke suspicious spending authority where feasible. If the seed phrase or private key was entered into a site, move to a newly secured wallet rather than relying only on revocation.

When passive inspection is enough

Stop after recording a mismatch, an unknown issuer or an unsolicited spam pattern. You do not need to remove an on-chain token by sending it, burning it or visiting a claim page. Hiding it in the wallet interface changes display only and avoids unnecessary authority.

Final decision rule

Interact only when the chain and exact address match a primary issuer source, the explorer record is coherent, the intended transaction is understood and the token has a legitimate purpose for you. A clean identity check reduces obvious impersonation risk; it does not guarantee price, liquidity or contract safety.

Verification sources — July 30, 2026

Primary explorer, wallet and blockchain documentation was used for contract identity and warning semantics. No token scanner or wallet label is treated as a guarantee.

• Etherscan contract source verification: https://info.etherscan.com/how-to-verify-contracts/
• Solana token verification guide: https://solana.com/developers/guides/getstarted/how-to-verify-a-token
• MetaMask security-alert meanings: https://support.metamask.io/configure/wallet/security-alerts/
• MetaMask smart-contract interaction checks: https://support.metamask.io/stay-safe/protect-yourself/how-to-tell-if-a-smart-contract-is-safe-to-interact-with
• MetaMask token approval explanation: https://support.metamask.io/stay-safe/safety-in-web3/what-is-a-token-approval/
• MetaMask airdrop and impersonation safety: https://support.metamask.io/stay-safe/safety-in-web3/scammers-and-phishers-rugpulls-and-airdrop-scams

FAQ