Install Chain Insights
← All stories

Safety Academy · Story 01 · Fake tokens

Free tokens. Expensive gift.

A surprise reward. A suspicious permission.
Two people dreaming of the same holiday.

Estimated 4 min read

THE $2,000 SURPRISE6 scenes

Penny has been selected. Apparently.

Penny is checking a payment. In her wallet, she taps “View on explorer” to open the public transaction record. Her address’s token-transfer list contains something extra: 2,000 BONUS.

Penny
“Two thousand? Please tell me that is holiday money.”
Illustration: Penny has been selected. Apparently.

Anyone can send a token to a public address. A transfer record proves neither its value nor the sender’s trustworthiness.

Someone else has booked the window seat.

From the token’s details, Penny opens its listed website. It promises “Redeem 2,000 BONUS for $2,000”. The scammer is already packing.

The Scammer
“Complimentary tokens. Non-complimentary consequences.”
Illustration: Someone else has booked the window seat.

A listed website is not an endorsement. The $2,000 is the promoter’s promise, not a verified price. Receiving tokens alone gives no spending permission.

The gift wants her real money.

She connects her wallet and taps Claim. Her wallet opens a separate approval request for USDC. Penny stops: that is not the token she came to collect.

Penny
“Why does my BONUS need access to my USDC?”
Illustration: The gift wants her real money.

This request is about real USDC, not the mystery BONUS. Approval would let that spender move USDC up to the allowance.

“You are the all-inclusive package.”

Captain Obvious reads the wallet request with Penny. The website promised to send her a reward. The wallet asks to let someone spend her USDC.

Captain Obvious
“The free gift is your money. You are giving it to him.”
Illustration: “You are the all-inclusive package.”

Check the asset, spender and limit. The website’s promise does not change what the permission allows.

Penny declines the generous offer.

She taps Reject in her wallet, closes the claim website and ignores the mystery tokens. No approval. No fee to “unlock” the reward.

Penny
“I prefer holidays where I am the one going.”
Illustration: Penny declines the generous offer.

Closing a website does not revoke earlier permissions. Here, Penny never granted one.

One holiday has been cancelled.

Penny keeps her 600 USDC. The scammer discovers that unpacking is much less glamorous than packing.

The Scammer
“Fine. I hear the kitchen is lovely this time of year.”
Illustration: One holiday has been cancelled.

An unexpected token is not a reason to approve spending. Read the permission before you sign.

The useful bit

A gift should not need your spending permission.

  1. Ignore surprise airdrops and claim links. Find the project yourself, never through the link.
  2. Before you approve anything, read what it may spend and how much. If you do not understand it, say no.
  3. A gift never needs permission to spend your other tokens. Connecting your wallet is not permission.

I already did this

If you approved spending, use MetaMask’s guide to revoke that allowance and check confirmation. Revocation cannot recover funds already taken. If you also shared recovery words, follow the compromised-wallet guide; revoking does not restore secrecy.

Sources & further reading