SOLANA·HUB
DE
Security

How to Spot Fake Airdrops and Dusting Attacks on Solana

Unknown tokens or NFTs suddenly sitting in your Solana wallet? How to check unsolicited airdrops with Solscan and Solana Explorer, recognize dusting attacks and phishing bait — and respond safely: ignore, hide, burn. Never claim.

SOLANA·HUB ·

You open your Solana wallet and there sits a token you never bought — often with a tempting name like “5000 USDC Reward” and a website address right in the token name. That is not a mistake and not a gift. It is almost always a fake airdrop or a dusting attack — and you can recognize and defuse both yourself, without losing a cent.

Short answer: On Solana, anyone can send you tokens and NFTs unsolicited — the sender pays the account fee. Unknown assets in your wallet are therefore almost always spam with a motive: tracking dust or phishing bait meant to lure you to a “claim” site. Merely receiving them is harmless. Only interaction is dangerous: visiting the site, connecting your wallet, signing. The right response: ignore, hide, or burn — never claim.

In plain terms: An unknown token in your wallet is like a junk-mail letter with a fake prize notification in your mailbox. Its presence does not hurt you. You only get fleeced when you go “collect your prize.”

What Are Fake Airdrops and Dusting Attacks?

A genuine airdrop is a planned token distribution by a project to defined recipients. A fake airdrop imitates exactly that: a sender mass-distributes worthless tokens or NFTs designed to look legitimate or valuable — often with a URL in the name or metadata pointing to a supposed claim or reward page.

A dusting attack is the quieter variant: tiny amounts (“dust”) sent to a very large number of addresses. The classic motivation is surveillance — anyone who later moves the dust along with other funds reveals links between addresses and makes de-anonymization easier. On Solana, the two patterns blur together: because transactions cost almost nothing, dust is usually sent straight away as phishing bait with a link. Mass distributions to thousands of addresses are also a known pattern around Sybil attacks and manufactured activity.

Why Do Tokens and NFTs Land in Your Wallet Uninvited?

The technical reason is a Solana peculiarity: tokens do not live “in” your wallet but in separate token accounts that belong to your address. Anyone can create such an account for you — the sender pays the small SOL rent deposit for it themselves. Your consent is not required, your seed phrase is not involved, and the sender gains no access whatsoever to your wallet.

That is exactly why: receiving alone is not a security problem. A token sent to you cannot pull anything out of your wallet. It can only do one thing: tempt you into an action.

Three motives sit behind unsolicited assets, often combined:

  1. Tracking (classic dusting): The dust serves as a marker. If you move it together with other holdings, your addresses can be linked and your activity profiled more easily.
  2. Phishing via token name and metadata: The token is called something like “Claim 2 SOL @ example-scam-site” or the NFT image shows a QR code. The goal is to get you to visit the page. A fake claim interface is waiting there.
  3. Drainer bait: On the claim page, you are asked to connect your wallet and sign a transaction — one that in reality sweeps funds or grants approvals. The airdrop is only the bait; the mechanics behind it are covered in detecting wallet drainers.

Important context: these patterns describe the general method of how such campaigns work — not every unknown token is automatically part of an attack. Legitimate unsolicited distributions exist too. The difference shows up when you check.

Checking Suspicious Airdrops Step by Step — with Solscan and Solana Explorer

Everything below works without connecting your wallet — read-only, in the browser:

  1. Copy the token address (mint), not the name. In your wallet, you find the mint address in the token details. Names and logos are freely chosen and deliberately faked by scammers.
  2. Open the mint in Solscan or Solana Explorer. How to find your way around there: using Solscan.
  3. Look at the holder distribution: if the same token was distributed to thousands of addresses in identical tiny amounts within a short time, that is the typical spam-airdrop pattern.
  4. Check metadata and name: URLs, “claim” prompts, deadlines (“expires in 24h”), or QR codes in the token name, symbol, or NFT image are a near-certain scam signal. Legitimate projects do not distribute entitlements via token names.
  5. Inspect the sender transaction: open the transaction that delivered the token to you. A freshly created sender firing identical transfers at unrelated addresses by the minute is a distribution bot, not a project.
  6. Cross-check with official channels: if the token claims to come from a known project, check that project’s official website or documentation for an announced airdrop — and compare the mint address stated there. If it does not match, it is a counterfeit.

For a deeper check of individual tokens — mint authority, distribution, market data — follow the guide check a wallet or token for scams.

Responding Correctly: Ignore, Hide, Burn — Never Claim

The safe responses, in order:

  • Ignore. The simplest and entirely sufficient option. The token can sit there; it cannot do anything.
  • Hide. Wallets let you mark spam tokens as such and remove them from view. That is a local setting — no transaction, no risk.
  • Burn. Wallets like Phantom offer a built-in burn feature: the token is destroyed, the token account is closed, and the account’s small SOL rent deposit is credited back to you. That is a standard transaction signed by you in your own wallet — no contact with the scam site.

And the do-not list: never visit the website advertised in the token. Never connect your wallet there. Never sign a transaction or message from a claim page. Never enter your seed phrase — no legitimate application asks for it. “Selling” the spam token through unknown sites is not an option either; if you want it gone, the wallet burn is the clean way.

If you have already interacted and signed something, speed matters: wallet hacked — what to do describes the steps, and trace fund flow shows how to reconstruct where funds went.

Hiding Spam Tokens in Phantom, Solflare & Co.

  • Phantom automatically filters known spam tokens into a hidden section, shows warnings on detected spam NFTs, and offers per-token options to “report as spam,” “hide,” and “burn” (with the rent refund).
  • Solflare allows hiding individual tokens and NFTs via the asset detail view and flags suspicious assets.
  • In general, for any wallet: hiding is cosmetic and risk-free; burning is a normal transaction signed by you. Neither requires visiting any external site.

Beyond that, the best defense remains clean wallet hygiene — separate wallets for experiments, hardware signing for holdings, healthy skepticism at every signature: Solana wallet security.

Important Context

This article explains the method on general patterns — it does not label any specific, real token, project, or person as a scammer. Not every unsolicited token is an attack, but every one deserves the same sober check. Verify for yourself, judge for yourself.

Note: This is reporting, not investment advice.

Sources and Further Reading

#airdrop #dusting-attack #scam-detection #phishing #wallet-security #security

Related Articles