Security and scams · How-to
8 Ways to Check Whether a Token Is a Scam
No single scanner can prove a token is safe. Use these eight checks to verify what you are buying, look for signs you may not be able to sell, and avoid exposing your wallet.
By the SkyBitcoins editorial team · Updated

1. Does the contract address match the real project?
Start with the contract address, not the token’s name, logo or ticker. Anyone can copy those details, so a search for a familiar name may lead you to a counterfeit token. Find the address through a project channel you reached independently, then compare every character with the address shown in your wallet or on the relevant blockchain explorer.
Check that you are looking at the right network, too. Tokens on different networks can share a name but have different contracts. Don’t rely on a search ad, unsolicited message, influencer post or direct message as your only source for an address.
Before you proceed:
- Confirm the network and full contract address.
- Cross-check the address in more than one independently reached official channel.
- Search the address itself for warnings, impersonation reports or signs of a copycat.
- Treat a mismatch as a stop signal, even if the logo and ticker look right.
If the project has not published a contract address, or its channels disagree, don’t guess. You can wait until the project clarifies it. A wrong address can lead you to a worthless imitation, and blockchain transactions generally cannot be reversed.
2. Can you verify the project and its claims?
Look for a project that clearly explains what its token does, who is responsible for it, and how the token fits into the product. Read the documentation rather than relying on a slogan or a promise of returns. Check whether the claims are specific and internally consistent: a roadmap should describe planned work, not guarantee a price or a listing.
Search for the team’s identities and history using information you can verify outside the project’s own channels. Anonymous creators are not automatically scammers, but anonymity can make it harder to hold anyone accountable. Be cautious if team biographies appear copied, partnerships cannot be confirmed by the named partner, or the project’s social accounts have recently changed names or deleted substantial history.
Watch for pressure tactics. “Guaranteed” gains, secret presales, countdowns, and demands to act immediately are reasons to pause. A legitimate-looking website can be copied, and a professional presentation does not prove the project is trustworthy.
Ask yourself:
- Can I explain the token’s purpose in a sentence?
- Do the project’s claims match its working product and documentation?
- Can I independently verify key team or partner claims?
If the answers are vague, conflicting or impossible to check, don’t treat confidence or popularity as evidence.
3. Is the supply concentrated or controlled by insiders?
Token distribution can reveal risks that a polished website won’t. Check the holder list and token supply on a blockchain explorer. Look for a small number of wallets holding a large share, especially if those wallets appear connected or can sell without restriction. Concentration does not prove fraud, but it means a few holders may be able to move the market sharply.
Read the token allocation and release schedule if the project publishes them. Ask when team, investor or treasury tokens can be sold, whether allocations are locked, and how those claims can be verified on-chain. A lockup claim is weaker if the project does not identify the relevant wallets or lock contract. Also check whether the supply can increase through minting, and who has permission to do so.
Consider these warning signs:
- Major allocations are unexplained or hidden behind vague labels.
- Many top wallets appear to be controlled by one party.
- The circulating supply is unclear or differs across project channels.
- Large unlocks or new token issuance are not disclosed.
Holder data is only a snapshot. Wallets can be split, and addresses may belong to exchanges or contracts. Use it to form questions, not as definitive proof of who controls each token.
4. What can the contract owner change?
Open the contract page on a blockchain explorer and see whether the source code is verified. Verification lets you compare published source code with the code deployed on-chain; it does not mean an independent auditor approved the contract or that the token is safe. If the code is not verified, it is harder for you and outside reviewers to inspect what the contract can do.
Look for powerful permissions. Depending on the contract, an owner or administrator may be able to mint tokens, pause transfers, blacklist addresses, change trading fees, or alter other rules. Some controls can be legitimate, but you should understand who holds them, whether they can be revoked, and what safeguards apply. If the project claims ownership was renounced, check that claim on-chain rather than accepting a post or screenshot.
An audit can help identify issues, but check who performed it, which exact contract and version it covered, and whether findings were fixed. An audit is not insurance and does not guarantee future safety.
If you cannot interpret the code, don’t pretend a green badge or verified label is a clean bill of health. Look for clear explanations from credible technical reviewers, and skip the token if important permissions remain unclear or unusually broad.
5. Can ordinary holders actually sell the token?
A token may let you buy but prevent or heavily restrict selling. This can happen through contract rules, extreme transaction fees, address blacklists, or other transfer controls. Before committing meaningful funds, check whether the token has a sell fee, maximum transaction size, trading cooldown, or restrictions that apply to ordinary holders.
Use a reputable contract-analysis or honeypot-checking tool as a screening step, not a verdict. These tools can miss threats, misread complex contracts, or become outdated when a contract has upgradeable controls. Don’t connect a wallet or sign a transaction just because a scanner asks you to; basic analysis should not require handing a site permission to spend your tokens.
If you still decide to test, use only a very small amount you can afford to lose. Check the estimated output and fees before buying, then inspect the sell transaction carefully. A test costs gas and may incur swap fees or slippage, and even a successful sale now cannot promise that you can sell later.
Stop if the sell simulation fails, the fee is unexpectedly high, or the tool and contract details raise unanswered questions. Never increase your position just to “test” a suspicious token further.
6. Is there enough trustworthy liquidity to exit?
Check whether the token has meaningful liquidity on the exchange or trading pool where you would buy it. Liquidity is what allows trades to complete without a large price impact. A displayed market price can be misleading if the pool is thin: your purchase may move the price up, and a sale may return far less than expected.
Look at the pool’s size, age, trading activity and the assets paired with the token. Compare the amount available with the size of the trade you are considering, and check the price impact shown before confirming a swap. A sudden jump in volume or price is not proof of genuine demand; it can come from a small pool or coordinated activity.
Check whether liquidity is locked or otherwise constrained, and whether that claim can be verified. “Locked” does not guarantee the token is safe: lock terms expire, other pools may remain exposed, and contract permissions can still create risks. If the project does not explain who controls liquidity or when a lock ends, treat that as an unanswered risk.
Avoid chasing sharp rises. Thin liquidity can make it difficult to exit at a fair price, even when a token is not technically a honeypot. If you cannot understand the pool and its risks, don’t trade it.
7. Do trading activity and community claims look genuine?
Look beyond the headline price and ask who is trading. A handful of wallets repeatedly buying and selling among themselves can make activity appear stronger than it is. On-chain explorers and market tools can show transfers, wallet concentration and trading history, but wallet identities are often unknown and automated activity can be hard to interpret.
Be wary of sudden price surges promoted by accounts promising a fast listing or “guaranteed” returns. Check whether trading volume is spread across time and participants, and whether the token’s price depends on a single pool or a few large wallets. A token trending on social media can still be manipulated, and large follower counts can be bought or inflated.
Read community channels critically. Look for substantive questions about contract permissions, liquidity, supply and selling. If moderators delete reasonable questions, flood channels with referral links, or insist that every concern is “FUD,” that is a warning about the project’s transparency.
No single metric settles the question. Combine activity data with the earlier checks, and remember that public transaction records do not automatically reveal who controls each address. If the only case for buying is that other people are rushing in, step back rather than letting urgency replace due diligence.
8. How can you limit damage and avoid common mistakes?
Protect your wallet even if your checks look reassuring. A token can be risky without being a scam, and a legitimate project can be impersonated by malicious sites. Use a wallet with only the funds needed for a small test, and keep long-term holdings in a separate wallet that you do not connect to unfamiliar apps. Never share your recovery phrase or private key; no legitimate token check needs them.
Before signing any transaction, read what your wallet says it will do. A swap approval can authorize a contract to spend tokens; an unfamiliar signature may grant permissions you did not intend. Reject requests you don’t understand. After using a service, review and revoke unnecessary token approvals through a tool you trust, while checking the network and contract carefully.
Mistakes to avoid:
- Buying from a ticker or search result without checking the contract address.
- Treating an audit, scanner result, verified code or locked liquidity as proof of safety.
- Connecting your main wallet to an unsolicited claim or token-removal site.
- Sending more funds to recover money already lost.
If you suspect your wallet is compromised, stop signing transactions. If the recovery phrase may be exposed, create a new wallet securely and move remaining assets; revoking approvals alone cannot protect a compromised key.
Frequently asked questions
Can a token scanner prove a token is safe?
No. A scanner can flag known risks or suspicious contract behavior, but it cannot guarantee a token is safe. Treat the result as one input alongside your own checks of the contract, liquidity, holders and sellability.
What should I do if an unknown token appears in my wallet?
A token appearing in your wallet does not mean you should interact with it. Unsolicited tokens may be spam or part of a scam designed to lead you to a malicious site or transaction. Don’t visit links or approve spending just to remove or claim one.
Is a small test trade enough to check a token?
A tiny swap can help reveal whether selling is possible, but it is not a guarantee: a token’s rules or liquidity can change, and a test costs gas and may incur trading fees. If you test, use a small amount you can afford to lose and inspect the sell transaction before signing.
What if I already approved a suspicious token?
Revoke an approval you no longer need using a wallet or blockchain tool you trust, and avoid signing further transactions from the exposed wallet. If you suspect its recovery phrase or private key was compromised, move remaining assets to a new wallet created securely; revoking approvals alone will not fix a compromised key.
Does a verified contract mean a token is legitimate?
No. A token can have a real contract and still be risky, misleading or controlled in ways that harm holders. Contract verification is one useful check, not proof of honest intent or a sound investment.
Keep reading
Related guides
Security and scams · Explainer
How to Check a Velo Token Scam Claim
A report that Velo users feel betrayed does not, on its own, prove fraud. Before you buy, sell or pay anyone to recover funds, verify the exact project, token contract and on-chain activity—and secure your wallet if you suspect a problem.
DeFi · Review
dYdX’s DYDX Token: What It Does and What to Check
dYdX’s DYDX token first launched as a governance token in 2021; the dYdX Chain later made native DYDX its chain token. Here’s what that change means, how to participate and what to check before you commit funds.
Token · Explainer
SportX SX Token: What It Does and What to Check
SportX SX is described as the native ERC-20 token of the SportX protocol. Learn what it is intended to do, what to verify before handling it, and how to think about the risks in 2026.
Token · Explainer
What Is Illusion Crypto? How to Check the Token
“Illusion crypto” does not identify one verifiable token by name alone. Learn how to distinguish a specific Illusion-branded coin from the broader idea of crypto-market illusion, and what to check before you risk money.
Security and scams · Explainer
What Is a Crypto Private Key? How to Keep It Safe
A crypto private key is the secret that lets a wallet authorize transactions. Learn how it differs from your address and recovery phrase, who controls it, and how to protect it.
Security and scams · Explainer
How to Check a Binance Yield-Farm Drain Claim
A claim that a Binance yield farm was exploited and tokens were sent to a “000” address is not enough to identify a confirmed incident. First establish which product and chain are involved, then verify transactions and protect any wallet that interacted with it.
Security and scams · Explainer
How to Assess the DecentraWorld Rug Pull
DecentraWorld was reported to have suffered a rug pull in May 2022 after its founders drained a BNB treasury, with losses valued at more than $1 million. Here’s what the incident means, how to check your exposure and how to avoid recovery scams.
Security and scams · Explainer
Should You Trust BXH’s Rebound After the OKExChain Hack?
A price rebound after a reported hack does not prove that BXH is safe, that losses were recovered, or that the project has resumed normal operations. Before interacting with a BXH token associated with OKExChain, verify the incident, the exact contract and any recovery plan.