Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
Receipt is not consent
A public address can receive an unsolicited token or NFT without the owner authorising it. Receipt alone does not prove a private key leak. First check for unauthorised spending, approvals or permission changes.
Anyone can send to a public address and use that surprise to create urgency. Do not migrate every asset according to an unsolicited message. Independently check real spending and permissions first so the supposed protective action is not itself a malicious transaction.
An unsolicited token or NFT can appear at a public address without the owner's consent; receipt alone does not prove a private key has been compromised.
Treat metadata as untrusted
Names, images and descriptions can link to fake support or claim pages. Verify the domain through a trusted source before opening it. Hiding spam in a wallet is generally safer than signing a contract merely to remove its visual appearance.
Names and images can be issuer-controlled. Wallet display is not wallet-provider endorsement. A prize or refund label does not establish an obligation; opening an embedded site can still expose device and account information.
Token names, images and metadata can contain deceptive links, fake support instructions or a claim that an unexpected balance must be activated.
Never approve a cleanup transaction
An unknown asset's transfer or approval may invoke malicious logic. Reject signatures you cannot explain and never enter a recovery phrase to activate an unexpected balance. Display hiding does not change the chain record.
If an item cannot be hidden safely, stop engaging with its promotion rather than forcing a sale. Transferring it may require contract interaction and a network fee. A recipient is not obliged to actively dispose of every unwanted token.
Use wallet display-hiding features where available and avoid signing approvals or visiting embedded claim sites merely to remove an item from view.
Look for evidence of actual loss
If an unauthorised transfer appears, preserve block, transaction and time details and use verified provider channels. A surprising receipt without spending evidence is not proof of theft, and recovery-service promises can create a second compromise.
For actual outgoing assets, distinguish prior approvals, legitimate provider activity and device compromise. Public addresses help inspect transactions, but recovery secrets do not belong with helpers. A threatening email alone does not prove possession of the private key.
Investigate separate evidence of unauthorised spending or account changes, preserve transaction identifiers and report impersonation through verified channels.
Use a household response routine
Agree on a simple see, hide, verify and report workflow. Use a separate browser profile and read-only inspection where possible. Keep evidence without circulating clickable scam links; key and signature controls matter more than a tidy asset list.
A household checklist should name the reviewer, read-only tool and escalation point. Keep the original domain and message for a report. Do not forward clickable scam links to relatives asking them to test the claim, which expands exposure.
A useful distinction is between hiding an item locally and asking a contract to change its state. The first is a presentation action; the second can require a transaction and expose the user to additional permissions. If a guide mixes them, stop and identify the exact operation before following it. A household reviewer should also avoid importing the same recovery phrase into a newly advertised cleanup wallet. Display clutter alone does not justify enlarging the number of applications that can access signing material.
A response card can use unsolicited receipt, metadata link, no claim signature and check real activity as checkpoints for observed symptoms, trusted verification, stop conditions and responsibility. Confirm facts before any action that changes permissions or moves funds. An urgent support message does not justify revealing secrets. Prefer read-only inspection, then document and recheck settings when a real change is necessary. After containment, repair the underlying recovery or access weakness rather than only dismissing the visible warning. Retain evidence without exposing identity material publicly. The aim is a controlled decision that reduces risk, not a hurried series of signatures prompted by fear or a stranger offering assistance.
