An unsolicited asset can be used to lure someone into a separate harmful action.
LET’S PICTURE IT
A surprise coupon can be harmless paper, while its instruction to hand over your keys creates the real danger.
SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
An address is public receiving information. It is not the private key that authorizes actions.
An address is public receiving information. It is not the private key that authorizes actions.The local signing system uses secret authorization material. It produces a signature; the private key is not sent along with it.A verifier checks the signed request under the account’s rules. A valid signature does not by itself prove that the action is safe.Balances belong to network state. A wallet is an interface and signing system, not a box containing coins.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Receiving is not requesting
A public address can appear in unsolicited token or NFT activity. The appearance of an asset does not prove that you requested it, that it has value, or that its displayed instructions are trustworthy.
The next step can be the trap
A token name, image or message can direct visitors to a site claiming an unlock or claim process. That site may ask for a dangerous transaction, approval, signature or secret phrase. Analyze the requested capability, not the promised reward.
Ordinary receipt does not reveal a private key
A normal public token transfer does not automatically publish the recipient’s secret key. The threat often comes from the interaction the recipient is persuaded to perform afterward, or from untrusted software handling content.
A label is not evidence of value
A wallet can display metadata supplied by contracts or services. Do not treat that presentation as verified market value or an official endorsement. Read token identity and permission lessons before interacting.
QUICK CHECK · NO PRESSURE
Does an unexpected token automatically prove you should visit its advertised claim site?
Unsolicited metadata can be bait for a separate harmful request.