You open a portfolio tracker and a wallet you have not touched in months is showing five figures. For a moment it is a very good day. Then you look at what is in there: a token you do not remember buying, with a ticker you definitely recognise, and a quantity in the thousands.
It is worth nothing. The number is real in the sense that the tracker computed it, and fictional in every sense that matters. This post is about how that happens — because the mechanism is simple, extremely common, and almost entirely preventable.
A ticker is not an identity
This is the root of it. On any chain with open token creation — which is all of them — a token symbol is just a text field. Anyone can deploy a contract and set its symbol to `UNI`, or `USDC`, or `ARB`. It costs a few dollars in gas. Nothing anywhere prevents it, because nothing anywhere could.
So when a tracker reads your wallet, finds 5,000 units of something calling itself `UNI`, and looks up the price of UNI, it multiplies a real price by a fake quantity of a fake asset and shows you a real-looking dollar figure. The tracker was not hacked and did not malfunction. It asked the wrong question: it asked what the token calls itself instead of what it is.
Scam airdrops depend on exactly this. Dust a hundred thousand wallets with a token named after something valuable, and a percentage of those people will open a tracker, see an inflated balance, and go looking for a way to sell it — which is where the actual theft happens, on a site the token’s website points them to.
What the tracker should ask instead
Every on-chain token has an unforgeable identity: its contract address. Uniswap’s UNI is one specific address on Ethereum and nothing else can be it. An impostor can copy the symbol, the name, the decimals and the logo, but it cannot occupy that address.
So the rule is: a balance that carries a contract gets priced by that contract, or it does not get priced at all. Look up the market for that address, not for the string it displays. Do that and the impostor `UNI` resolves to no market, or to a market worth a few dollars, and it is valued accordingly instead of at Uniswap’s price.
A balance with no contract is a different case and is safe to price by ticker. A native coin — ETH on Ethereum, SOL on Solana, BTC on Bitcoin — cannot be impersonated, because it is the chain’s own unit. An exchange balance is safe for a related reason: Binance listing something as `UNI` is Binance asserting which asset that is, and that assertion is the thing you are relying on when you trade there.
Three more ways the price goes wrong
The same address on five chains
An EVM address is identical across Ethereum, BNB Chain, Base, Arbitrum and Polygon — the address you use on one is the address you have on all of them. But a token contract at a given address on Base has no relationship whatsoever to whatever sits at that address on Ethereum. Pricing a Base holding off an Ethereum pool, or vice versa, produces a number with no meaning at all. Any lookup has to be filtered to the chain the balance is actually on.
The pool with $300 in it
On-chain prices come from liquidity pools, and a pool’s quoted price is only as meaningful as its depth. A pool holding a few hundred dollars can be pushed to any price at all by one small trade — and people do exactly that, deliberately, to make a worthless token quote at a high price for precisely as long as it takes for someone to see it in a tracker.
The defence is a liquidity floor: ignore pools below a threshold, and where a token trades in several pools, take the deepest one rather than the most flattering. If nothing clears the floor, the honest output is no price. Reporting no price is not a failure — it is the correct answer to “what is this worth?” when the truthful reply is “nothing you could actually sell into”.
Wrapped tokens and the opposite error
There is a mirror-image failure worth knowing about. Some contracts genuinely do track another asset: WETH is ETH, WBTC is BTC, and the major stablecoins are dollars. A tracker being maximally strict will refuse to price these — they are contracts whose ticker it will not trust — and you get a wallet full of USDC valued at zero, which is technically defensible and practically useless.
The resolution is a small, boring allow-list of contracts someone has actually verified: these specific addresses are USDC, this one is WETH, this one is WBTC. It stays safe because the assertion comes from the maintainer rather than from the token’s own claim about itself — an impostor USDC is not on the list, so it still gets nothing. The list should be short and dull. The moment it starts including speculative tokens, it is back to trusting tickers.
What a good tracker shows you
The behaviour to look for is not "prices everything". It is "refuses to price the things it cannot identify, and says so".
- A token it cannot identify appears with its quantity and its on-chain symbol, flagged as unidentified, valued at nothing rather than at its namesake’s price.
- The portfolio total carries a note like “excludes 3 unpriced assets”, so you know the number is an under-count rather than a complete picture.
- An unpriced holding is never grouped into dust — “unknown value” must not be filed under “negligible”, or you will eventually hide something real.
- Token symbols read off-chain are treated as untrusted text and stripped of markup before display, because an attacker controls that field too.
That last point generalises. Everything about a token except its contract address is attacker-controlled: symbol, name, logo, website, the lot. A tracker that treats any of it as authoritative is trusting the person who deployed the scam.
What to do with the junk in your wallet
Nothing, mostly. An unwanted token sitting in your wallet is inert — it cannot do anything on its own, and there is no cost to leaving it there. The danger is never the token; it is the action you take because of it.
- Do not go looking for a way to sell it. The website the token points at is the actual attack, and the swap it offers is what drains the wallet.
- Do not approve anything to interact with an unknown token contract. A token approval can be far more expensive than the token is worth.
- Do not chase the number. If a tracker shows a wallet worth vastly more than you put into it, the tracker is wrong before your luck is good.
Then fix the measurement. A portfolio total is only useful if you can say where each part of it came from — which is the same argument as keeping an honest cost basis, and the same reason to be deliberate about which sources you track at all. A number that flatters you is not a neutral inaccuracy. It is the one kind of error you will never go looking for.