Safety & Verification
Verifying Token Contract Addresses Before Swapping
Learn how to defend against spoofed tokens, verify smart contract addresses, and ensure you are routing the legitimate asset.
By BetaExchanger Research · Published · Updated · 6 min read
Key takeaways
- Anyone can create a new cryptocurrency and name it 'Bitcoin' or 'USDT'. The name and ticker are meaningless on decentralized networks.
- The only true identifier of a token on a smart contract blockchain is its cryptographic contract address.
- Scammers frequently airdrop fake tokens to wallets, hoping users will attempt to swap them.
- BetaExchanger's routing networks are hardcoded to accept only official contract addresses.
On decentralized networks like Ethereum, Binance Smart Chain, and Solana, permissionless creation is a feature, not a bug. Anyone with five dollars and basic coding skills can deploy a smart contract that issues a new token. Crucially, there is no central registry preventing them from naming that token 'Tether' and giving it the ticker 'USDT'.
The Spoofing Threat
A common vector for loss involves token spoofing. You might check your wallet and notice an unexpected balance of thousands of 'USDT'. A malicious actor has manufactured a worthless token named USDT and airdropped it to your address.
If you attempt to route this fake asset through a BetaExchanger provider, the provider's deposit detection software will ignore the transaction. The software does not read the name 'USDT'; it reads the exact contract address that generated the transaction. If it does not match the official Tether contract, the transaction is discarded.
The Ultimate Identifier: Contract Addresses
A contract address is a unique cryptographic string that identifies the specific smart contract managing a token's ledger. It is the blockchain equivalent of a vehicle identification number (VIN). While the make and model can be faked, the VIN cannot.
For example, the official contract address for ERC-20 USDT on Ethereum is always: 0xdAC17F958D2ee523a2206206994597C13D831ec7
No matter how convincing a fake token looks in your wallet, if its contract address does not match the string above, it is not real Ethereum Tether.
Verification Habits
- Trust the Address, Not the Logo: Wallet interfaces pull logos from public repositories which can be manipulated. Only trust the underlying contract address.
- Use Block Explorers: When viewing your address on Etherscan or Polygonscan, click on the token to view its global holder count and transaction history. A real stablecoin has millions of transactions; a spoofed token will have very few.
- Ignore Unsolicited Airdrops: If a high-value token appears in your wallet without your interaction, it is almost certainly a malicious spoof or a phishing vector.