Verifying that a token is genuine
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
Anyone can mint a token with any name and symbol, so a name tells you nothing about authenticity. The only identifier that means anything is the contract address: take it from the project's own channels and corroborate it in an explorer. If you cannot confirm it, the right call is to leave it alone.
Key points
- Unlimited tokens can share a name and symbol; the name identifies nothing
- Get the contract address from the project's own site or official account
- Check holder count, transaction history and whether the source code is verified in an explorer
- If you cannot confirm it, or the only source is a third party's social post, walk away
Definition
Establishing whether a token really was issued by the project it claims to represent, using its contract address and on-chain records.
Start from the fact that issuing a standard token — an ERC-20, say — takes minutes and is open to anyone. Naming it 'Bitcoin' with the symbol 'BTC' is technically unobstructed. The name shown in a DEX or wallet list is simply a string the issuer chose. That leaves the contract address as the only usable identifier.
The process begins at the project's own material: documentation on the official site, the official GitHub, a pinned post on an account the project actually runs. What matters here is not reaching that official site through a search advert — sites with a single character changed in the domain, publishing a fake address, are a known pattern.
Take the address you found and search it on that chain's block explorer. Look at the holder count (very few means new, or manufactured), the transaction history (is there genuine activity), the supply, and whether the contract's source code is published and verified. If the source is not available, nobody outside can confirm what the contract does — and that unreadability is itself a finding.
Cross-checking independent sources helps too: see whether the address listed for that project on aggregation or analytics sites matches the one you obtained. A mismatch means you picked up a fake somewhere. Note that being listed on such a site says nothing about whether a token is safe or worth anything; it is only a way to confirm identity.
Finally, a word on where to draw the line. Common scam constructions include tokens you can buy but not sell, designs that let the issuer mint without limit afterwards, and designs where a privileged address can freeze transfers. Reading those details takes technical knowledge. If you cannot read them, let 'I could not confirm this' be your conclusion. Passing on something costs you nothing; touching something unverified can cost you everything.
Watch out for
- · Do not interact with tokens or NFTs that arrive unsolicited. The act of trying to sell one can itself connect you to, or approve, a malicious contract
- · 'It trades on a DEX' and 'it has a price' prove neither authenticity nor safety
- · Fake airdrop claims that funnel you to a site and extract a signature or approval are a standard playbook. Ignore distributions you were not expecting
Frequently asked questions
What is the most reliable place to get a contract address?
The project's own technical documentation or its official repository. Third-party roundups and social posts can be altered in the retelling, so always corroborate against the project's own material.
If the source code is verified, is the token safe?
No. A verified badge only means the published source matches the deployed bytecode; it says nothing about whether that code treats you fairly. Verification is a minimum bar, not a safety certificate.