The last time I watched someone buy a fake token, the whole thing took under a minute. A project announced a new listing, he typed the ticker into the DEX search bar, picked the result with the right logo and the most volume, and swapped. The token he bought had existed for about forty minutes. Same name, same symbol, same logo lifted from the real project's website. It went to zero the moment the deployer pulled liquidity, roughly an hour later.
The part that stings is that nothing on the swap screen looked wrong. On a DEX there is no listing team checking whether the token you are about to buy is the token you think it is. The only identifier that means anything is the contract address. Everything else, the name, the symbol, the logo, the apparent volume, can be manufactured by anyone with a few dollars of gas.
Why the ticker tells you nothing
When you deploy an ERC-20 style token, the name and symbol are just strings you pass in at deployment. There is no registry and no uniqueness check, so nothing stops me from deploying a token called Chainlink with the symbol LINK in the next ten minutes, on most chains for less than the price of a coffee. Add a liquidity pool with a few hundred dollars in it and my counterfeit shows up in DEX search results next to the real thing.
The logo is an even weaker signal, since interfaces pull it from token lists and metadata services that scammers can sometimes populate themselves. And volume, which feels like it should be hard to fake, is trivially manufactured. A scammer can wash trade between their own wallets for an hour so the clone sorts above the real token when results are ranked by activity. I have seen fakes showing more apparent volume than the token they were impersonating.
The timing is usually deliberate too. Clones cluster around announcements. A project says its token launches at a certain time, and fake contracts start appearing before the official one is even deployed, because the scammer knows a wave of buyers is about to search for a ticker that does not officially exist yet. Being early to a launch is exactly when you are most exposed to this.
Where the real address lives
The canonical contract address comes from one place, the project's own official channels, reached through a path you already trust. That means the docs page or site you have bookmarked, or the official account you followed before you needed it. It specifically does not mean the first search result, which can be a paid ad for a phishing clone of the real site, and it does not mean an address someone posted in a Telegram or Discord reply, where impersonating an admin is the oldest trick going. Real admins do not DM you a contract address. Anyone who does is selling you something worthless.
Once you have a candidate address, cross-check it in two independent places. Paste it into the block explorer for that chain and read the token page. Established tokens usually carry a label or verified tag, a link back to the official site, and a long transfer history. Then check an aggregator like CoinGecko or CoinMarketCap, which lists the contract address per chain on each token's page. Aggregator listings involve some human review, so a match between the project site, the explorer, and the aggregator gives you three sources that would all have to be compromised at once.
One nuance that catches people on multichain tokens: the same project has a different address on every chain, and often a bridged version and a native version on the same chain. Verifying the Ethereum address does nothing for you if you are swapping on an L2 or a sidechain. Match the address to the specific chain you are actually trading on.
What a fresh clone looks like on-chain
Pull up almost any impersonation token on a block explorer and the pattern repeats. The contract was deployed hours or days ago, not months. The deployer wallet was funded just before deployment, often from an instant exchange or another fresh wallet, so there is no history to trace. Liquidity went in minutes after deployment. The holder list is tiny, the top few wallets hold most of the supply that is not in the pool, and a suspicious share of the trading activity is the same handful of wallets passing tokens back and forth.
The contract itself often tells you something as well. Legitimate projects verify their source code on the explorer so anyone can read it. Clones are frequently unverified, or verified but padded with copy-pasted code and extra functions bolted on: a transfer tax that only fires on sells, a blacklist the owner can add you to, or logic that lets you buy but never sell. That last category, honeypots, is common enough that token scanners and honeypot checkers exist specifically to flag it. They miss things, so treat a clean scan as one data point rather than clearance.
None of these signals is damning on its own. Every legitimate token was once a fresh contract with few holders. The tell is the combination, a brand new contract wearing an established project's name, deployed right around that project's announcement, with concentrated supply and manufactured volume.
The 60 second routine
Here is what I run before any swap into an unfamiliar token. Once it is habit it takes about a minute.
- Get the address from the project's official site or docs, reached from a bookmark or a link you trusted before today. Never from DEX search, never from a chat message, never from a search ad.
- Paste the address into the chain's block explorer. Check the contract's age, the holder count, whether the source is verified, and whether the explorer shows an official label or website link.
- Cross-check the address on an aggregator page for the token, making sure you are reading the entry for the chain you are trading on.
- In the DEX interface, select the token by pasting the full address into the token search rather than typing the ticker, then confirm the interface shows that same address before you sign anything.
- Compare the whole address, or at minimum characters from the beginning, middle, and end. Scammers generate vanity addresses that match the real one at both ends precisely because most people only check the first and last four characters.
If the token passes all of that and I am still uneasy, I do a small test swap and immediately try to sell a piece back. It costs a little in gas and fees, and it is the only check that directly answers the question you care about, which is whether you can get out.
If you keep just one habit from this, make it selecting tokens by pasted address instead of by ticker. The search bar on a DEX is a list of things strangers deployed, sorted by metrics anyone can fake, and once you treat it that way most of these traps never get a chance to spring.