One day you open your wallet or your exchange account and there's USDT sitting there you never bought — or a handful of tokens you've never heard of. Nobody told you it was coming, and you have no idea who sent it. For a lot of newcomers the first thought is "free money," followed quickly by "let me cash it out." That single move is what can turn you from a bystander into a suspect. This piece explains what the coins might actually be, why "just sell it" is the most dangerous idea of all, and what the right response looks like.
- Don't sell it. Unexplained crypto may be crime-linked "dirty USDT." Move it to an exchange to sell and you can trip compliance controls — at best a frozen balance, at worst a suspended account and questions from investigators.
- Don't scan, don't click "claim." Those links are almost always approval-phishing. One signature and your wallet can be drained.
- Don't copy the address from your history. A tiny incoming transfer may be "address poisoning," planted to trick you into paying a look-alike scam address later.
- Leaving it alone is usually fine. The trouble almost always starts the moment you decide to "deal with it."
What unexpected crypto usually turns out to be
Money that shows up from nowhere almost always falls into one of three buckets, and each one is dangerous in a different way.
1. Crime-linked "dirty USDT" (the one to fear most)
"Dirty USDT" is stablecoin with a shady origin — typically the proceeds of online fraud, stolen-wallet operations, or a collapsed Ponzi. The blockchain is a public ledger, and firms like Chainalysis and TRM Labs, along with exchange compliance teams, tag and track these tainted addresses. The coins sitting in your account won't explode on their own. The danger is when you touch them — above all when you send them to an exchange to sell, which effectively runs crime proceeds through your own hands.
2. Address poisoning / dusting
A scammer sends you a tiny amount so that an address whose first and last characters closely mimic one you use often lands in your transaction history. Next time you pay someone, if you copy the address from that history to save time, you may send your funds straight to the look-alike scam address. The dust itself doesn't steal anything — it just plants a landmine.
3. "Claim your airdrop" phishing
The coins arrive with a claim page, QR code, or link that asks you to connect your wallet and hit "confirm" or "sign." You think you're claiming an airdrop; in reality you're signing a token approval — and once you do, the other side can move the assets out of your wallet, with your own "consent," almost impossible to recover. A genuine airdrop never needs you to sign an approval or reveal a seed phrase first.
Why "just cash it out" is the most dangerous idea
Plenty of people figure: whatever it is, once I've turned it into money the problem's gone. That's exactly where it goes wrong. If it's dirty USDT and you move it onto an exchange, the platform's compliance system will very likely flag that the funds trace back to a tagged address: best case the balance is frozen and your account restricted; worst case the whole account is suspended and you're asked to explain yourself to investigators. In the eyes of the money trail, you've objectively become a link in laundering and cashing out crime proceeds. The traceability of the blockchain — usually a good thing — works against you here.
Regulators treat this seriously. In the U.S., moving illicit funds can put you in "money mule" territory, and financial institutions file suspicious activity reports (SARs) on exactly this kind of pattern. So when unexplained coins land in your wallet, "sell fast" is the worst option and "do nothing" is the safest.
The right response: four don'ts + keep a record
- Don't sell and don't transfer the unexplained asset. Treat it as if it isn't there.
- Don't scan any QR code, don't click any "claim" link, and never sign a wallet approval.
- When you move your own funds, check the entire recipient address (not just the first and last few characters), and don't copy it from your history.
- Take a screenshot of where it came from in case you need it later; if you're worried you may have approved something by mistake, use a block explorer to review and revoke suspicious approvals, and move your assets to a fresh wallet if needed.
How to avoid the whole mess
- Don't hand your wallet address around casually. Posting it publicly in chats and forums is what invites dusting and tainted transfers in the first place.
- Be wary of "deposit and get a bonus" or "receive-on-my-behalf" offers. Anyone asking to route funds through your wallet or account is trying to borrow your identity to launder money — the "commission" is bait.
- Verify the source before you accept a transfer. If you don't know who sent it or why, assume the worst and leave it untouched.
Common misconceptions
Root yourself in legitimate channels and most of this trouble never starts. If you actually need USDT, buy it yourself on a large, reputable exchange where the origin is crystal clear — instead of gambling on coins that fell out of the sky. If you don't have an account yet, you can register on Binance's official site (invite code BN1606) and walk through it once with our first crypto purchase guide.
Invite code BN1606; any trading-fee discount is up to 20%, subject to current Binance terms and eligibility.