What to collect
- Chain and contract address
- Raw integer amount and decimals
- Issuer’s deployment reference
Before drawing a conclusion
A valid address format says nothing about its owner or safety. An unsolicited token is not evidence that your signing key is compromised.
Test the idea
Two tokens both say USDC. Can their balances be combined as the same asset?
Reveal the explanation
Only after checking their deployments and representations. The symbol alone is insufficient.