Everyone tells you to buy an ERC-20 token. Almost nobody tells you what that means or how it goes wrong.
I remember staring at Ethers can at around 1 a.m., refreshing the page like it would change something. Green checkmark. Transaction successful. And my tokens, about $400 worth [YOUR DETAIL: amount and year], sitting in a contract that had no idea what to do with them.
I wrote to support. I posted on Reddit. A kind stranger explained, politely, that the money was gone. Not lost, not delayed. Gone.
That night I realized I’d been buying and sending “ERC-20 tokens” for months without knowing what the term meant. So I went and learned. This is what I wish somebody had told me first.
Image Generated by ChatGpt
ERC-20 is just a set of rules
That’s all it is. No mystery.
In 2015, Fabian Vogelsteller and Vitalik Buterin put forward a proposal for how tokens on Ethereum should behave. Before then, every project built its tokens however it liked, and a wallet that supported one coin might choke on the next. Think of a drawer full of chargers that all almost fit.
The ERC-20 rules fixed it. If a token follows them, any wallet or exchange on Ethereum can handle it without special code. The rules are six functions and two events. Check a balance, send tokens, see the total supply. And one slightly scary pair, approve and transferFrom, which let someone else spend your tokens. Hold that thought, because it comes up again below.
The reason this mattered so much is that it made launching a token almost embarrassingly easy. You didn’t need your own blockchain anymore. A developer with a free afternoon could write a small contract, deploy it, and have a coin that showed up in MetaMask by dinner. That’s how we got the 2017 ICO craze, and honestly, a lot of garbage along with the good stuff.
Today the big names you probably already hold work this way. Tether and USD Coin on Ethereum, Chainlink, Uniswap. When people say “the crypto ecosystem,” a big chunk of it is just contracts following this one old rulebook.
The approve button
Now the part that actually costs people money.
When you swap on a decentralised exchange, your wallet asks you to approve a token. You click it. Everybody clicks it. I did for a year without thinking.
What you’ve done is give a smart contract permission to take tokens out of your wallet. And many apps ask for an unlimited amount by default, so you never have to approve again. Convenient. Also, a loose key under the doormat.
If that app gets exploited six months later, the attacker doesn’t need your password. The permission you gave is still sitting there. A lot of “my wallet got drained, and I didn’t do anything” stories are exactly this. They did do something. They clicked approve in March and forgot.
So I do three boring things now. I set a custom amount instead of unlimited when the wallet lets me. Every month or so I open Revoke. cash, look at the list of contracts I’ve approved, and cancel the ones I’m not using. And I keep a second wallet for experiments, so the one holding real savings never touches a sketchy site.
Ten minutes. Genuinely worth it.
Back to my $400
Here’s what happened to me, and it’s baked into the standard itself.
The transfer function in ERC-20 doesn’t check whether the receiver can handle tokens. It subtracts from your balance, adds to theirs, and moves on. If you send tokens to a regular wallet, fine. If you send them to a smart contract that wasn’t built to receive and return them, they sit there forever, because the contract has no function to send them back out.
Developers have complained about this for years. Over time, huge amounts of tokens have ended up stranded in contracts this way, and nobody can touch them. Newer standards like ERC-223 tried to patch it. They didn’t take over, because by then the whole industry was built around ERC-20. Wallets, exchanges, lending apps. Replacing it would be like trying to replace the QWERTY keyboard. Flawed, familiar, and not going anywhere.
There’s a cousin of my mistake that catches even more people: the wrong network. USDT exists on Ethereum, Tron, and other chains, and the addresses can look similar. Send it over the wrong network to an exchange that doesn’t support it and you can be in for a long, painful support ticket, or no recovery at all. Always check which network you’re sending on, and send a tiny test amount first. I know it feels silly. Do it anyway.
Before you buy any ERC-20 token
Here’s something that surprised me. Calling a token “ERC-20” says nothing about quality. Anyone can make one in a few minutes, for free, with no approval from anyone. A scam coin and a serious project use the same standard.
So I run a short check every time.
First, the contract address. Scammers copy the name and logo of real tokens, and fake versions pop up constantly. I get the address from the project’s official site or Coin Gecko, never from a reply under a tweet.
Second, who owns the supply? Etherscan has a holders tab. If three wallets own 80% of everything, those three can crash the price whenever they feel like it. Not always a scam, but it should make you think.
Third, whether the code is verified on Etherscan and whether a known firm audited it. An audit isn’t a guarantee. Plenty of audited projects have still been hacked. But a big project with neither? I walk away.
I’m not a financial advisor, and this isn’t financial advice. It’s just the checklist I wish I’d had at 1 a.m. staring at that checkmark.
What this taught me
I used to think crypto was either genius or fraud, depending on who was shouting. ERC-20 changed my mind a bit. It’s a tool. A clever, simple, slightly flawed tool that lets anyone create digital money without asking permission.
That freedom is the whole appeal, and it’s also exactly why nobody is going to save you when you slip. The code does what it says, not what you assumed it said. No one picks up the phone.
You don’t have to become a developer. You just have to know what you’re clicking, and slow down for a few seconds before you do.
I paid $400 to learn that. If this post saves you the tuition, good.
Have you ever been burned by an approval or a wrong-address transfer? Tell me in the comments. Somebody scrolling by might dodge the same hole.
I Sent Crypto to the Wrong Address and Nobody Could Help Me. Learn From My Mess (ERC-20 Explained) was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.