Crypto Airdrop Scams
Originally published · 6 min read · Updated
Crypto airdrop scams use fake claim pages, token metadata, malicious approvals, or seed-phrase theft. Use this checklist before signing.
TL;DR: An unsolicited token cannot drain your wallet by existing; the danger begins when you follow its link, reveal a secret, approve spending, or sign a transfer.
Table of contents
An unsolicited token cannot drain a wallet merely by appearing; the loss starts when the owner follows its URL, exposes a recovery phrase, signs a transfer, or grants spending authority.
Crypto airdrop scams that actually drain wallets
| Lure | What the page requests | What is really at risk |
|---|---|---|
| Token or NFT with a claim URL | Visit a domain in the asset image, name, or memo | Recovery phrase, approval, or transfer |
| Fake eligibility checker | Connect, then "verify" with a signature | Permit, Permit2 authority, or a signed order |
| Failed token swap | Follow an error message to unlock trading | A redirect to a phishing dapp |
| Impersonated project post | Claim before a countdown expires | A rushed signature on an unverified domain |
| Send-to-receive giveaway | Transfer crypto to unlock a larger reward | The transfer itself; nothing is returned |
| Fake support after a failed claim | Share a phrase, password, or screen | Complete wallet or device control |
Connecting a wallet normally reveals its public address and network; it does not by itself authorize token movement. The dangerous step is the transaction or signature that follows. A typed-data signature can authorize a permit, order, or transfer without looking like a conventional token send.
MetaMask's airdrop guidance confirms the counterintuitive part: receiving a mystery token is not the compromise. Trying to redeem it through the URL supplied by the token is the trap.
How to spot a crypto airdrop scam
Reject the claim if any one of these checks fails:
- Origin: Open the project from a saved official domain or its documentation, not from the token, email, direct message, search ad, or reply thread.
- Announcement: Match the claim window, eligible chain, and contract address against a dated official announcement. A polished claim page is not evidence.
- Secret: No legitimate claim needs a recovery phrase, private key, wallet password, or one-time code.
- Transaction: The wallet prompt should claim the stated asset. Reject transfers, NFT operator approvals, unlimited allowances, and unrelated batch calls.
- Typed data: Read the token, spender, amount, chain, nonce, and deadline. "Sign to verify" describes the interface, not the authority being granted.
- Payment: Network gas can be necessary; sending funds to a person or deposit address to "unlock" a reward is not.
- Pressure: If verification cannot be completed before the timer, value the claim at $0 and wait.
Our rule is blunt: urgency is an attack input. A reward that survives independent verification will still exist after you inspect the contract; a reward that requires blind speed is not worth the wallet.
Crypto airdrop scam checklist before signing
- I opened the claim from the project's official domain or docs.
- The announcement names the same chain, URL, dates, and claim contract.
- I am using an activity wallet, not the wallet holding long-term assets.
- The wallet prompt shows the expected contract and action.
- I checked every token, spender, amount, expiration, and batched call.
- The page requested no recovery phrase, password, remote access, or deposit.
- I know how to exit the position and revoke any permission created.
- I saved the transaction hash and spender in the crypto tracking spreadsheet.
Do not treat transaction simulation as authentication. Simulation can expose a transfer or approval, but a clean preview does not prove the domain, project, or upgradeable contract is trustworthy.
Safe wallet setup for airdrop farming
Use three custody boundaries:
- Vault: hardware-backed storage that never connects to quests or claim pages.
- Activity wallet: only the assets needed for planned protocol use, a likely revocation, and the exit transaction.
- Burner: a replaceable address for an unknown contract; never fund it from the vault immediately before every action if address-linking matters.
A hardware wallet protects key storage, not judgment. It will faithfully sign a malicious request that the owner approves. The real control is limiting what the signing address can lose.
For EVM wallets, inspect standard ERC-20 allowances, NFT operator approvals, and Permit2 separately. Uniswap's Permit2 documentation describes both signature-based transfers and time-bound allowances; checking only a token's conventional approve history is incomplete. Use the token approval checker after a campaign, not only after an incident.
What to do after an airdrop scam
| What happened | Immediate response |
|---|---|
| Only viewed the token or connected the wallet | Close the page and disconnect; verify that no transaction or signature was approved |
| Signed a token or NFT approval | Identify the chain and spender, revoke it onchain, then verify the new allowance |
| Signed a permit, Permit2 message, or unknown typed data | Cancel the relevant nonce where supported; inspect all affected assets and move value if the scope is unclear |
| Sent funds | Preserve the transaction hash, destination, domain, messages, and timestamps; report through official channels |
| Exposed a recovery phrase or private key | On a clean device, create a new recovery secret, move assets on every chain, and retire the old wallet |
| Installed software or allowed remote access | Treat the device and every key used on it as compromised until rebuilt and rotated |
Disconnecting a site does not revoke onchain permissions. Revoking permissions does not make an exposed recovery phrase secret again. Choose the response based on the authority lost, not the button you remember clicking.
If assets have moved, ignore private recovery offers. Ethereum transactions cannot be reversed by a stranger charging an upfront fee. Follow the containment sequence in digital wallet scam. US victims can report transaction hashes and addresses through the FBI Internet Crime Complaint Center.
Crypto airdrop scam edge cases
A random token appeared, but I did nothing. Hide it and leave it alone. Do not visit its metadata URL, attempt a swap, or burn it through an unknown contract. Ownership alone is not approval.
The project's social account posted the link. A social account can be compromised. Confirm the same claim through the project's established documentation and inspect the contract request.
The claim asks for an approval before distributing tokens. Stop unless the official mechanics clearly require that exact asset and spender. A one-way reward rarely needs authority over unrelated holdings.
The wallet shows no warning. Absence of a warning is not a security verdict. New domains, contracts, and signature patterns may not exist in a wallet's blocklist yet.
For campaign economics rather than phishing defense, see what is airdrop farming. For source verification before connecting, use the crypto due diligence workflow.
Sources
Related articles
Token Approval Checker
Use a token approval checker to find ERC-20, NFT, and Permit2 spending permissions by chain, then revoke dormant or unlimited spenders safely.
Digital Wallet Scam
Digital wallet scams steal recovery phrases, signatures, approvals, or transfers; identify the failure type first, then contain it without trusting recovery DMs.
What Is a Decentralized Wallet
A decentralized wallet gives the user control of transaction keys, but its app, RPC, recovery, and swap services may still be centralized.
What Is Airdrop Farming
Airdrop farming is deliberate protocol activity performed for a possible future token allocation; calculate known costs and assume the reward is zero.