A fake airdrop usually steals funds by luring you to a cloned claim site, asking for a seed phrase, or obtaining a malicious signature or token approval. A legitimate claim never needs your recovery phrase, and “free” tokens are not worth signing an instruction you cannot explain.
How the problem works#
Airdrop bait works because urgency lowers scrutiny. The wallet may display a vague message while the site requests an unlimited allowance, NFT operator permission or typed-data signature that a drainer can use later.
Make the final call#
Skip the claim if the contract cannot be verified, the deadline exists only in a private message, or the reward requires a secret. The maximum gain is the advertised token; the downside is the entire exposed wallet.
The operating procedure#
- Find the announcement through the project’s independently verified website. The choice determines which asset, authority or risk model applies, so resolve any ambiguity before the next step.
- Confirm the chain, claim contract and eligibility rules from two official channels. Compare the exact domain, address, network or permission with an independent official source before continuing.
- Use a low-value interaction wallet with no important approvals. Complete this through the verified product interface, then test the control instead of assuming it is active.
- Simulate or decode the transaction when a trusted tool is available. For airdrop scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Revoke unnecessary permissions after the claim is complete. For airdrop scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
Avoid these shortcuts#
- Following a sponsored search result or reply-account link. The branding can be copied, so the request must be re-opened through an independently verified channel.
- Paying a “verification deposit” to unlock a reward. This weakens a control that should limit the blast radius of airdrop scam.
- Importing an unsolicited token into an unknown claim site. A label can look correct while the underlying destination differs, and a confirmed onchain action may be irreversible.
- Assuming a wallet connection is harmless because no transfer appears. This removes a required input from the airdrop scam decision and makes the apparent result unreliable.
For airdrop scam, a clean result is not merely a completed transaction or setting. It is a result you can independently verify, reproduce and recover from if the surrounding service fails.
Confirm the result#
Do not judge the outcome of airdrop scam only by whether the interface shows a success message. Use evidence that can still be checked after the page is closed.
| Checkpoint | Evidence | Stop condition |
|---|---|---|
| Find the announcement through the project’s independently verified website | Dated screenshot or onchain record with sensitive data removed | Following a sponsored search result or reply-account link |
| Confirm the chain, claim contract and eligibility rules from two official channels | Exact URL or contract address matched to official documentation | Paying a “verification deposit” to unlock a reward |
| Use a low-value interaction wallet with no important approvals | Exact URL or contract address matched to official documentation | Importing an unsolicited token into an unknown claim site |
Keep transaction hashes, official case numbers or dated screenshots when they help document airdrop scam, but exclude seed phrases, private keys and authentication codes.
Frequently asked questions#
Can an airdropped token itself empty my wallet?
Simply receiving a token normally cannot authorize spending. Risk begins when you interact with a malicious contract or site.
Why does a claim require gas?
A real onchain claim may require a network fee, but a fee does not prove legitimacy.
Should I hide spam tokens?
Yes, if the wallet supports hiding them. Do not visit URLs embedded in token names or descriptions.
Related guides#
Sources#
- FTC: What to Know About Cryptocurrency and Scams
- FBI IC3: Cryptocurrency Investment Fraud
- Ethereum.org: Scam Prevention
Risk notice: Crypto actions can be irreversible. Never share a seed phrase, private key, password or authentication code, and verify every domain and wallet prompt independently.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
