A token you never bought shows up in your wallet. Its name reads like an invitation: claim 5,000 USDT, visit a website, act before midnight. Nothing about it is a gift. Crypto airdrop scams rarely take anything at the moment the token arrives. They take it at the next step, when you connect your wallet to the site the token points to and sign what it asks.
That second step is the whole game. A fake claim page asks for a permission that lets a script empty the wallet. A lookalike address planted in your transaction history waits for you to copy it. A celebrity account promises to double whatever you send. The bait changes; the move the scammer needs from you is always one you make yourself.
Our overview of crypto scams covers every family of fraud, and the previous lesson on fake crypto investment platforms dealt with sites that pretend to grow your deposit. This lesson stays on free-money bait: fake claim sites and wallet drainers, tokens dropped into your wallet, address poisoning and giveaways that use famous names, with real cases, dated figures and a routine to check an airdrop before you touch it.
Real airdrops exist, which is why crypto airdrop scams work
An airdrop is a distribution of tokens to wallet addresses, usually to reward early users of a protocol or to spread a new token widely. Some are sent directly. Most of the large ones ask users to go to the project’s site, connect a wallet and submit a claim transaction.
The best-known example is Uniswap. On 16 September 2020 the exchange launched its UNI token and let past users claim 400 UNI each. Every address that had called the Uniswap v1 or v2 contracts before a snapshot taken on 1 September 2020 at 00:00 UTC qualified, including about 12,000 that had only sent failed transactions: 251,534 addresses in all, according to the Uniswap announcement. About 49,000 past liquidity providers shared a further 49.2 million UNI, pro rata. People who had swapped a few dollars of tokens months earlier found they had something worth claiming.
Scammers learned two lessons from airdrops like that one. Users will connect a wallet and sign transactions to claim free tokens, and they will do it fast, because claim windows and price moves create urgency. Each time a real airdrop is announced, copycat claim pages follow, with the same logo, a domain one letter away from the real one and a button that says “Claim”. A real airdrop is the best cover a fake one can get.
So the honest answer to “are airdrops safe?” has two parts. Receiving tokens is harmless in itself. The danger is in what you are asked to do next, and where.
Fake claim sites and the wallet drainers behind them
What a drainer does once you connect
A wallet drainer is a kit of scripts and smart contracts sold or rented to scammers. The phishing site looks like a claim page for a real project. When a visitor connects a wallet, the script reads what the wallet holds and asks for a signature or an approval that hands over the most valuable assets first. The visitor thinks they are claiming tokens. In fact they are authorising a transfer out.
Drainers are run as businesses. Scam Sniffer, a Web3 anti-scam firm, counted more than USD 5.9 million taken from 4,888 victims by Inferno Drainer as of 22 May 2023, through at least 689 fake sites imitating 229 brands, BleepingComputer reported; operators paid the kit’s developers 20% of what they stole, or up to 30% if the developers also built the phishing sites. Group-IB, a security firm, described in January 2024 how Inferno’s pages lured visitors with wording such as “Exclusive airdrop” and “The biggest airdrop”, and cited a Scam Sniffer estimate of at least USD 80 million stolen between November 2022 and November 2023 through more than 16,000 domains.
Inferno was one brand among several. MS Drainer, which Scam Sniffer tracked from March 2023, took about USD 58.98 million from about 63,210 victims in roughly nine months, according to its report of 21 December 2023; a single victim lost about USD 24 million on Ethereum in September 2023. In mid-May 2024 Pink Drainer told its customers it was shutting down, The Block reported on 17 May, after taking about USD 85 million from more than 21,000 victims over the previous year, according to Scam Sniffer data.
| Drainer or measure | Losses | Victims | Period and source |
|---|---|---|---|
| Inferno Drainer (early count) | over USD 5.9 million | 4,888 | to 22 May 2023, Scam Sniffer via BleepingComputer |
| Inferno Drainer (estimate) | at least USD 80 million | not given | Nov 2022 to Nov 2023, Scam Sniffer estimate cited by Group-IB |
| MS Drainer | about USD 58.98 million | about 63,210 | Mar to Dec 2023, Scam Sniffer |
| Pink Drainer | about USD 85 million | over 21,000 | year to 17 May 2024, Scam Sniffer data via The Block |
| All drainer phishing, 2024 | about USD 494 million | not given here | Scam Sniffer annual report, January 2026 |
| All drainer phishing, 2025 | USD 83.85 million | 106,106 | Scam Sniffer annual report, January 2026 |
The trend has turned, at least by this measure. Scam Sniffer’s report published on 3 January 2026 counted USD 83.85 million lost to drainer phishing in 2025, down 83% from 2024, with 106,106 victims (down 68%) and an average loss of USD 790. Only 11 cases topped USD 1 million, against 30 the year before. The firm calls its figures a lower bound: they cover wallet-drainer attacks through phishing sites only and leave out direct hacks, exchange compromises and blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract exploits.
Approvals and permit signatures, in plain words
Two kinds of permission do most of the damage. The first is the classic token approval. On Ethereum and similar chains, a token such as USDC lets you authorise a smart contract to move your tokens for you, which is how decentralised exchanges work. The approval is a transaction you pay gas for, and it stays valid until you cancel it. Revoke.cash, which builds a tool for cancelling them, puts it simply: a contract you approved can spend those tokens at any time, for as long as the allowance lasts. Many apps ask for an unlimited allowance by default. ethereum.org warns that an unlimited spend could let a contract drain your wallet.
The second kind is quieter. The EIP-2612 standard, known as “permit”, lets a token holder grant an allowance by signing a message instead of sending a transaction. No gas, nothing visible on the chain at the moment you sign. Anyone holding that signature can then submit it to the token contract. Uniswap’s Permit2 contract works on the same idea for any token. For a scammer, a signed permit is ideal: the victim sees a wallet pop-up with text they do not read, clicks “Sign”, and the transfer happens later from a wallet they have never heard of.
The figures show how much this matters. Of the USD 22.98 million lost in the 11 largest drainer cases of 2025, Permit and Permit2 signatures accounted for about USD 8.72 million, roughly 38%, ahead of classic approvals at about 24%, Scam Sniffer found. The single largest theft of the year, about USD 6.5 million in September 2025, used a Permit signature. A newer variant appeared after Ethereum’s Pectra upgrade: malicious EIP-7702 signatures that bundle several operations into one, behind two large cases in August 2025 totalling about USD 2.54 million.
The rule that follows: a signature can be as dangerous as a transaction. “Sign” does not mean “log in”. If a claim page asks you to sign something you cannot read or that mentions a spender, an amount or a deadline, you are being asked to hand over control of tokens.
How victims land on the fake page
Nobody types the address of a phishing site. They are sent there. MS Drainer is the documented case for paid advertising: Scam Sniffer first found it behind phishing ads in Google search results in March 2023, saw it again at the end of April in a fake ad for the Radiant lending protocol, and later found that six of nine phishing ads it sampled on X used the same kit. A search for “[project name] airdrop” can put a paid fake above the real site.
The other routes are social. Hijacked or lookalike accounts on X reply to a project’s real announcement with a “claim here” link. Discord servers get a fake mint or airdrop post after a moderator account is compromised. Direct messages on Telegram promise that “your wallet is eligible”. The page itself often shows a countdown, because a reader in a hurry does not check the domain.
Scam tokens dropped into your wallet
The unsolicited token from the opening of this lesson is the cheapest version of the trap. Sending tokens to thousands of addresses costs little on low-fee chains, and the token’s name or symbol can itself be an advertisement: a URL, a dollar amount, the word “reward”. Some come as NFTs whose image shows a claim link.
Receiving such a token is not the problem. MetaMask’s support page is direct about it: nobody can access your funds simply by depositing tokens in your wallet. The scam begins when you try to do something with the token. MetaMask describes the usual path: the token seems to have value on a block explorer, you try to sell or swap it, an error message (often on the page of a failed transaction) points you to a fraudulent site, and that site asks you to approve a transaction, grant access to your tokens or type your Secret Recovery Phrase. ethereum.org describes the same pattern for airdropped NFTs and tokens: claiming them on the linked site is what compromises the account.
What is safe: leaving the token alone, or hiding it in your wallet’s interface. Hiding changes nothing on chain and costs nothing. What is not safe: visiting the site in its name, trying to sell it on an unknown exchange page, approving it for trading, or “claiming” a bonus linked to it. Some of these tokens are built so they cannot be sold at all, the honeypot design explained in our lesson on rug pulls; an attempt to sell is only a way to make you interact.
The FBI documented one version of this in a public service announcement of 3 June 2025. Users of non-custodial wallets on the Hedera network were receiving NFT airdrops presented as free rewards, with a link to a third-party site written in the transaction’s memo field. Victims who followed it were asked to connect their wallet to the site, or to type passwords and seed phrases, and then watched their crypto move out. The FBI’s advice: confirm any unsolicited token offer with the provider before accepting it, and never hand a seed phrase to anyone who contacted you first.
MetaMask suggests three checks before you treat an unknown token as real. Is it shown by the wallet with token detection on, which relies on curated lists? Does the network’s block explorer flag it? Does the project have a site, a community and people you can identify? Its own summary: if in doubt, do not take the risk.
There is one more reason not to wave off strange entries in your wallet. A tiny incoming transfer from an address you do not recognise may not be a token advertisement at all. It may be the setup for the next trick.
Address poisoning: the trap hidden in your own transaction history
Crypto addresses are long strings that people do not read in full. Most check the first few and the last few characters, and many copy an address from their wallet’s recent activity rather than from a saved contact. Address poisoning exploits both habits. If you are not sure how an address is built, our guide to what a crypto address is explains it.
The attacker watches the chain for wallets that move large sums. They generate an address whose opening and closing characters match one of the victim’s usual counterparties, then send the victim a tiny amount, or a token transfer worth nothing, from that lookalike. The fake now sits in the victim’s history, next to the real one. The next time the victim copies “the address I always use” from that list, they may pick the wrong line.
It is a numbers game, and it pays. A 2025 study cited by Etherscan in March 2026 counted about 17 million poisoning attempts on Ethereum between July 2022 and June 2024, targeting about 1.3 million users, with at least USD 79.3 million lost; adding BNB Chain, the study found about 270 million poison transfers and about USD 83.8 million in losses. A single attempt succeeds about 0.01% of the time on Ethereum, roughly one in 10,000, but one large theft pays for thousands of failures. In an example Etherscan describes, 13 poison transfers landed within a couple of minutes of one genuine USDT transfer. Lower fees after the Fusaka upgrade of 3 December 2025 made the spam cheaper: in the 90 days after it, dust transfers of USDT rose about 612% compared with the 90 days before, according to Etherscan, which notes that not all dust is poisoning.
Two cases show the scale. On 3 May 2024, ForkLog reported, a holder sent 1,155 wrapped bitcoin (wBTC), about USD 68 million at the time, to a lookalike address. The attacker swapped it into ether. After negotiations that started on 10 May, involving the security firm Match Systems and the Cryptex exchange, the attacker sent back about 22,960 ETH, then worth about USD 65.7 million or just over 96% of the dollar value taken, Cointelegraph reported; ether had moved in the meantime, so Match Systems described it as the entire stolen amount. That ending is a rare exception, the product of a traceable attacker and outside pressure, and it tells you nothing about what usually happens.
The usual outcome looked like this. In December 2025 a wallet lost 49,999,950 USDT, nearly USD 50 million, after its owner copied a poisoned address from their history, Cointelegraph reported on 20 December, citing the on-chain investigator Web3 Antivirus. The fake matched the first three and last four characters of the real one, SlowMist founder Cos pointed out. The victim had even sent a small test transaction to the correct address first; minutes later the full amount went to the poisoned one. The funds were swapped into ether, split across wallets and partly moved into Tornado Cash.
That last detail matters. A test transfer proves the address you used for the test is right. It proves nothing about the address you paste for the second transfer. The defences that work are boring: keep the addresses you pay often in your wallet’s address book, use an ENS name or an explorer’s private name tags, and compare the full address, character by character, against a source outside your history. Etherscan also highlights matching addresses, so two near-identical addresses with different highlighting give the trick away, and it shows a warning when you copy an address linked to suspicious activity. Its own rule is to verify the destination address before sending funds, because getting back funds sent to the wrong address is extremely unlikely.
Giveaways, celebrities and the “send one, get two back” trick
The giveaway is the oldest of these schemes and the least technical. A famous name, or an account that looks like one, announces that for a limited time any crypto sent to an address will come back doubled. Nothing ever comes back. ethereum.org puts it in one line: “Giveaways are always scams.” The US Federal Trade Commission says the same of anyone who promises to multiply crypto you send.
The case that proved even a real, verified account can carry the pitch came on 15 July 2020. Hackers took control of about 130 Twitter accounts belonging to politicians, celebrities and companies and posted the doubling offer from them. According to the criminal complaints described by the US Attorney’s Office for the Northern District of California, the scam bitcoin address received more than 400 transfers worth more than USD 100,000.
On 31 July 2020 federal prosecutors charged two men: Mason Sheppard, 19, of Bognor Regis in the UK, with conspiracy to commit wire fraud, conspiracy to commit money laundering and intentional access of a protected computer, and Nima Fazeli, 22, of Orlando, with aiding and abetting that access. The third suspect, a juvenile, was referred to the State Attorney in Tampa, Florida. A UK citizen charged later, Joseph James O’Connor, known as “PlugwalkJoe”, was extradited from Spain and pleaded guilty on 9 May 2023 to charges that included his role in the Twitter hack, after his extradition in April; on 23 June 2023 Judge Jed Rakoff in Manhattan sentenced him to five years in prison, followed by three years of supervised release, and ordered him to forfeit USD 794,012.64. The same case covered SIM-swap thefts and cyberstalking as well as the Twitter breach.
The pitch moved well beyond one breach. The FTC said in May 2021 that people had reported losing more than USD 2 million to Elon Musk impersonators in about six months, within nearly 7,000 crypto investment scam reports worth more than USD 80 million between October 2020 and March 2021. In April 2020 Ripple and its chief executive Brad Garlinghouse sued YouTube, alleging that the platform let fake “XRP giveaway” videos run on hijacked channels; those were Ripple’s allegations in a complaint, not findings of a court.
Video makes the trick more convincing, not more real. A hijacked channel with a large audience, an old interview of a founder replayed as if live, or a face and voice generated by software can all sit next to a QR code and a wallet address. The test does not change with the production value: no genuine company or person asks you to send crypto in order to receive more back.
How to check a crypto airdrop before you touch it
No checklist makes a claim risk-free, but most crypto airdrop scams fail one of these tests. Run them in order and stop at the first failure.
- Find the claim page yourself. Start from the project’s own website or documentation, reached by typing the address you already know or from a bookmark, and follow its link to the claim. A link in a reply, a direct message, a search ad or a token name does not count.
- Ask whether you expected it. Real airdrops reward something you did, such as using the protocol before a snapshot. A token that appears out of nowhere, with a link in its name, is advertising a trap.
- Never enter a seed phrase. No airdrop, wallet update or “verification” needs it. Our guide to seed phrase security explains why the phrase is the wallet itself.
- Read every wallet pop-up. A claim is normally a transaction that calls a claim function and costs a little gas. A request to approve a token, sign a permit, set approval for all your NFTs or sign a message you cannot read is a red flag on a claim page.
- Claim with a separate wallet. A “burner” wallet that holds only a little ETH for gas limits what any mistake can cost. Move the claimed tokens on afterwards if you want to keep them.
- Ignore the clock. Real claim windows usually last weeks or months. A countdown measured in minutes is there to stop you from checking.
- Clean up afterwards. Review the approvals your wallet has granted, on the Etherscan token approval checker or a tool such as Revoke.cash, and cancel the ones you do not need. Each revoke is a transaction and costs gas.
A hardware wallet helps less here than people expect. It keeps your keys off your computer, which matters for many attacks, as our guide to setting up a hardware wallet explains. But if you confirm a malicious approval or permit on its screen, the device signs it faithfully. It protects the key, not your judgement.
| Claim step | What is normal | Red flag |
|---|---|---|
| Finding the page | Link on the project’s own site or docs | Link from an ad, a reply, a DM or a token name |
| Connecting the wallet | Connect, then one claim transaction | Connection followed by several approvals |
| What you sign | A claim call with a small gas fee | Permit, “setApprovalForAll”, unlimited allowance, unreadable message |
| Secret data | Never asked for | Seed phrase or private key “to verify eligibility” |
| Timing | Days to months to claim | Countdown in minutes, “last chance” |
| Payment | Only network gas | A “fee” or deposit sent to an address to unlock tokens |
Claim sites are web apps that talk to your wallet, so it helps to understand how a dapp interacts with a wallet before you click “Connect”.
If you already clicked or signed
Speed matters more than certainty. If you signed an approval or a permit on a site you now doubt, revoke the approvals you can see and move what is left in that wallet to a new wallet created with a new seed phrase, since a signed permit may still be usable by whoever holds it. If you typed your seed phrase anywhere, treat the whole wallet as lost to the attacker and move everything that remains at once. Keep the transaction hashes, the addresses involved and screenshots of the site.
In the US, the FTC lists ReportFraud.ftc.gov, the FBI’s ic3.gov, the CFTC and the SEC as places to report crypto fraud. The FBI’s Internet Crime Complaint Center received 181,565 complaints with a cryptocurrency link in 2025, with reported losses of USD 11.366 billion, according to its 2025 annual report, which has no separate category for airdrop or drainer scams. In England, Wales and Northern Ireland, Report Fraud, run by the City of London Police, replaced Action Fraud from 4 December 2025 (in Scotland, report to Police Scotland on 101); in the UK, also check any firm against the FCA register. What reports, tracing firms and exchanges can and cannot do for a victim is the subject of a later lesson in this path. Be wary of anyone who contacts you offering to get the money back for a fee.
A short tax note on real airdrops
A genuine airdrop can create a tax bill. In the US, the IRS ruled in Revenue Ruling 2019-24, released on 9 October 2019, that a taxpayer who receives new coins in an airdrop following a hard fork has ordinary income, measured at fair market value when the airdrop is recorded on the ledger, provided the taxpayer can control the coins; a hard fork alone, with nothing received, is not income. Other airdrops and other countries have their own rules. Our lesson on crypto tax basics sets out the general principles. Scam tokens you never claimed and cannot sell are a different matter: do not interact with them to “report” them.
One habit covers most of this lesson: before you sign or send, look up the claim page, the contract or the address yourself, from a source you already trust. The next lesson in this path looks at what happens after a theft, what tracing, exchange freezes and police reports can achieve and where they stop.
