Are airdrop scams really that common?

Yes. Wallet-drainer kits are sold like software subscriptions, so fake claim pages can be spun up in minutes. Any surge of hype tends to bring a matching surge of clones.

What is a wallet drainer?

A wallet drainer is a piece of software that automatically moves assets out of a wallet once the owner signs a malicious approval or transfer. It works instantly, so you cannot cancel after the fact.

Is it safe to connect a wallet just to check a page?

Read-only connects are usually safe, but do not sign anything. To be extra careful, use a burner wallet with almost no funds when you are checking a new site.

How do I revoke an approval I already signed?

Tools like Revoke.cash or Etherscan's token approvals page let you see and cancel active approvals. Do this on a computer you trust and double-check what you are cancelling.

Can a scammer steal from me just by knowing my public address?

No. Public addresses are meant to be shared. Danger appears only when you sign something with your private key or seed phrase.

What should I do if I already lost coins to an airdrop scam?

Move any remaining assets to a fresh wallet, revoke old approvals, and report the incident to the project and to platforms like Chainabuse. Recovery is rare, but reports help others avoid the same trap.

Airdrop Scams: Patterns, Red Flags, Safe Checks

Airdrop scams are one of the fastest ways people lose crypto in 2026. They ride on a real feeling: free tokens are fun, and nobody wants to miss one. Scammers know this and build claim pages that look almost identical to real ones. This guide breaks down the patterns, so you can spot them without needing to be a security researcher.

The fake claim site pattern

The most common airdrop scam is a lookalike website. You see a tweet or a Telegram post that says a token is airdropping to early users. The link points to a domain that is almost, but not quite, the real one — maybe an extra letter, a different top-level domain, or a Unicode character that looks like a normal letter.

On the page there is a nice "Connect Wallet" button and a claim form. When you connect, the site asks for a signature. The signature is usually not a normal transaction — it is a broad token approval or a signed message that hands over control of specific coins or NFTs. Once you sign, a drainer bot moves the assets out. If you are new to how legitimate drops work, read our plain-English airdrop explainer first.

Drainer approvals and what they look like

A drainer approval is a wallet signature that gives a smart contract permission to move your tokens. Real projects use these for good reasons — a swap on a decentralized exchange needs one, for example. Scam sites abuse the same tool.

Warning signs in the signature popup include:

The word approve, setApprovalForAll, or permit against a token or NFT collection you never asked to touch.
An unlimited allowance (a very large number, often ending in many zeros).
A destination contract that does not match anything on the project's official docs.

Slow down and read the popup. Wallet apps like MetaMask now show human-readable summaries for many approvals. If the summary looks off, cancel and check the contract address on the project's real site.

The send-first and referral farm traps

A second family of airdrop scams asks you to send crypto first. The pitch is always a "gas fee," a "verification deposit," or a claim to "unlock" the free tokens. A real airdrop never works this way. If the tokens are free, you receive them; you do not pay to pick them up.

Referral airdrop scams are related. They dangle bonus tokens for every friend you invite. The tokens are usually worthless, the referral link tracks you, and your friends get spammed with more of the same. We covered this pattern in depth in our referral airdrops explainer, using a real 2021 case study from this very domain.

The ten-second safety checks

You do not need a security background to filter most airdrop scams. Run these four quick checks before you sign anything:

Search for the project's official site — not the link that was sent to you. Compare the URL letter by letter.
Check the contract address in the project's docs, then look at the address inside your wallet popup. They must match.
Ask what you are signing. A message? A transfer? A token approval? A permit? If you cannot answer, cancel.
Never share your seed phrase. Not with a claim wizard, not with support, not with a Discord admin. Ever.

If a page passes those checks and still feels off, use a burner wallet with a few dollars in it and connect there first. Our guide to finding legit airdrops has a longer playbook.

Reading the shape of an airdrop scam

Airdrop scams look different every week, but the shape rarely changes. There is urgency ("claim in 24 hours"), there is a wallet connect, and there is a signature that does more than it seems. Once you have seen the shape, you can spot new versions on your own. The bad news is that scammers keep improving. The good news is that a two-minute check plus a habit of never sharing your seed phrase covers you against almost all of them. Add our risk disclaimer to that mindset and you are already ahead of most claimants.