Airdrop scams: how to spot fake airdrops and wallet drainers

An airdrop scam uses the promise of free tokens to get you to do one of two things: reveal your seed phrase, or sign a transaction that lets someone else move your tokens. Real airdrops need neither. The bait can be a token or NFT that appears in your wallet, a link in a direct message or social post, or a close copy of a real claim site, and the defence is the same each time: reach claims only from the project's own pages, and never sign a request you do not understand.

How much is being stolen

The figures below cover crypto fraud and wallet drainers in general, not airdrop scams alone, but they show the scale.

• The FBI's 2025 Internet Crime Report, released on 6 April 2026, counted 181,565 complaints involving cryptocurrency, with reported losses of more than $11 billion. Complaints involving cryptocurrency reported the highest losses of any kind.
• Scam Sniffer, a firm that tracks crypto phishing, counted $83.85 million stolen from 106,106 victims by wallet drainers on EVM chains in 2025, down from $494 million in 2024. It calls its figure a lower bound and warns that the fall "may partly reflect a shift toward harder-to-track attack vectors".

The 5 airdrop scams to know

1. Fake claim sites and wallet drainers

A wallet drainer is, in Scam Sniffer's definition, "phishing infrastructure deployed on malicious websites that induces users to sign harmful transactions, enabling rapid asset extraction." To the victim it looks like a claim page. ethereum.org's security guide describes the flow: the site prompts you to sign in with your wallet and "approve" a transaction to claim, and that transaction compromises your account, or in another version simply sends your funds to the scammer.

One user's account, quoted by MetaMask, sums it up: "You confirm the MetaMask transaction, but what you don't realize is that you're giving the page permission to take your tokens, rather than give you tokens." The permissions involved have names worth recognising: approve, permit and setApprovalForAll are the signature types Scam Sniffer lists under signature phishing. A Permit signature was behind the largest single theft it recorded in 2025, $6.5 million in September.

2. Tokens and NFTs you never asked for

Wallet addresses are public, so anyone can send tokens to them. MetaMask describes the usual sequence: a wallet holder notices new tokens, "maybe even millions" of them, tries to swap them, nothing happens, and an on-chain message says they must be claimed on a third-party site. That site then asks for the recovery phrase or for a token approval.

NFTs are used the same way. MetaMask warns that NFTs "looking more like an ad than digital art" which tell you to claim an airdrop on a website are most likely phishing for your recovery phrase, and advises not to interact with them at all. The FBI warned of a version on the Hedera network in a 2025 public service announcement: scammers put a link in the memo field of airdropped NFTs, and the linked site asked users to connect their wallet and enter details "including seed phrases".

3. Copycat tokens

A scam token can carry the same name and ticker as a real one. ethereum.org's guide to scam tokens uses wARB, made to look like Arbitrum's ARB: about 16% of its supply sat in the real Arbitrum Foundation deployer address, to make it look like a token real holders own. What a scam token cannot copy is the contract address. ethereum.org says the best source for that address "is the organization whose token it is", and that scam tokens typically have tiny liquidity pools, if any.

4. Fake support and seed phrase requests

Support scammers search public Discord channels for people asking questions, then send a private message offering help, according to ethereum.org, and they impersonate moderators and support staff on Discord, Telegram and social media. Its rules are short: "Real moderators will never DM you first", and no legitimate service, support agent or website will ever ask for your recovery phrase or private key. The FBI's advice is the same: do not respond to requests for passwords, seed phrases or one-time passwords if you did not start the conversation.

5. Pay-to-claim offers and rug pulls

Some fake airdrops ask you to send crypto first, as a fee or a deposit. ethereum.org calls the general pattern the giveaway scam, in which you send coins on the promise of getting more back, usually against a deadline, and says "Giveaways are always scams." Offers to sell a token before its official launch are covered in what is a TGE.

A real token can also be the bait. MetaMask describes the rug pull: a token is created, promoted "through airdrops, spamming through social media channels", its price is inflated, and the creators sell, leaving buyers with "tokens worth next to nothing".

Warning signs

MetaMask's list of tactics behind malicious approval requests reads like a description of a fake airdrop: urgent deadlines, "promises of unrealistic returns, airdrops, or allowlisting", impersonation of known projects, poor grammar or design, and unexpected messages. Being offered a place on an allowlist in a direct message fits that list. Add these:

• A site asks for your seed phrase or private key. That alone settles it.
• A claim asks you to approve all your NFTs, or unlimited spending, before you receive anything. Of the setApprovalForAll request used to claim fake NFT drops, MetaMask says "you shouldn't have to sign this kind of approval to receive anything."
• The link reached you in a message, a reply, an ad or a token memo, not from the project's own site.
• A token you never interacted with appeared in your wallet and cannot be swapped.
• Someone offers to recover lost funds for a fee.

What to do if you clicked, signed or lost funds

1. Move what is left. ethereum.org's scam help page says to move remaining funds to a new, secure wallet the scammer has no access to. If you typed your seed phrase anywhere, MetaMask's warning is that the scammers then "have control over their entire wallet", so the new wallet needs a new phrase.
2. Revoke approvals. Use a tool such as Revoke.cash, Revokescout or the Etherscan token approval checker to remove the permissions the scam site received. How to claim an airdrop safely walks through it.
3. Secure your accounts. Change passwords on linked exchange accounts and turn on two-factor authentication.
4. Report it. In the US, file a complaint with the FBI's Internet Crime Complaint Center (IC3); in the UK, with Action Fraud; in the EU, through Europol. The FBI asks for the wallet addresses, the amount and type of cryptocurrency, the date and time, and the transaction ID. Flagging the scam address on Chainabuse or Etherscan warns others. If funds went to a centralised exchange, contact its support quickly: ethereum.org notes that exchanges can sometimes freeze accounts flagged for fraud.
5. Ignore recovery offers. "No one can reverse blockchain transactions," ethereum.org says, and someone offering to recover your funds for a fee is "almost certainly a second scam". The FBI gives the same warning.

If you are new to how real airdrops work, start with what is a crypto airdrop. Telegram games have scams of their own, covered in Telegram tap-to-earn airdrops. For a claim you are about to make, a burner wallet with its own seed phrase limits what a mistake can cost.

Key takeaways

• Airdrop scams want your seed phrase or a signature; a real airdrop needs neither.
• Do not interact with tokens or NFTs you never asked for, however valuable they look.
• Names and tickers can be copied; contract addresses cannot, so check them against the project's own docs.
• If you signed something bad, move what is left and revoke approvals at once, then report it.
• Nobody can reverse a blockchain transaction, so paid recovery offers are scams.