How to claim a crypto airdrop safely

To claim a crypto airdrop safely, open the claim page only from the project's own website or docs, connect a wallet that holds little else, and read every request your wallet shows before you approve it. A real claim never needs your seed phrase, and the only payment it involves is the blockchain's network fee. When you are done, revoke any token approvals you no longer need.

A real claim and a fake one, side by side

The steps below turn that table into a routine.

Step 1: Confirm the airdrop exists

Before you connect anything, find the airdrop on the project's own pages. Arbitrum's docs show the standard to look for: they name arbitrum.foundation as "the only official website" for the ARB airdrop and add "There is no presale. Don't ever share your seed phrase." The FBI gave similar advice in a 2025 public service announcement about fake NFT airdrops: if you did not sign up for a rewards program and receive an offer of free tokens, "verify the offer is from the cryptocurrency provider before accepting and/or providing any information."

Two warning signs at this stage:

• A token for sale before launch. When Binance announced on 12 September 2024 that it would list HMSTR, it warned that "any claims to offer this token for sale before the stated timeline are likely to be false advertising".
• A link you did not find yourself. ethereum.org's scam page is blunt: never click links sent in unsolicited messages, and remember that real moderators never message you first.

Each AirdropStop listing, such as Hamster Kombat or SEED Combinator, carries a status checked against the project's own pages. Treat it as a starting point and confirm on the project's site before you claim.

Step 2: Reach the claim page by hand

Phishing sites copy real claim pages closely. ethereum.org advises you to "always verify the URL before connecting your wallet" and to bookmark the official sites you use. It also documents a trick in which a post on X shows a link preview for a real domain while the link leads to a malicious site, so, in its words, "always check that you are on the right domain, especially after clicking a link".

For Telegram games, start from the project's official channel and its bot. Binance's HMSTR notice pointed eligible users to the claim page inside the game's own bot, t.me/hamster_kombat_bot. Telegram tap-to-earn airdrops covers fake bots and mini apps.

Step 3: Claim with a separate wallet where you can

A token approval is granted by one wallet address and only reaches the tokens in that address. That is the case for a burner wallet: a fresh wallet holding only enough of the network's coin to pay fees, kept apart from your savings. For the savings themselves, ethereum.org calls hardware wallets "the most secure wallet option for storing your private keys".

Give the burner its own seed phrase. ethereum.org warns that anyone who has your recovery phrase "can access all of your accounts and drain every asset", so a second account under the same phrase does not protect you if the phrase leaks.

There are two limits. If the airdrop rewards your main wallet's history, the claim has to come from that address, so be strict about everything else on this list. And a second claiming wallet is not the same as farming with many wallets: Arbitrum disqualified addresses identified as Sybil accounts. Airdrop eligibility explains how projects filter them.

Step 4: Check the network and the token

Claims happen on a specific chain. ARB, for example, was only minted and claimable on Arbitrum One, and its docs note that it could not be claimed on Ethereum mainnet. Set your wallet to the network the official page names, and keep a little of that network's coin for the gas fee.

After claiming, check that the token in your wallet comes from the contract address the project publishes. MetaMask's advice: "tokens can be faked. Check the issuing smart contract address against the address of the legitimate token."

Step 5: Read every signature before you approve it

This is the step where a wallet drainer does its work, so slow down here.

• Know what an approval is. MetaMask defines a token approval as "permission for a dapp to access and move a specific type of token from your wallet".
• Refuse blanket access. MetaMask says malicious sites ask people to sign setApprovalForAll, which covers every NFT you hold from one collection, "to claim an NFT drop", and that "you shouldn't have to sign this kind of approval to receive anything."
• Cap the amount. ethereum.org advises against unlimited spend limits, and MetaMask lets you lower the amount in its "custom spending cap" field.
• Check who is asking. MetaMask shows the requesting site and lets you view the contract address; compare both with the official site.
• Treat a free signature as seriously as a paid one. Some tokens use a signed permit instead of an on-chain approval, which MetaMask notes means you "effectively pay zero gas for the approval". A request that costs nothing can still grant spending rights.
• Never type your seed phrase. ethereum.org says no legitimate service, support agent or website will ever ask for your recovery phrase or private key.

Step 6: Pay gas, and nothing else

A claim costs gas because, as MetaMask explains, "for any transaction to be processed on chain, you must pay the costs of operating the network". Anyone who asks you to send crypto first, to "unlock", "verify" or "activate" an airdrop, is running a version of what ethereum.org calls the giveaway scam, in which you send coins on the promise of more coming back. Its verdict: "Giveaways are always scams."

Some legitimate routes do add conditions, and they are stated by the platform itself. Binance's HMSTR Launchpool required KYC identity verification and listed countries whose residents could not take part.

Step 7: Claim before the deadline

Claim windows close. Arbitrum's ran from 23 March to 24 September 2023, and its docs now say the token is no longer claimable. Note the claim period on the official page when you confirm eligibility, and distrust messages that invent a shorter one: MetaMask lists "time pressure with deadlines or cut-off dates" among the signs of a malicious approval request.

Step 8: Clean up afterwards

Approvals do not expire on their own. ethereum.org's guide to revoking token access says contract permissions "can be used, even years after they're granted", and that disconnecting your wallet from a site does not remove them. To review yours:

1. Open a revoke tool listed by ethereum.org, such as the Etherscan token approval checker or Revoke.cash.
2. Connect the wallet on the network you used for the claim: each tool shows only the contracts on the selected network.
3. Revoke any approval you do not recognise or no longer need, and pay the small fee the revoke transaction costs.
4. Refresh the tool after a few minutes to confirm the approval has gone.

If you signed something you should not have

Act quickly. ethereum.org's scam help page lists the first steps: move remaining funds to a new, secure wallet the scammer cannot access, revoke token approvals, change passwords on linked exchange accounts and turn on two-factor authentication. If you typed your seed phrase into a site, MetaMask's warning applies: the scammers then "have control over their entire wallet", so move to a new wallet with a new phrase.

Then report it: to the FBI's IC3 in the US, Action Fraud in the UK or Europol in the EU. Ignore anyone who offers to recover your funds for a fee; ethereum.org says that "no one can reverse blockchain transactions" and that such an offer "is almost certainly a second scam". Airdrop scams covers the common tricks in detail.

Key takeaways

• Find the claim link on the project's own site or docs, then type it or use a bookmark.
• Claim with a wallet that holds little, and never share or type your seed phrase.
• Read every approval: receiving an airdrop should not need access to all your tokens or NFTs.
• The only cost of a real claim is gas; sending crypto to unlock an airdrop is a scam.
• Revoke approvals after claiming, because they never expire on their own.