Fake Airdrop/Giveaway Scam¶
A fake airdrop offers free tokens for a wallet connection, a signature, or a small fee. The promised tokens are bait, the signature or approval can move what you already hold, and refusing any claim that asks for more than a public address defeats it.
Who this is for¶
Anyone who follows token launches, giveaway posts, or reward links, and anyone who has been tagged in a "claim your tokens" message.
How the scam works¶
The offer is built to look like news. A post announces a giveaway for a launch, a milestone, or an event, with a countdown, a claim counter, and screenshots of other people "receiving" tokens. It often impersonates a project, an exchange, or a person with followers.
The claim page connects to your wallet. Then it asks for one of three things: a signature to prove ownership, an approval to enable the token, or a gas fee sent to an address. The first two can be enough to empty the account, and the third is a direct payment with no token behind it.
A signature is enough because it can authorize a spender or a delegation without creating a transaction. You see a message, not a transfer, and the wallet may render it as harmless text. An approval works at a slower pace: the attacker can move the tokens later, when you are not watching.
Some campaigns skip the site and send the token itself, then wait for you to interact with it. Others ask you to activate the reward by holding a balance or sending funds first. A real distribution does not need your money, and it does not need permission to move assets you already own.
Warning signs¶
- You must connect, sign, approve, or pay before anything is received.
- The reward is large, the effort is small, and a timer is running.
- The account is new, replies are restricted, and the link is a shortener or a lookalike domain.
- The claim page asks you to import a wallet or type a recovery phrase.
- The project's official channels do not mention the campaign.
- You are asked to send a small amount first to "verify" or "activate" the wallet.
If it happens to you¶
- Reject the pending request in your wallet and close the page.
- If you signed or approved, revoke the approval and move the remaining assets to a new wallet.
- Do not pay a gas fee, deposit, or activation charge to release a reward.
- Record the domain and the addresses involved, and report them to your wallet vendor and to the project being impersonated.
- Keep an eye on the address; an approval can be used weeks later.
Next steps¶
- DApp Approval Scam — why an approval outlives the site that asked for it.
- Fake Token Scam — tokens that exist only to be interacted with.
- About Approve — what an approval actually authorizes.
Self-check¶
- Do I know that receiving a token never requires a fee or a signature?
- Can I tell a signature request from a transaction request in my wallet?
- Do I check a project's official channel before I trust a giveaway?
- Would I refuse a claim that asks me to approve an unlimited amount?