Fake Crypto Airdrops and Claim Sites: How to Recognize Them
Fake crypto airdrops lure you to claim sites that drain your wallet. Learn how real airdrops work, the tells of a fake, and what to do with surprise tokens.
Key takeaways
- Real airdrops are announced on a project's official channels. Tokens or links that arrive unannounced are bait, not gifts.
- Claiming new tokens should never require permission to spend tokens you already hold. An approval on a claim page is a stop sign.
- In the example, a claim site demanded 0.08 ETH ($200) as a fee; the real network fee was about $3.75, roughly 53 times less.
- Never enter your recovery phrase to verify eligibility. No legitimate service, support agent or website will ever ask for it.
On this page
- How real airdrops work
- How fake airdrop scams work
- What a claim site is really asking you to sign
- The fee math that gives fakes away
- Surprise tokens in your wallet: leave them alone
- A three-question check before you claim anything
- Common mistakes that turn a fake airdrop into a loss
- If you already connected or signed
- The bottom line
- Frequently asked questions
- Sources
How real airdrops work
An airdrop is a distribution of tokens to a set of eligible wallet addresses, often to reward early users of a project. Some tokens arrive in your wallet automatically. Others must be claimed on the project’s website with an on-chain transaction, for which you pay the ordinary network fee.
Real airdrops share a few traits. The rules, dates and claim address are published in advance on the project’s official channels. Claiming costs only the network fee. And nothing in the process involves your recovery phrase.
Real allocations often come with lockups and vesting schedules too, which our guide to airdrop allocations and vesting explains.
How fake airdrop scams work
Fake airdrops copy the excitement of the real thing and skip the substance. ethereum.org describes the classic version: a scam project sends a token or NFT to your wallet and directs you to a website to claim it. The site prompts you to connect your wallet and approve a transaction, or in another variation, to confirm a transaction that sends funds straight to the scammer.
Other versions arrive through replies under real announcements, lookalike social accounts, DMs and paid search results. The FBI has warned that criminals buy search ads using domains similar to real businesses and have used them to impersonate cryptocurrency platforms. These pages are often wired to wallet-draining tools, as described in how crypto drainers steal funds.
What a claim site is really asking you to sign
The danger is rarely the token you are promised. It is the permission you give while “claiming” it. Here is how common requests translate, using the definitions in the token standards themselves.
| Request on the claim page | What it actually does | Verdict |
|---|---|---|
| Approve (ERC-20) for a token you already own | “Allows _spender to withdraw from your account multiple times, up to the _value amount” | Stop |
| Set approval for all (ERC-721 NFTs) | Lets an “operator” manage all of your NFTs in that collection | Stop |
| A signature naming a spender, amount and deadline | A gasless approval that can be used later | Stop unless verified |
| A transaction that sends ETH or tokens to an address | A payment, whatever the button says | Stop |
| Your recovery phrase “to verify eligibility” | Hands over your entire wallet | Always a scam |
| A claim transaction on the verified official domain | Transfers the new tokens to you | Normal, after checks |
One rule covers most of the table: claiming tokens you are receiving should never require permission to spend tokens you already hold. If a claim page asks for an approval over your existing tokens or NFTs, close it.
The fee math that gives fakes away
Many fake sites ask for a “claim fee”, “gas deposit” or “activation charge” before your free tokens are released. Compare that with what the network actually charges.
Example: A site says you are eligible for 2,500 Token X, “worth $3,750”, and asks you to send 0.08 ETH to cover gas. Suppose a real claim transaction uses about 150,000 gas, the base fee is 9 gwei with a 1 gwei priority fee, and ETH is $2,500 (all hypothetical figures).
The real network cost would be 150,000 × 10 gwei = 1,500,000 gwei, or 0.0015 ETH, about $3.75. The site’s 0.08 ETH is $200, roughly 53 times more. More importantly, it goes to an address the scammer controls instead of being paid to the network as part of a transaction.
That gives you a clear test. Real gas is shown by your wallet inside the transaction you are signing. Any request to send a separate payment first is a scam, whatever it is called. You can sanity-check a claimed fee with our gas fee calculator.
| Real airdrop | Fake claim site | |
|---|---|---|
| How you hear about it | Project's official channels | DMs, replies, ads, odd tokens |
| What you pay | Network fee inside the claim | A fee sent to an address |
| What you sign | A claim transaction | Approvals for tokens you own |
| Recovery phrase | Never requested | Asked for to verify wallet |
| Deadline | Published in advance | Minutes left, act now |
Surprise tokens in your wallet: leave them alone
If tokens you never asked for appear in your wallet, especially with a web address or “claim” message in the token name, treat them as bait.
- Don’t visit the address in the token’s name or description.
- Don’t try to sell or swap them. Doing so can require approving a contract you know nothing about.
- Hide them if your wallet allows it, and move on.
A related trick sends tiny or zero-value transfers from lookalike addresses so a fake address appears in your history. That one is covered in address poisoning scams.
A three-question check before you claim anything
- Did I find this myself? The announcement should come from the project’s official channels that you reached independently, not from a DM, a reply, an ad or a surprise token.
- Is the domain exact? Type or bookmark the official address and compare the claim page character by character.
- Is it asking only for a claim? No recovery phrase, no payment to an address, no approval over tokens you already hold, no countdown pressure.
If any answer is no, walk away. For extra safety, claim with a separate wallet that holds nothing else, so a mistake can’t reach your main holdings. The same logic runs through all of the flags in how to spot a crypto scam.
Common mistakes that turn a fake airdrop into a loss
- Trusting the dollar value in your wallet. A price shown next to an unknown token proves nothing; prices for obscure tokens can be thin or manipulated.
- Trusting the top search result. Paid ads can sit above the real site, which is exactly the tactic the FBI warned about.
- Retrying after a “failed” claim. A page that says the claim failed and asks you to approve something different is escalating, not fixing a bug.
- Claiming from your main wallet. One bad signature can reach everything that wallet holds.
- Racing a countdown. Real claim windows are usually announced well ahead; a timer measured in minutes is there to stop you thinking.
If you already connected or signed
- Connected only: connecting usually shares just your public address. Disconnect the site and watch for strange requests.
- Signed or approved something: revoke the permissions from a trusted device using the steps in how to review and revoke token approvals, and move valuable assets to a fresh wallet if you are unsure what you approved.
- Entered your recovery phrase: the wallet is compromised. Create a new wallet with a new phrase on a trusted device and move everything immediately. Our guide to seed phrase security explains how to store the new one.
Then report the site and the addresses involved to your national fraud reporting service, and warn others in the project’s official community.
The bottom line
Real airdrops are announced in advance, cost only the network fee and never touch your recovery phrase or your existing tokens. Fake ones arrive unannounced, push urgency and ask for approvals, payments or secrets. When a free token asks for anything more than a plain claim transaction on a verified domain, close the page.
Frequently asked questions
How do I know if a crypto airdrop is real?
Start from sources you already trust, not from the message that told you about it. Check the project's official website and announcement channels, reached through addresses you typed or bookmarked earlier, and confirm the claim page's domain matches exactly. A real claim costs only the network fee inside the claim transaction and never asks for your recovery phrase, a payment to an address, or approval to spend tokens you already hold.
Is it safe to sell random tokens that appeared in my wallet?
It is safest to leave them alone. Unexpected tokens, especially ones with a website address in their name, are often bait meant to send you to a malicious site. Trying to sell or swap them can mean approving a contract you know nothing about. Most wallets let you hide unknown tokens. Don't visit any address in the token name, and don't interact with the token contract.
Do real airdrops charge a fee to claim?
A real claim usually requires an on-chain transaction, so you pay the ordinary network fee, which your wallet shows as part of that transaction. What a real project won't do is ask you to send ETH or tokens to an address first, pay a processing charge, or cover a tax before release. A separate payment to unlock free tokens is the signature move of a fake claim site.
What should I do if I connected my wallet to a fake airdrop site?
Connecting alone usually shares only your public address, but anything you signed or approved may give the site power over your tokens. Review and revoke approvals from a trusted device, and move valuable assets to a fresh wallet if you are unsure what you signed. If you typed your recovery phrase into the site, treat the whole wallet as compromised and move everything to a new wallet with a new phrase immediately.
Sources
- Ethereum security and scam prevention (Airdrop scams) — ethereum.org
- ERC-20: Token Standard — Ethereum Improvement Proposals
- ERC-721: Non-Fungible Token Standard — Ethereum Improvement Proposals
- ERC-2612: Permit extension for EIP-20 signed approvals — Ethereum Improvement Proposals
- Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users (PSA, December 21, 2022) — FBI Internet Crime Complaint Center (IC3)
This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.