Fake Airdrop: How to Spot an Airdrop Scam and Verify a Claim Link

A fake airdrop is the most widespread type of scam in crypto, because it exploits exactly what a participant is already waiting for: a claim link. An airdrop scam does not hack your wallet; it convinces you to sign a transaction that hands over your tokens yourself. To answer the question «is this airdrop real?», you need to understand how the scheme works, which signs give away a fake, and which signature is actually dangerous.

This article describes common scam schemes and verification methods, but it cannot cover every variant. The absence of the listed signs does not prove that a site is legitimate. This is not financial or legal advice.

How a claim scam works

The scheme is built on three elements: anticipation, urgency and a signature. The scammer knows that a project has confirmed a token, or that rumors are circulating, and builds a site that looks like the official claim interface. The link spreads through phishing accounts on social media, replies under official posts, hacked Discord servers, search ads and direct messages.

From there, one of three scenarios follows. First: the site asks you to «verify your wallet» by entering the seed phrase — that is outright theft. Second: the site asks you to sign a transaction that looks like a claim but actually grants the scammer's contract an approval over your tokens — a drainer then withdraws everything it gained access to. Third: the site asks you to pay «gas» or a «verification fee» to an address — the money simply leaves.

What all variants share: the initiative comes from you. The wallet executes what you signed, and once executed it cannot be undone.

Signs of a fake site

Lookalike domain. Swapped letters (rn instead of m, l instead of I), an extra hyphen, a different zone (.io instead of .xyz), a subdomain on someone else's domain (project.claim-portal.com). Check the exact spelling, not the general impression.
Urgency. «Claim closes in 2 hours», a countdown, «340 allocations left». Real claim windows last weeks and are announced in advance.
A request for the seed phrase or private key. Under any pretext: «sync», «verification», «restore access». This is always a scam.
A claim before the official announcement. If the project is in Confirmed or Verification status and «the claim is already open», it is fake. The order of statuses and what happens at each is in the article on airdrop statuses.
An allocation without a check. The site shows «1,250 tokens available» to any connected address, including empty ones.
A link from an unreliable channel. A direct message, a comment, a search ad, a fresh account with a checkmark. Official links do not arrive in DMs.
No footprint. The domain was registered days ago, the site has no link to documentation, the social links lead to unrelated or empty accounts.

How to verify the official link

The principle: a link counts as verified when it is confirmed by at least two independent official sources. A single source can be compromised — Discord servers and social accounts get hacked regularly.

Official site and documentation. Open the project's site at an address you have known for a long time or that is listed in the docs. The claim section should be announced there.
Verified social accounts. Check that the claim post is a pinned or recent post from the official account, not a reply under it. Note the account's creation date and follower count.
Cross-check. The link on the site, in the docs and on social media must match character for character.
Contract check. If the project has published the claim contract address, compare it with the one the site calls. The explorer shows whether the code is verified and who deployed it.
Type the address by hand. Do not follow links from messages — enter the address manually or from a bookmark.

If even one step fails, the link is not verified. Waiting costs nothing in that case: a real claim is not going anywhere.

Why a signature on a fake is dangerous

Not every signature is equally dangerous, and knowing the difference is useful. A sign-in message signature without a transaction is usually harmless if the text grants no powers. The dangerous signatures are those that give a contract rights over your assets:

approve. Allows a contract to move the specified amount of a token. Fake sites request an unlimited amount — after that, the contract can withdraw the entire token balance at any moment.
permit / permit2. The same approval, but granted via an off-chain signature, with no transaction and no gas. It looks harmless because «nothing was sent», but the result is the same.
setApprovalForAll. Approval over every NFT of a collection on the address. One signature — the whole collection belongs to the scammer.
A direct transfer. A transaction disguised as a claim that sends ETH or tokens to the scammer's address.

A practical rule: a real claim is a transaction that calls a claim function on the project's contract, and it contains no approve or permit on your existing tokens. If the wallet shows that you are granting an approval or signing a message with an amount and a recipient address, that is not a claim. Wallets with transaction simulation show what will change in your balance, and that is worth reading every single time.

If you have already connected your wallet

Connecting on its own does not give a site rights over your assets — it only reveals your address. The danger begins with a signature. The steps depend on what you have already done:

Only connected, signed nothing. Disconnect the site in your wallet settings. No damage.
Signed an approve, permit or setApprovalForAll. Revoke the approval immediately — through an explorer or a revocation service. Every minute matters: drainers run automatically. How to do it is in the article on revoking token approvals.
Entered the seed phrase. Revoking will not help: the scammer controls the entire wallet. Create a new wallet with a new seed and move everything that is left, starting with the most valuable. The old address is considered lost.
Funds already withdrawn. Recovering them is technically impossible. It makes sense to record the transaction hashes and the recipient address — for reporting to the project, to platforms that label addresses, and, where applicable, to law enforcement.

The best defense is an architecture in which a mistake has a limited cost: a separate wallet for airdrop activity with a minimal balance, as described in the article on wallet setup. Then even a successful phishing attempt never reaches your main funds. CoinDropster tracks official project statuses, including the move to Reward available, from primary sources. See tracked airdrops →