What is a crypto airdrop scam?

A fake airdrop scam sends free tokens to your wallet address, then directs you to a website to 'claim' them. The claim process requires you to sign a malicious approval transaction that gives the attacker's contract access to your real tokens or NFTs.

Can simply receiving airdropped tokens harm me?

Receiving tokens passively in your wallet is harmless — tokens cannot steal from you just by being there. The risk occurs only when you interact with those tokens: visiting a claim site, approving transactions, or interacting with a malicious contract.

How do I check if an airdrop is legitimate?

Check the project's official website and social channels for any announcement of an airdrop. Cross-reference on CoinGecko or CoinMarketCap. Search the token contract on Etherscan and check how many addresses received it. A token sent to millions of random wallets with no official announcement is almost certainly a scam.

What should I do if I already visited a fake airdrop site?

If you only visited the site but did not sign any transaction, you are likely unharmed. If you signed a transaction, immediately check your approvals on Etherscan's token approval checker or Revoke.cash and revoke any suspicious approvals. If funds have already been drained, unfortunately they are not recoverable.

Security · Scams

Fake Airdrop Scams Explained

You received tokens you didn't ask for. There is now a website telling you to claim more. Here is exactly what's about to happen if you interact with it — and how to protect yourself.

By Ashir Khan3 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated: September 1, 2026

How fake airdrop scams work

Step 1: The attacker sends a small amount of worthless tokens to thousands of wallet addresses. These tokens often have names designed to look like legitimate projects ("Uniswap V4 Reward", "ETH2 Bonus", etc.).

Step 2: The token contract has a function that, when queried, returns a URL pointing to a "claim" website. Your wallet or Etherscan may display this URL when you view the token.

Step 3: The claim website looks professional and shows you a large reward to claim. Clicking "Claim" prompts you to sign an ERC-20 token approval — not a claim transaction, but a permission for the attacker's contract to spend your real tokens.

Step 4: Once signed, the attacker drains your real valuable tokens (USDC, WETH, etc.) immediately. The "free tokens" you were going to claim were worth nothing; your real tokens are now gone.

Dust attacks: the related threat

A "dust attack" sends tiny amounts of real cryptocurrency (a few satoshis or wei) to your wallet to de-anonymise it. The attacker then tracks all transactions involving your address to identify you. No immediate theft occurs, but your on-chain privacy is reduced.

Best practice: do not interact with small, unexpected token or coin amounts in your wallet. You can simply ignore them — receiving tokens passively cannot harm you.

How to verify if an airdrop is real

Check the project's official website for any airdrop announcement
Search the project name on Twitter/X and look for a verified account announcement
Look up the token contract on Etherscan — check how many addresses received it and when
Check CoinGecko for the token — legitimate airdropped tokens are usually listed
Never visit claim sites found via token contract URLs or unsolicited DMs

Legitimate airdrops from major protocols (Uniswap, Arbitrum, dYdX) are always announced publicly and well in advance. You will hear about them through official channels, not a random token appearing in your wallet.

Airdrop red flags

Token you never interacted with appeared in your wallet
Token has a URL in its name or contract
Claim site requires connecting your wallet and signing an approval
Claim site shows an unusually large reward with urgency pressure
No official announcement from a verifiable project Twitter/X account