Disclosure: I wrote this article as an entry for the AirdropBuzz creator campaign. I was not paid by any project mentioned here, I hold none of the tokens discussed, and every statistic below is quoted from the public report linked in the sources.

The page looks perfect. The logo is right, the countdown is ticking, and the button says "Claim". Then the wallet opens and asks you to sign something you do not recognise. That moment — not the page, not the tweet, not the countdown — is where a fake airdrop either works or fails.

The numbers explain why the attackers keep building these pages. Scam Sniffer's 2024 report found that wallet drainers stole roughly $494 million across about 332,000 victim addresses, a 67% increase in losses year over year, with the largest single theft at $55.48 million. Chainalysis put total on-chain scam revenue in 2025 at at least $14 billion, possibly $17 billion once more addresses are attributed — investment scams were the dominant category, and approval phishing is one of the ways they play out on-chain. The drainer numbers show how the loss happens at the wallet: not from someone voluntarily sending coins to a stranger, but from a signature that looked like a claim.

Here are the seven checks I run before I connect a wallet to anything that promises free tokens.

1. Check where the link came from, not what the page says

The first question is not "is this airdrop real?" It is "did this URL come from the project itself?" Open the project's official documentation, GitHub organisation, or verified social account and follow the claim link from there. Do not use a link from a DM, a Telegram forward, a comment, or a sponsored post.

Look at the domain character by character. Drainer operators register lookalikes that swap an l for an I, add a hyphen, or use a different top-level domain. A page that is pixel-identical to the real one costs them almost nothing to build. The domain is the part they cannot copy.

If the claim is framed as urgent — "last 30 minutes", "first 5,000 wallets only" — treat that as a design choice aimed at stopping you from doing this check.

2. Separate connect, sign, approve, and send

Four different actions look similar in a wallet, and only one of them is usually safe:

  • Connect shares your public address. It does not move funds.
  • Sign a message is off-chain and costs no gas — but it can still grant spending rights, which is the trap in check 3.
  • Approve gives a contract permission to move a specific token up to a limit.
  • Send transfers the asset immediately.

A real claim should be one transaction to a claim contract, or a signature that grants nothing. It should never ask for your seed phrase, and it should never ask you to type your recovery words into a "wallet validation" box. No legitimate project needs them. Ever.

3. Read the wallet prompt, not the website

The website can say "Claim" while the wallet says Approve. The wallet is the source of truth. Before you confirm, read three things: the function name, the spender address, and the amount.

Functions worth stopping on: approve, increaseAllowance, setApprovalForAll, setOwner, and permit. A plain transfer or transferFrom to an address you do not recognise is also a stop. If the page says "claim" and the wallet says approve, close the tab.

The permit signature deserves its own warning. EIP-2612 lets a token holder grant an allowance with an off-chain signature instead of a transaction. That is useful for legitimate apps, and it is also why a "gasless" claim can drain a wallet without the victim ever sending a transaction. In Scam Sniffer's large-loss cases, Permit accounted for 56.7% of losses by signature type, ahead of setOwner at 31.9%, Transfer at 4.5%, and increaseAllowance at 3.5%.

4. Check whether the allowance is bounded

An approval is a limit, and the limit matters. Unlimited approval — usually 2^256 - 1 — gives the spender access to that token balance now and in the future. A bounded approval for the exact amount you intend to move is safer.

For NFTs, setApprovalForAll is the equivalent of handing over the whole collection, not one token. If a claim page asks for that, ask why a claim needs collection-wide rights.

The safest claim contracts do not need an approval at all. They check eligibility and send the token in one transaction. If a site insists on an approval first, set the smallest amount that works and revoke it afterwards.

5. Verify the full address, not the first and last characters

Address poisoning does not need a malicious contract. It needs you to copy the wrong address from your own transaction history. The attacker sends a tiny amount of dust from an address that starts and ends with the same characters as one you use often. That lookalike now appears in your history, and the next time you copy "your" address, you may copy theirs.

Chainalysis documented a May 2024 case where an address poisoning attack nearly cost a whale $68 million in wrapped bitcoin, and identified 82,031 seeded addresses traced to a network of eight seeder wallets in one campaign. The defence is mechanical: copy addresses from a saved address book, not from a transaction list, and compare the full string before sending. First and last four characters are not enough.

6. Treat "gasless claim" as a warning, not a feature

"We pay the gas" sounds generous. Ask what you are signing so that someone else can pay it. In practice, a gasless claim often means a permit signature: you are not sending a transaction, you are granting permission, and the attacker submits the transaction that uses it.

There is a legitimate version — a project sponsoring a claim transaction — but you should still see a transaction in your wallet that calls a known contract. If the only thing you sign is an off-chain message, and the site calls that a claim, stop.

The same rule applies to "activation". No real airdrop requires you to send tokens to a contract or wallet before you can receive tokens. That pattern is a honeypot, not a claim.

7. Verify after the claim, then revoke

Once the claim is done, check what permissions remain. MetaMask Portfolio shows spending caps and lets you revoke them on Ethereum, Polygon, BNB Chain, Optimism, and Base. Revoke.cash is a wallet-agnostic alternative. Revoke anything you do not expect to use again, and revoke the whole approval rather than reducing it if the site offers both.

Use a separate wallet for claims. Keep only what you would accept losing in it, and never connect the wallet that holds your savings. If you have to interact with an unfamiliar contract, test with a small amount first, confirm the result, and only then decide whether to continue.

What a real claim looks like

A legitimate claim usually passes all five of these:

  • It is announced on the project's own domain and at least one other official channel.
  • It is one transaction to a contract address you can match to the project's documentation.
  • It never asks for a seed phrase, an off-chain "validation" signature, or a token transfer to "activate" anything.
  • The wallet prompt names a function you can explain in plain language.
  • Any approval it needs is bounded, and you revoke it when you are done.

If a claim fails one of these, it does not automatically mean the project is a scam — but it does mean you should stop and find out why before you sign.

The one-sentence test

Before any signature, try to finish this sentence: "This transaction calls this contract and does this one thing, and the worst case is this specific loss." If you cannot fill in all three parts, you are guessing, and guessing is the attack surface.

A missed airdrop costs you nothing. A signed permit can cost you the wallet. The routine above is slower than clicking "Claim", which is exactly why it works.

Sources