Fake airdrops are phishing campaigns dressed up as free tokens. The attacker gets you to connect your wallet to a lookalike site or sign a transaction, then uses an approval or a signature to move your assets. No exploit is needed. You authorize the theft yourself, often in under a minute. Here's how the tricks work and where they trip up.
How a fake airdrop actually reaches your wallet
The delivery is the easy part. Scammers spray worthless tokens into thousands of addresses and wait. Your wallet shows a balance you never earned, and curiosity does the rest. Some tokens even come with a name that mimics a real project, or a URL baked into the token symbol.
The bait shows up in three common forms:
- A random token appears in your wallet with no transaction from you.
- A direct message or reply claims you're eligible for a reward and links to a claim page.
- A cloned site mirrors a real project's design, sometimes on a nearly identical domain.
None of these require hacking your keys. They require you to act.
Wallet drain tricks hidden behind the "Claim" button
The approval trap
A drainer asks you to approve token spending rather than send a transaction. Approvals can be broad. Grant unlimited spending rights to a malicious contract and it can pull that token whenever it likes, long after you've closed the tab. Revoking later helps, but only if you notice.
The signature request
Some drainers don't ask for an approval at all. They ask you to sign a message. It looks harmless, like a login. A signature that authorizes a transfer or a permit can move funds without a visible gas fee, which makes it feel safer than it is.
Address poisoning and lookalike sends
A related trick plants a fake address in your transaction history that matches the first and last characters of an address you've used. Next time you copy from history, you might paste the attacker's. This one isn't strictly an airdrop, but it's often paired with the same fake-token noise.
A concrete scenario: the $40 claim that cost $12,000
Say a trader holds about $12,000 in a self-custody wallet. A token called something like "BNB Reward" shows up. The project site looks polished, the countdown timer is ticking, and the claim page asks to connect the wallet. Connection alone does nothing. Then comes the approval request: "Allow $BNB Reward to access your tokens." The trader approves, expecting a small gas fee, maybe $40 in total across a couple of steps.
The contract now has spending rights. Within minutes it sweeps the valuable tokens in that wallet. The $40 was never the cost. The cost was everything the approval touched.
That's the pattern to internalize: the fake reward is bait, and the approval is the hook.
Warning signs you can check before you click
On the site
Look at the domain character by character. Check whether the project has announced the airdrop on its own verified channels. A claim page that rushes you with a countdown is applying pressure on purpose.
In the wallet prompt
Read what you're actually approving. An approval that asks for unlimited spending on a token you don't recognize is a red flag. A signature request you don't understand is a stop sign. Your wallet is telling you what the contract wants. Most people never read it.
In your own habits
Use a separate wallet for experimenting with unknown tokens. Keep your main holdings in a wallet you don't connect to anything unfamiliar. That single habit caps the damage from any one mistake.
What to do if you've already approved something
Act fast. Open a reputable approval-revocation tool and revoke spending rights for any token or contract you don't recognize. Move remaining assets to a fresh wallet you control. If funds are already gone, report the addresses to the relevant exchange and block explorer, though recovery is unlikely.
For context on how exchanges handle suspicious tokens, Binance and other major platforms periodically flag or delist assets tied to scams. That helps the wider market, but it doesn't protect a self-custody wallet. Your approvals are yours to manage.
Frequently asked questions
Can a fake airdrop drain my wallet just by receiving the token?
No. Receiving a token doesn't give anyone access to your funds. The danger starts when you interact with a site or sign something. Ignoring an unexpected token is safe. Trying to sell or claim it is where people get hurt.
Is revoking approvals enough after I connect to a drainer?
Connecting alone usually doesn't move funds, but any approval or signature you granted does. Revoke all unfamiliar approvals and consider moving assets to a new wallet. If you signed a permit-style message, treat the wallet as compromised and migrate.
Do hardware wallets protect against drainers?
They help, because you see and confirm the transaction on a separate screen. But a drainer can still trick you into approving a malicious contract if you don't read the details. The device confirms what you tell it to confirm. Your judgment is still the last line of defense.
How do I tell a real airdrop from a fake one?
Check the project's official channels for an announcement, verify the exact domain, and be suspicious of any claim that requires an approval or signature you don't understand. Real projects rarely need unlimited spending rights to hand you tokens.
Before your next claim, open your wallet's approval list and revoke anything you don't recognize. That five-minute habit is worth more than any airdrop.