Airdrop phishing works at one moment: the wallet asks you to sign, and you confirm. Scam Sniffer counted $83.85 million lost to crypto phishing across 106,106 victims in 2025. This guide gives five checks to run before you sign a claim, three worked wallet prompts, and the steps to take afterwards.
The link comes from the project docs or its verified account.
Compare it character by character, then run the link checker.
Clean browser profile, the eligible address, hardware device if it holds the key.
Sign-in message, claim transaction, or an approval you did not expect.
Review approvals and revoke what you no longer use.
Start from the project, not from a link
A real claim link comes from the project itself: its documentation, its pinned post on a verified account, or its own website. A link in a reply, a direct message or a search ad does not count, however polished the page looks. MetaMask describes the common trap as unexpected tokens in your wallet, plus an error message that sends you to a third-party site to claim.
Write the domain down from the official source, then type it or bookmark it. Compare it character by character: look for a swapped letter, an extra word such as "rewards", or a different ending after the dot. Paste the full link into our claim link checker as a second opinion. It is a check, not a guarantee.
Some projects have no separate claim site at all. Our Grass page records that the Stage 2 claim runs only through the wallet in the Grass dashboard. When a project says that, any other claim URL is wrong by definition. The same page lists a deadline of January 22, 2027, so nothing forces you to claim in the first hour.
Leave unsolicited tokens alone. MetaMask advises hiding them and ignoring the site they point to, because tokens can be faked and the site is the trap. No claim ever needs your recovery phrase.
Read the prompt: signature or transaction
A wallet asks for two kinds of confirmation. A transaction is sent to the network and recorded on the blockchain. MetaMask's help center says messages, by contrast, are generally not published. That is why a signature feels harmless, even though a signed message can carry real permissions.
EIP-712, the standard for typed data, exists so wallets can show readable fields instead of raw hex. EIP-2612 uses it for Permit: the holder signs an owner, a spender, a value, a nonce and a deadline. Anyone can submit that signature later to set the allowance, and the holder pays no gas for the permit itself.
| Prompt | On-chain when you confirm? | What it can do | What to check |
|---|---|---|---|
| Sign-in message | No | Proves you control the address | Names the site you are on; lists no token, spender or amount |
| Permit or Permit2 signature | No, until someone submits it | Sets a token allowance for a spender | Owner, spender, value, nonce, deadline; any spender you cannot identify |
| Approve transaction | Yes | Lets a contract spend one token up to a cap | Spender address and the spending cap |
| Approve-all for NFTs | Yes | Lets one address move every item in a collection | Marketplaces use it; a token claim does not need it |
| Claim transaction | Yes | Calls the airdrop contract and sends tokens to you | Contract address matches the project docs; no approval requested |
Uniswap's Permit2 extends the idea to any token. First you give the Permit2 contract a one-time approval on each token, typically for the maximum amount. Later signatures then set narrower allowances beneath it. Revoke.cash notes that one Permit2 signature can cover several tokens, which makes the prompt harder to judge.
Wallets add help, but not certainty. MetaMask turns security alerts on by default and labels risky requests Warning or Malicious, yet it says you can still confirm after a warning. Its balance preview covers contract interactions, and its help page cautions that an off-chain simulation can differ from what runs on-chain.
Why approve-all and Permit signatures cause the large losses
A token approval lets a contract spend a token from your wallet without asking again. MetaMask says many legitimate apps request unlimited amounts so you approve less often, and that this is also how many malicious sites steal. ethereum.org adds that approvals have no expiry date and that disconnecting a wallet does not remove them.
For NFTs, the approve-all call (setApprovalForAll) lets one address move every item in a collection. Revoke.cash says most marketplaces use it, because a limited approval would allow only one address at a time. MetaMask describes fake marketplaces that ask for a signature to list a whole collection, which hands an attacker authority over every item.
Scam Sniffer's 2025 report shows where the large losses came from. Permit and Permit2 signatures accounted for $8.72 million across three cases above $1 million, about 38 percent of those losses. Approvals added $5.62 million, plain transfers $4.87 million, EIP-7702 batches $2.54 million and approve-all calls $1.23 million. The largest single theft of the year, $6.5 million, used a Permit signature in September.
Total losses fell 83 percent from 2024's $494 million, but Scam Sniffer cautions that lower tracked losses do not mean the threat is gone. Drainers may have shifted to methods that are harder to detect.
Permits are hard to catch for a further reason. Revoke.cash says many wallets warn you when you sign an on-chain approval, but those warnings are absent for Permit signatures. MetaMask adds that signing is not recorded on-chain, so an attacker can wait weeks before using it.
Set up the claim: browser profile, wallet and hardware device
Eligibility is tied to an address, so you usually cannot choose a new wallet for the claim itself. Check the project's documentation for whether another recipient is allowed, and do not assume it is. What you control is everything around the claim.
Use a separate browser profile with one wallet extension and nothing else installed. Open the claim page from your bookmark, connect, sign, and close the profile afterwards. That keeps unrelated wallets and sessions out of the picture.
Treat a fresh wallet as the destination. Create a new address with its own recovery phrase, and send the claimed tokens there once any lockup allows. Use it too for the first contact with any new staking or swap page, starting with a small amount. Our farming guide describes the three-wallet split in detail.
If the eligible address lives on a hardware wallet, keep it there and sign on the device. ethereum.org says hardware wallets keep private keys offline. Ledger says its Clear Signing shows the recipient, amount and action on the device screen, and that blind signing means approving data you cannot read. If the screen shows only a hash, stop. A hardware wallet protects the key, not the decision, so it will sign a bad Permit if you confirm it.
Three prompts, step by step
Example 1: the sign-in message. You click Connect on the claim page you bookmarked, and the wallet opens a signature request.
- Read the site name at the top of the request and confirm it matches your bookmark.
- Read the message. A sign-in text names the site and lists no token, spender or amount.
- If you see owner, spender or value fields, it is a Permit and not a sign-in. Reject it.
Example 2: the claim transaction. You click Claim, and the wallet opens a transaction instead of a signature.
- Compare the contract address the wallet shows with the address in the project's documentation.
- Read the balance preview if one appears. Expect tokens to arrive and nothing to leave except the network fee.
- Treat a Warning or Malicious label as a stop until you know why it appeared.
Example 3: the approval you did not expect. Mid-claim, the wallet shows a spending cap request for one of your tokens, or a typed-data request that lists a spender.
- Stop. A claim sends tokens to you, so it has no reason to ask permission to move tokens you already hold.
- If the request is legitimate, MetaMask's cap screen lets you enter a custom amount instead of Max or the site's suggestion.
- Look up the spender address on a block explorer. A contract you cannot identify is a reason to reject.
- If the page keeps asking after you reject, close the tab and do not retry there.
After you claim, and if you signed something bad
Check approvals on the address you used. The Etherscan token approvals checker lists them by token type (ERC-20, ERC-721, ERC-1155) and shows a value at risk for each. Revoke.cash lets you paste an address or ENS name, choose a network, sort newest first, then revoke an approval or edit its amount.
Revoking is an on-chain transaction, so you pay network gas. Revoke.cash's FAQ says single revokes cost only gas, while its batch revoke carries a $1.50 fee for free users. ethereum.org says revoking does not affect staked or lent positions. MetaMask suggests a monthly check.
Solana works differently. A token account holds one delegate and one allowance at a time, and approving a new delegate replaces the old one, Solana's documentation says. Revoke.cash's FAQ lists only EVM networks. We did not verify a Solana approval checker today, so we name none.
If you think you signed something bad, speed matters more than diagnosis. Move the highest-value tokens to a new wallet with a new recovery phrase, then revoke approvals on the old address. If the phrase itself was exposed, treat that wallet as burned, and MetaMask advises against sending it more ETH for gas while a sweeper script is active. Revoke.cash says to revoke even when you are too late to stop the theft, so nothing more can be taken.
MetaMask says transactions cannot be reversed and it cannot recover funds. It does recommend reporting the scammer's address to MetaMask Support and flagging it on Etherscan. It also lists cybercrime agencies, such as the FBI's IC3 in the US, for a formal report.
Expect offers of help. ethereum.org warns about impersonators who promise to return lost ETH in exchange for your private keys, and it states that there is no official Ethereum support desk. The FTC says no legitimate business demands cryptocurrency in advance. Anyone who contacts you first to recover funds, asks for a recovery phrase or wants a fee up front is running the next scam. For the wider catalogue of tricks, see our guide to spotting airdrop scams.
