Every airdrop scam asks for one of two things. It wants a payment before you receive tokens, or it wants a signature that gives a contract control of your tokens. A real airdrop can cost network gas, but it never costs a fee paid to the project, and it never needs your recovery phrase.
The two asks behind every scam
Strip away the branding and the request is always one of these.
An unlock fee, a verification deposit or refundable gas. A real airdrop never needs funds sent to the project.
A recovery phrase request, or an approval or permit that lets a hostile contract move your tokens.
Gas and fees are easy to confuse. Gas is the network charge your wallet shows in its own fee line when you confirm a transaction. A scam fee asks you to send tokens to an address you must copy or type. The first is normal on a claim you start yourself, and the second is the first ask.
The second ask is now far more common than the first, and it often looks like routine wallet traffic. ScamSniffer, a phishing-tracking firm, counted nearly $295 million stolen from about 324,000 victims in 2023, $494 million from 332,000 addresses in 2024 and $83.85 million from 106,106 victims in 2025. The 2025 figure is lower, and the firm warns that lower losses do not mean the threat has gone.
Other counters use other definitions. Chainalysis put personal wallet compromises at about $713 million in 2025, spread over at least 80,000 victims. The FBI logged 181,565 crypto-related complaints and $11.366 billion in reported losses in 2025, most of it investment fraud and not wallet drainers.
Fake pages look polished because drainer kits are sold as a service. ScamSniffer's 2023 report ranked Inferno Drainer first, with $81 million taken from 134,000 victims. It estimated that the people selling kits earned at least $47 million under a 20 percent fee model. A scammer with a professional template and a paid ad has the same tools as the real project, so a polished page proves nothing.
What a signature request is asking
A transaction shows up in your history. A permit signature does not. Revoke.cash explains that a permit is an off-chain message naming a spender and an amount, so a scammer can activate it later with no gas cost to you. Victims may believe they are signing in to a website. This table sets out the requests you will meet, with the largest ScamSniffer cases from 2025.
| Request | What it grants | What you see | 2025 cases above $1M |
|---|---|---|---|
| Approve or increaseAllowance | A spender contract may move up to a set amount of one token, often unlimited | A transaction naming the token, spender and amount | 3 cases, $5.62M |
| setApprovalForAll | Every NFT in one collection | A transaction | 1 case, $1.23M |
| Permit or Permit2 signature | A signed message the attacker submits later, with spender, amount and expiry | A signature request, no transaction until it is used | 3 cases, $8.72M |
| Plain transfer | Sends the tokens right now | A transaction | 2 cases, $4.87M |
| EIP-7702 batch | Bundles several operations behind one authorization | An authorization request | 2 cases, $2.54M |
The 2024 report points the same way. ScamSniffer found 30 cases above $1 million, worth $171 million in total, and Permit signatures made up 56.7 percent of them.
ScamSniffer also saw a new pattern in 2025: EIP-7702 batch attacks, which bundle several malicious operations, appeared shortly after the Pectra upgrade.
Read the spender and the amount before you sign, and decline anything you cannot explain. If a site wants an unlimited approval for a one-time claim, that is a warning in itself. Our farming guide shows how to audit and revoke approvals.
Five packages scams arrive in
The fake claim site. A clone of a real project's page, reached through an ad, a reply or a direct message. It appears within hours of any real announcement. Reach claims through the project's verified account or documented domain, typed or bookmarked.
The recycled or premature claim. Claim windows are real and they end. Arbitrum's closed on September 24, 2023, and Monad's closed on November 3, 2025, so a page offering either today is recycling a finished event. The opposite trick targets drops with no date. OpenSea postponed its SEA launch in March 2026 and has set no new date, so any link saying the claim is live is false until OpenSea says otherwise. Polymarket has published no criteria either.
The mystery token. Unknown tokens show up in your wallet. Trezor describes dusting attacks, where worthless tokens are sent to track users. Revoke.cash describes address poisoning, where scammers send fake tokens or zero-value transfers from an address that resembles one you use, hoping you copy it from your history later. Hide the token, ignore it, and take addresses from the official source and not from your history.
The support desk. You complain in public and a helpful stranger writes to you. Trezor's rule is that any request for your wallet backup, PIN, passwords or codes is always a scam, and Ledger says it will never ask for your phrase. Trezor also lists fake notices claiming a device will be deactivated unless you act at once. Abstract warned users about fake direct messages as it announced its shutdown on October 6.
The eligibility checker. A site offers to show your allocation if you connect and sign. Some checkers are real, which makes the fake ones convincing. LayerZero told users to run its checker without connecting a wallet. A real ownership check is a plain message. If the request names a spender, an amount or a deadline, it is a permit, and the page is hostile. Treat any checker that wants an approval the same way.
What a real claim looks like
A real claim is public and unhurried. Monad published its eligibility tracks and then its full results on its own site. Its claim ran for three weeks, from October 14 to November 3, 2025. Arbitrum's ran for six months, from March 23 to September 24, 2023. A message that demands action in ten minutes does not fit either pattern.
Monad also screened wallets against sanctions lists with the Chainalysis oracle, geo-blocked several jurisdictions and kept team members out. Claimed tokens went into an escrow contract on November 9 and reached claimers when mainnet launched on November 24. The results post describes screening and timing, and it mentions no fee and no phrase request. The scam version arrives on a day with no announcement, adds a countdown, and then wants a fee or a signature you cannot read.
A five-step check before you connect
- Where did the link come from? Only the project's verified account or documented domain counts. A path through an ad, a reply or a direct message ends the check, however good the page looks.
- Does the project's own channel say a claim is open? If the project says no date exists, a claim page is false. Our tracker shows the status and the last check date for each project.
- Is anything asking for a payment or your recovery phrase? Either one means you stop, with no exceptions.
- Which wallet are you connecting? Use the separate farming wallet and never the vault, so the worst case is a small balance.
- Can you explain the request on screen? Name the spender, the token and the amount. If you cannot, decline, close the tab and look the project up again from its official channels.
The first hour after a hit
Speed matters, and the right steps depend on what you exposed. Revoke.cash separates the cases.
If you signed an approval or permit but never typed your phrase, your keys are intact. Revoke the approval, move what remains to a fresh wallet, and check the Signatures tab for permits that could still be activated.
If your phrase touched a website or malware, the wallet is permanently unsafe. Wipe and scan the device, create a new wallet on a clean device, preferably a hardware wallet, and move funds across. Do not send gas to the old wallet. Revoke.cash warns that sweeper bots, scripts running on a compromised wallet, drain incoming funds before you can use them. For more than $1,000 in assets, it points to the Flashbots Whitehat Hotline.
Then report the incident to the police and to any exchange involved. In the United States, the FBI takes complaints at ic3.gov. Expect a second wave of fake recovery services after any public loss. The FBI's 2025 report counted 10,516 recovery-scam complaints with $1.4 billion in losses, and Revoke.cash notes that anyone who promises to get funds back is likely a scammer too. Its guide ends on prevention: verify URLs, bookmark the sites you use, and run a security extension, because that works better than any recovery attempt.
