Fake Crypto Airdrop Scams: How They Work and How to Spot Them

Fake airdrop scams are sent to thousands of wallets at once — often targeting wallets that have interacted with DeFi protocols, because those wallets are more likely to know how to sell tokens and more likely to have larger balances. The tokens look real. Sometimes they show a dollar value. They're designed to create urgency.

The core rule: if you didn't know a token was coming, don't interact with it. Tokens sitting in your wallet are inert. The trap only springs when you try to do something with them.

How fake airdrops actually drain wallets

There are several mechanisms, and they vary in sophistication:

• •Malicious token contracts — the token has a custom transfer function that triggers additional logic when you try to sell. Interacting with the contract executes an approval for a drainer.
• •Claim sites — the token's description or a metadata URL says "visit [site] to claim more tokens." The site is a phishing page that asks you to connect and sign an approval.
• •Fake DEX listings — the token appears on DexTools or DexScreener with a chart that looks real. You try to buy more or sell via a link in the token's page. That link goes to a drainer.
• •Social engineering follow-up — the token drop is the first step; someone messages you later pretending to be support for the project, offering to help you claim your "reward."

What legitimate airdrops actually look like

Real airdrops from legitimate projects have a paper trail. Uniswap announced their UNI airdrop on their official blog, with a snapshot date and claim instructions on app.uniswap.org — a URL that existed before the airdrop. ENS, Optimism, and Arbitrum did the same.

The pattern: project you already use → public announcement → tokens claimable at the project's existing official URL. Not: unknown project → tokens appear → claim at a new URL you've never heard of.

If you think you might have received a real airdrop from a project you use, find the claim process through the project's official website directly — not through any link in the token's metadata.

The dust attack variant

A related technique is "dusting" — sending tiny amounts of a real cryptocurrency (usually well under a dollar) to your wallet. This isn't a direct theft attempt. Instead, if you later consolidate these small amounts with your main balance in a transaction, the attacker can potentially use transaction analysis to link your addresses together and de-anonymize your holdings.

The response is the same: don't interact. The dust amounts are too small to be worth selling anyway.

Frequently asked questions