Airdrops can be a genuine way to learn about a new project, but they are also one of the most common ways wallets get drained. The scam version usually works the same way: a message promises free tokens, a link leads to a convincing website, and a wallet connection quietly asks you to approve something you did not intend. Learning to spot the warning signs before you connect is far more effective than trying to recover funds afterwards, because crypto transactions are generally irreversible.

Start with the source of the announcement. Real projects announce airdrops on their official channels, and those channels are usually linked from the project's main website or documentation. Be cautious about announcements that arrive by direct message, a reply to your post, or a link shared in an unrelated group. Scammers routinely copy project names, logos, and profile pictures, and a verified-looking account on one platform can still be an impersonator. If you cannot find the same announcement on the project's official site or main social account, treat the offer as unverified.

Fake airdrops almost always add pressure. Claims like claim in the next hour, limited to the first 500 wallets, or your allocation expires today are designed to stop you checking details. Real distributions may have deadlines, but they rarely require an instant wallet approval from a link you just received. Be equally wary of airdrops that ask you to send funds first to receive tokens, pay a claim fee to a personal wallet, or hold an unrelated token you have never heard of. A legitimate airdrop should not require you to pay the project directly to unlock free tokens.

The most important moment is the approval screen in your wallet. Many drainer scams do not steal your password. Instead, they ask for a broad token approval or a signature that lets a contract move assets from your wallet. If an approval asks for unlimited spending of a token, access to all of your NFTs, or a permission you do not understand, stop and do not sign. A simple token claim should not need open-ended control over your assets. When in doubt, use a separate wallet with only a small amount for any claim, and never connect your main holdings wallet to an unverified site.

Look closely at the website itself. A domain name that is almost, but not quite, the project's real domain is a common trick, as are extra words like claim, airdrop, or official added to a familiar name. Check whether links on the site actually lead to real project pages, whether the site's text is copied or full of errors, and whether the contract address, if shown, matches the one published by the project. None of these checks alone proves a site is safe, but several small mismatches together are a strong reason to walk away.

Sometimes the scam arrives the other way round: an unknown token simply appears in your wallet, and its name or website promises a valuable airdrop if you interact with it. Do not try to sell, swap, or approve that token without researching it first, because interacting with a malicious token contract can itself trigger a drain. The safest response to an unexpected token is to ignore it and hide it in your wallet interface. Curiosity is exactly what that kind of airdrop is designed to exploit.

If you connected to a suspicious site, act quickly. Disconnect the site in your wallet settings, revoke any token approvals you granted using a reputable approval-management tool, and move your remaining assets to a fresh wallet if you signed anything you did not fully understand. Then report the site and the account that promoted it, so others see the warning. Revoking an approval does not undo a transaction that already happened, but it can stop further drains from the same approval.

The simplest rule covers most cases: slow down, verify through official channels, and never sign an approval you cannot explain in plain language. A real airdrop will still be there after you take five minutes to check. A scam depends on you not taking those five minutes.