Fake airdrops and malicious approvals: free tokens, and why you get taken instead
"Connect your wallet to claim tokens" sounds like zero cost, but the moment you hit claim, what you sign may not be a claim at all — it can be an approval handing over a token's spending rights. This entry puts approvals, signatures, and revoking into plain words so you can see what that pop-up is really asking you to agree to.
Airdrops are a common thing on a blockchain — a project gives tokens away free to addresses that meet certain conditions, as a way to promote itself. Precisely because they're real, scammers can borrow the shell. They build a fake airdrop page and design the claim flow so you sign an approval with your own hands, and the money is swept out while you think you're collecting a reward.
The bait of free tokens
The bait comes in various forms, but they all hit the same instinct: take it while it's free.
- Tokens that drop in out of nowhere: some tokens you don't recognise appear in your wallet, the name maybe carrying a URL, luring you to that site to "claim the real reward" or "swap".
- Claim links from communities / DMs: limited-time airdrops, early-bird eligibility, "connect your wallet to claim" — often appearing alongside fake support and fake events.
- Mis-clicking a "famous project" airdrop: impersonating a well-known project's name, publishing a fake claim page, driven by search or ads.
The key isn't "is there a reward" but what the claim process asks you to do. A legitimate airdrop usually doesn't need a high-risk approval, and never asks for your seed phrase; a fake airdrop will, at some step, lure you into signing something in its favour.
What an approval is
To see through this scheme, you first have to understand "approval". On chains like Ethereum, for a smart contract to move a token in your wallet (like USDT, or various ERC-20s) you first sign an approve, meaning "I allow this contract to move this token of mine, up to a certain amount".
The legitimate use is very common: to swap tokens on a decentralised exchange, you first approve it to move the token you want to sell, which is reasonable. The problem is in the target and the amount of the approval:
- If the target is a scammer's contract, you've handed it permission to move your token with your own hands.
- If the amount is "unlimited", it can move the entire balance of that token out — not once, with no cap.
The trick of a fake airdrop is to wire the "claim" button to a transaction that "approves the scammer's contract, with the amount cranked to unlimited". You think you're collecting a reward; what you sign is the green light. For the underlying concepts of approvals, the ethereum.org security page has an explainer worth reading.
The most counterintuitive part is this: at the moment the approval is granted, your money "doesn't go down", nothing on screen looks wrong, and you may even genuinely receive a small worthless token, so you're all the more sure "it's fine". But that approval is now like a signed blank cheque left in the other side's hands; they can wait until your balance of that token is high, or until the market is good one day, and move it out in one go. The time gap in between is exactly why so many people only realise after the fact: "I didn't do anything, how did the money vanish?" — you did do something, you just didn't feel it at the time.
The risk of a signing window you can't read
What really trips people up is that signing / approval window the wallet pops up — a pile of addresses, hexadecimal numbers, and contract method names that most people don't understand, so they hit confirm out of habit. That habit is exactly what the scammer wants.
The window actually holds key information, and there are a few spots you should understand before you hit confirm:
- Is this a "signature" or a "transaction"? Some are gasless offline signatures (like Permit, setApprovalForAll) that can grant transfer rights all the same, and they're often overlooked because they cost no fee and look harmless.
- Which contract is the target? Do you recognise this contract address? If its origin is unknown, don't sign.
- Which token is being approved, and for how much? Be especially wary if the word "unlimited" appears.
- What's the method name? Claiming an airdrop but being asked to approve, setApprovalForAll, or permit doesn't match "claim" — that's a danger signal.
If you can't read it, the safest move is to not sign. An unsigned approval won't cost you a real airdrop; but a carelessly signed approval can cost you an entire wallet's worth of one token.
Offline signatures especially deserve their own mention. An ordinary approval transaction costs a bit of gas, which at least gives you a pause; but signatures like Permit and setApprovalForAll are "no fee, instant", the wallet pop-up flashes by, and many people click without even looking. Scammers favour these precisely because they're painless and low-alarm. So judgement can't rest only on "does it charge a fee" — look at what permission it grants and to whom. A healthy habit: whenever your wallet asks you to sign something, ask yourself "what am I actually trying to do right now, and does this signature match it" — if it doesn't, back out.
A few marks of a fake airdrop
Treat these as a quick checklist; most fake airdrops trip at least one:
- You never took part, yet you "won". A project you've never interacted with suddenly gives you an airdrop — suspect it first.
- Claiming asks you to sign an approval or enter your seed phrase. Collecting something free shouldn't need spending rights, and certainly not a recovery phrase.
- Limited time, rushing, limited spots. A countdown to push you into signing without verifying.
- A link of unknown origin. A DM, a URL tucked into a random token's name, or a claim page from a search ad slot.
- It asks you to pay a "fee / gas / deposit" first to claim. A legitimate airdrop won't ask you to put money down first; this is another variant of the scam.
- It asks you to connect your wallet to an unheard-of site. Connecting itself doesn't auto-drain funds, but the signature that follows is the trap, so avoid connecting where you can.
The principle is simple: for any airdrop of unknown origin, don't connect your wallet, don't sign, don't enter your seed phrase. Missing a fake airdrop costs you nothing.
When you genuinely want to take part in a project's airdrop, the right move is to look up the official announcement from a source you trust and confirm the claim page's URL and rules were published by the project, rather than clicking a link someone forwarded you or one tucked into a token's name. A practical habit is to keep a "clean wallet" — holding no main assets, used only to connect to sites you want to try but aren't fully sure about. Even if you do hit a malicious approval, the only thing exposed is this empty wallet, with your main assets out of its reach. Separating high-risk interactions from your net worth is a compartmentalising mindset well worth building when using a wallet, and it means you don't have to be on edge every time you try something new.
How to revoke
If you recall having signed an approval on some suspicious site, don't panic — approvals can be taken back:
- Use an approval-checking tool to see which contracts your wallet currently has approvals for and on which tokens.
- Find the approvals you don't recognise, or those from suspicious airdrop sites.
- Revoke them. Revoking is itself an on-chain transaction and needs a small fee (gas); that's normal.
- Once revoked, that contract can no longer move this token of yours.
For the full steps, which tools to use, and how to read the approval list, see the wallet approval review and revoke guide. It's worth building the habit of checking approvals regularly and clearing out ones you no longer use; that shrinks the attack surface a lot. For the full picture of related tactics, see the 2026 Binance scam round-up.
One thing to say up front, so you don't relax after revoking: revoking only stops the other side from moving your coins in the future; it can't recover what's already been moved out. If the assets are still there when you find the approval, revoking is timely bleed-stopping; if it's already been swept once, revoking only prevents what's left from continuing to drain. So the value of this is in being early — rather than checking only after something goes wrong, make a regular approval review as routine as reconciling an account. People who use one wallet to connect to DApps everywhere especially should clear up every so often, calling back approvals that have long been unneeded.
We took a wallet holding only a little test crypto, connected it to a common approval-checking tool, and walked through it, mainly to work out how to read that approval list. It turned out not to be complicated: each row is one approved contract, which token it covers, and the amount — "unlimited" gets flagged outright; and to actually revoke is to send an on-chain transaction that costs a little gas. The thing more likely to make you pause is the wording — different tools name the fields differently and versions change, so we don't hard-code an operation path here; go by the current screen of the tool in your own hands.
When you check yourself, watch three columns: one, whether you recognise the approved-target contract; two, whether the approval amount is "unlimited"; three, whether the method name in the signing window (approve / setApprovalForAll / permit) matches what you thought you were doing — if it doesn't match, don't sign.
FAQ
My wallet suddenly has tokens I don't recognise. Is that a good thing?
No. This is often phishing bait — a URL tucked into the token name to lure you to "claim" or "swap", and the site then tricks you into signing an approval. The safest move is not to interact: don't click, don't connect, don't swap, just leave it alone.
I only connected my wallet and signed nothing. Can I still be robbed?
Simply connecting a wallet (letting the site read your address) usually doesn't move assets directly; the real risk is in the signing and approval that follow. But connecting to a suspicious site is already on the edge, so to be safe avoid connecting where you can, and never hit confirm in any window it pops up.
Revoking an approval costs a fee. Am I being scammed again?
No. Revoking is a real on-chain transaction; your wallet pays gas to the network, and it doesn't go into anyone's pocket. It's a normal cost. If you worry about paying the wrong thing, do it from an approval-checking tool you trust; see the revoke guide.