Can a token in my wallet steal my crypto by itself just by being there?

No. A token sitting in your wallet cannot move your funds on its own, no matter what its name says. Theft only happens if you visit the claim site, connect your wallet, and authorize a signature or approval. As long as you never sign anything, an unsolicited token is harmless and can simply be hidden.

What is the difference between an approval and a permit in these scams?

An approval is an on-chain transaction that grants a contract permission to move a specific token, often for an unlimited amount, and it costs gas. A permit is an off-chain signature that does the same thing gaslessly, which is why it looks like a harmless free sign-in message. Drainer sites favor permits precisely because the no-fee popup feels safe. Both can authorize a full sweep of your assets.

Should I send the unsolicited airdrop token back to remove it?

No. Sending it back means signing a transaction and paying gas, which gives attackers exactly the interaction they want and may route you through a malicious contract. The correct move is to do nothing and use your wallet's hide or block feature to remove the token from view. Never interact with a token you did not expect.

I already clicked a claim site and connected my wallet. What now?

Do not sign any further requests. Immediately review your token approvals with a trusted revocation tool and remove anything you do not recognize, because a granted approval stays active until you revoke it. If you believe a draining transaction already executed, move your remaining assets to a brand-new wallet and follow a wallet recovery checklist without delay.

Fake Airdrop Claim Site Scam: How Drainers Steal Your Wallet (and How to Verify)

June 27, 2026 — By Tony Rabbit in Tutorials

A fake airdrop claim site scam uses an unsolicited token in your wallet as bait to lure you to a malicious page that asks you to sign a draining approval. Here is the exact kill chain, what the signature really does, and how to verify before you ever connect.

A fake airdrop claim site scam is a theft technique where attackers deposit an unsolicited token into your wallet, name it after a "claim" URL, and rely on your curiosity to drive you to a malicious website that asks you to sign a wallet-draining transaction. The token itself is harmless bait. The damage happens the moment you connect and approve a request on the spoofed site. Unlike a legitimate airdrop, nothing real is ever waiting for you to claim. The whole funnel exists to manufacture a single fraudulent signature, and understanding that funnel is the difference between losing a wallet and shrugging off junk.

Key Takeaways

The unsolicited token is bait, not value. The theft happens on the claim site, not in your wallet.
The site asks you to sign an approval or an off-chain permit that hands a drainer control of your assets.
Real airdrops are announced through official channels first. You verify the channel, then go to the site, never the reverse.
The correct default is to do nothing. Never sign to "claim" a token you did not expect. Hide it and move on.

The kill chain of a fake airdrop claim site scam

The attack runs in a predictable sequence. First, an unknown token appears in your wallet. You never bought it, never interacted with the project, and often never heard of it. The token name or symbol is frequently a URL, something like "Claim at rewards-xyz.com" or "$2,000 voucher - visit site." This is the lure. The token is mass-distributed to thousands of addresses at once, sometimes paired with a small dusting attack that sends tiny amounts to make wallets look "active" and worth targeting.

Second, curiosity does the attacker's work. You see an apparent balance, search the name, and land on a site that looks like a polished claim portal: countdown timer, project branding, a glowing "Claim Now" button. Third, you connect your wallet. Fourth, the site presents a transaction or signature request that is not what it appears to be. Approve it, and a drainer contract sweeps your real tokens, stablecoins, or NFTs in seconds. No claim ever arrives. The token in your wallet was only ever a billboard pointing at the trap.

What the malicious site actually asks you to sign

The claim button never gives you anything. It asks for a permission, and the danger lives in the difference between what the popup looks like and what it does. There are two main mechanics, and both are quiet by design.

The first is a token approval. You think you are enabling a claim, but you are granting a smart contract permission to move a specific token out of your wallet, often for an unlimited amount. The second is an off-chain permit signature. This looks like a harmless "sign-in" message with no gas fee, which is exactly why people approve it without thinking. In reality it authorizes the same kind of transfer through a gasless signature. If you are unsure how these differ, our breakdown of approve versus permit token permissions spells out why the gasless one is often the more dangerous of the two.

What the popup says	What it actually does	Tell
"Approve to claim"	Grants a contract spending rights over your token, often unlimited	Approval is for a token you hold, not the junk one
"Sign to verify wallet" (no gas)	Off-chain permit authorizing a gasless transfer of your assets	Free signature that names a spender and amount
"Confirm to receive tokens"	Sends a transaction to a drainer that sweeps balances	You are paying gas to "receive" something free

Why an unsolicited token in your wallet is a red flag

Legitimate airdrops almost never start by surprise-depositing a tradeable balance and asking you to visit a website. Real distributions are announced in advance, are usually claimed through the project's own verified domain that you navigated to deliberately, and do not depend on a token mysteriously showing up first. When the token arrives before any announcement and its name is a call to action, the sequence is reversed, and that reversal is the signal.

An unexpected token is functionally an advertisement that anyone can place in your wallet for a few cents, because sending tokens to an address requires no permission from the recipient. Treat it the way you would treat a flyer slipped under your door promising a free prize "if you call this number." The mere appearance of value is not evidence of value. For the wider pattern of how these fake airdrops are constructed and spotted, see our guide to identifying fake airdrop scams.

How to verify an official airdrop channel before connecting

Verification reverses the scam's flow. Instead of letting a token lead you to a site, you start from a source you already trust and work outward. Never click a link that came to you. Find the project independently.

Start from the official source, not the token. Locate the project through a reputable aggregator, its long-standing verified social account, or a documentation site you reached by typing the address yourself.
Cross-check the domain. Drainer sites use look-alike URLs with extra words, swapped letters, or odd top-level domains. Compare the exact spelling against multiple official references before connecting anything.
Confirm the airdrop was announced first. A real claim is documented before it opens. If you cannot find an official post predating the token's arrival, assume it is bait.
Read every signature request. If a "claim" asks you to approve a token you already own or sign a gasless permit naming an unknown spender, reject it. Our walkthrough on how to avoid crypto scams covers the broader connect-and-sign discipline.

The do-nothing default: never sign to claim, just hide the token

The safest response to an unsolicited token is the cheapest one: nothing. You do not need to sell it, send it back, or "claim" it. A token sitting in your wallet cannot move your assets on its own. Only a signature you authorize can do that, so withholding the signature ends the attack. Hide or spam-filter the token in your wallet interface and carry on.

If you have already connected to a suspicious site, do not panic-sign anything else, and review your existing allowances. Use a trusted approvals tool to revoke any token approvals you do not recognize, since a granted approval keeps working until you remove it. If you fear a transaction already went through and funds are at risk, follow the immediate containment steps in our crypto wallet recovery guide right away, moving any remaining assets to a fresh wallet before doing anything else. The fake airdrop claim site scam only succeeds when you supply the one ingredient it cannot fake: your own approval.

This article is for educational purposes only and is not financial advice.