You open your wallet and see tokens you never bought. They might be worth hundreds or thousands of dollars — at least that is what your wallet balance claims. The natural reaction is excitement: free money. But these tokens are not a gift. They are a trap designed to steal everything else in your wallet.

Malicious airdrop scams are one of the fastest-growing attack vectors in crypto. Unlike honeypots or rug pulls where you actively seek out and buy a token, airdrop scams come to you. The attacker sends tokens directly to your wallet without your consent, then waits for you to interact with them.

How Malicious Airdrops Work

The scam relies on a simple psychological trigger: people see apparent value in their wallet and want to access it. The attacker exploits this through several mechanisms, all designed to get you to sign a transaction that grants their contract access to your real assets.

The phishing website trap

The most common variant. The airdropped token has a name like "Visit-ClaimReward.com" or "You Won 500 USDT — claim at xyz.io". When you visit the website and connect your wallet to "claim" your reward, the site requests a token approval — permission for their smart contract to spend your tokens. If you approve, the contract immediately transfers your real tokens (USDT, ETH, SOL, or whatever you hold) to the attacker's wallet.

The approval request is often disguised. Instead of clearly stating "Allow this contract to spend your USDT," it may appear as a standard signature request or be buried in the fine print of a legitimate-looking interface.

The sell-trap mechanism

Some airdropped tokens are designed to trigger when you try to sell them on a DEX. The token's transfer function contains hidden logic that, when executed through a swap, requests approvals for your other tokens or executes external calls to drain contracts. You think you are selling a worthless token for a few dollars; instead, you are signing away access to your entire wallet.

The fake governance token

Scammers airdrop tokens that mimic legitimate governance tokens from popular DeFi protocols. The name might be nearly identical to a real protocol — one character off, or with "V2" appended. When you try to "vote" or "stake" these tokens on the fake protocol's website, you are actually approving a drain contract.

NFT airdrop drains

The same principle applies to NFTs. You receive an NFT you did not purchase, often with an appealing image and a description containing a link. Following the link leads to a phishing site that requests wallet approval to "view" or "claim" associated rewards. The approval grants full access to your wallet.

Understanding Token Approvals

To understand why airdrop scams are so dangerous, you need to understand how token approvals work on EVM chains (Ethereum, BSC, Base, Arbitrum, etc.).

Every time you trade on a DEX, you grant that DEX's contract permission to access your tokens. This is called an approval. Without approval, the contract cannot move your tokens. The problem is that most DEX interfaces request unlimited approval — permission to spend any amount, forever, until you explicitly revoke it.

Legitimate DEX contracts use this approval only for the trade you requested. But a malicious contract with unlimited approval can drain your entire balance at any time — even days or weeks after you signed the approval.

This is exactly how airdrop scams work. They trick you into granting unlimited approval to their drain contract. Once approved, they take everything. For a deeper understanding, read our token approval exploit guide.

Types of Airdrop Scams

Reward claim tokens

Tokens named "Claim 500 USDT" or "You Won — Visit site.com". The name itself is the attack vector, directing you to a phishing website. These are the most obvious and also the most common.

Copycat protocol tokens

Tokens mimicking real projects: "Uniswap V4 Airdrop", "LayerZero Rewards", "Eigenlayer Points". These exploit awareness of legitimate airdrop campaigns to lure victims to fake claim sites.

Value-displaying tokens

Tokens that show a high dollar value in your wallet (achieved by creating fake liquidity pairs). You see "$5,000 worth of XYZ token" and naturally want to sell. Attempting to sell triggers the drain mechanism.

Dust attacks

Tiny amounts of real tokens (fractions of a cent) sent to your wallet to track your transaction patterns. While not immediately draining, dust attacks map your wallet activity to identify high-value targets for more sophisticated attacks later.

Approval bait tokens

Tokens that appear on DEX aggregators with liquidity pools showing attractive prices. When you try to swap them, the approval transaction grants the drain contract access to your other holdings. The swap itself might even succeed — giving you a few dollars while the contract silently takes hundreds or thousands.

How to Avoid Airdrop Scams

1. Never interact with tokens you did not buy. If it appeared in your wallet without you purchasing it, treat it as hostile. Do not sell, transfer, or approve anything related to it.
2. Never visit websites embedded in token names. These are phishing sites designed to steal your wallet.
3. Audit your approvals regularly. Use Revoke.cash to review and revoke any unlimited approvals you have previously granted. Make this a monthly habit.
4. Use separate wallets. Keep your main holdings in a wallet that never interacts with unknown contracts. Use a separate "hot" wallet for trading new tokens, funded only with amounts you can afford to lose.
5. Scan before interacting. If you are curious about an airdropped token, scan it with RugCheck, Honeypot.is, or TokenSniffer first — but do NOT interact with the token contract directly.
6. Hide unknown tokens in your wallet. Most wallet apps allow you to hide or block specific tokens. Use this feature to remove the temptation to interact.

What to Do If You Already Interacted

If you have already connected your wallet to a suspicious site or approved a transaction from an airdropped token:

1. Go to Revoke.cash immediately and revoke ALL approvals you do not recognize.
2. Transfer remaining assets to a brand new wallet. Do not reuse the compromised wallet.
3. Do not trust "recovery services" that promise to get your funds back. They are scammers targeting scam victims.
4. Check for pending approvals on all chains you use — attackers often target multiple chains from a single phishing site.