Crypto airdrop scams: how a 'free token' claim empties a wallet, and what to check first

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

A surprise token or a 'claim your reward' link is the bait. The theft happens later, when you approve a spending permission, sign a message or type your recovery phrase. Here is what each request means, and what to do if you already clicked.

01 / The short answer

Receiving an unexpected token does not, on its own, give anyone access to your wallet. The danger starts when you follow it: visiting a 'claim' site, connecting your wallet, and then approving a spending permission, signing a message or entering your recovery phrase. MetaMask's own guidance draws exactly this line between a regular airdrop and an airdrop phishing scam.

This guide is about crypto token and NFT airdrops, not Apple's AirDrop file-sharing feature.

02 / Four different requests, four different risks

• Receiving a token. Anyone can send a token to a public address. Its appearance in your wallet or on a block explorer is not an endorsement, and it is not a sign it has value.
• Connecting a wallet. This shares your address with a site. It is not the same as giving it permission to spend.
• Approving a spending permission (an allowance). This lets a smart contract move a token from your wallet, sometimes up to an unlimited amount. On EVM chains such as Ethereum, this is how most drainers take funds.
• Signing a message. Some signatures cost no fee and move nothing at once, but can be used later to authorise a transfer. MetaMask warns that 'gasless' does not mean safe.

Never type your 12- or 24-word recovery phrase into any site, form or chat to claim anything. Anyone with it controls the whole wallet.

03 / What to check before you claim anything

1. Start from the project's official channel that you found yourself, not from a link in the token, a direct message or a reply under a post.
2. Read every wallet prompt: which site is asking, which token, which spender address, and how much. An unlimited allowance for a 'free' claim is a red flag.
3. Treat countdowns, 'last chance' banners and famous logos as pressure, not proof.
4. If you are unsure what a signature does, reject it. You can always come back after checking.

Practise reading a permission request in our Scam Lab.

04 / Disconnecting is not enough

Disconnecting a site from your wallet does not cancel a spending permission you already gave. MetaMask says plainly that disconnecting 'will not revoke any token approvals', so the site may still be able to move your tokens. To remove an allowance you have to revoke it, which is an on-chain transaction and costs a network fee. A fee alone is not a sign of fraud.

These details apply to token approvals on EVM chains. Other blockchains handle permissions differently; check your wallet provider's guidance for the chain you use.

05 / If you already clicked

• You approved a permission but kept your recovery phrase private: revoke the allowance through your wallet or a trusted revoke tool, and move remaining funds if in doubt.
• You typed your recovery phrase anywhere: treat the wallet as compromised. Revoking or disconnecting is not enough. Follow your wallet provider's compromise steps and move what is left to a new wallet created from a new phrase. Do not keep sending gas money into the old address; automated 'sweeper' scripts can take it as soon as it arrives.
• Save the transaction hashes, wallet addresses and the claim site's address. In India, report on 1930 or cybercrime.gov.in, which takes cryptocurrency crimes.

Be realistic: blockchain transfers cannot be reversed by your wallet provider, and anyone promising guaranteed recovery for a fee is running a second scam. Crypto scams in India: what to do.

06 / Confirmed vs. general guidance

From the wallet provider's documentation: that receiving a token alone is not theft, that signatures can be abused, that disconnecting does not revoke approvals, and the steps after a compromise. Not available: any official figure for airdrop scam losses in India. The steps here describe common patterns, not a single named case.