A real airdrop is announced on the project's own website and verified accounts. Its rules are published, and it never asks for your seed phrase, an upfront payment or a signature you don't understand. The airdrops most likely to be worth something come from protocols with real use that you would have used anyway. Their rules reward genuine activity and filter out farmed wallets. Most losses do not happen when you click a link. They happen when you connect a wallet to a fake claim page and sign an approval or permit that lets a drainer move your tokens.
What is happening now (October 2026)
- 12–13 October 2026: A widely shared "SHIB airdrop" was flagged by a Shiba Inu ecosystem adviser as "no such airdrop. this is a drainer". The posts sent users to a link that asked them to connect a wallet and sign transactions.
- 21 October 2026: Security site PCRisk described a fake "Xaman Airdrop" page. It showed a countdown and a fake "64% claimed" progress bar to create urgency, and a drainer started once a wallet was connected.
- 19 March 2026: FBI New York warned Tron users about tokens claiming to come from the FBI. It told recipients not to give identifying information to any website linked to those tokens, and to report to ic3.gov if they already had.
All three follow the same pattern. Unsolicited tokens or social posts lead to a lookalike claim page, and the theft happens at the signature.
The scale of the problem, with dates
- Scams overall (Chainalysis, 13 January 2026): At least $14 billion in 2025 scam revenue was confirmed on-chain. Chainalysis projects the total could exceed $17 billion as more wallets are identified. Impersonation scams grew more than 1,400% year over year. Scams with on-chain links to AI vendors averaged $3.2 million per operation, against $719,000 for those without, about 4.5 times as much. The report does not break out airdrops.
- Wallet drainers (Scam Sniffer, published early January 2026): Phishing drainers took $83.85 million from 106,106 victims on EVM chains in 2025. That is down 83% by value from 2024. Permit and Permit2 signatures accounted for 38% of losses in large cases, and malicious EIP-7702 batch signatures appeared after the Pectra upgrade. Scam Sniffer calls these figures a lower bound.
- Inferno Drainer (Check Point Research, 7 May 2025): Its operators announced a shutdown in late 2023, but the kit was still active. Check Point estimates more than 30,000 wallets were drained of at least $9 million between September 2024 and March 2025. One campaign used a fake $TRUMP airdrop site after the token launched on 17 January 2025.
What makes an airdrop "high-potential"
No public method predicts an airdrop's value. These signals separate projects that may reward users from ones that are only collecting wallet connections.
Signals worth weighting
- A product people use without an airdrop. Usage that holds up when no rewards are running is a better sign than activity that spikes during a points campaign.
- Published, specific rules. Serious projects publish snapshot dates, eligibility criteria and how they filter farmed wallets.
- Identifiable teams and verifiable funding. You can check funding on project announcements and databases such as RootData or Crunchbase. Funding is not a guarantee: it shows someone did due diligence, not that the token will hold value.
- A token allocation stated in documentation. Look for a stated percentage for users, not vague promises of "rewards soon".
What a well-run airdrop looks like: Arbitrum, 2023
The Arbitrum Foundation's documentation is a useful reference because it published the whole method:
- Snapshot: block 58642080 on Arbitrum One, 6 February 2023.
- Claim window: 23 March 2023 to 24 September 2023.
- Allocation: 1.162 billion ARB, or 11.62% of the 10 billion initial supply, went to users.
- Points: Wallets earned points for qualifying actions, up to 15, and needed at least 3 to qualify. Points earned before the Nitro upgrade (31 August 2022) counted double.
- Anti-farming rules: A point was deducted if all of a wallet's transactions happened within 48 hours. Another was deducted if the wallet held under 0.005 ETH and had used no more than one contract. Wallets flagged as Sybils in the Hop protocol bounty were disqualified.
- Amounts: Allocations ranged from 625 to 10,250 ARB.
The point for 2026: rules like these rewarded long-term, varied use and penalised wallets created for farming. Spreading thin activity across many wallets is the behaviour these filters are built to catch.
Red flags: stop immediately if you see these
- Any request for a seed phrase, private key or one-time passcode. The FBI's June 2025 airdrop alert says never to share these in response to unsolicited requests.
- "Pay gas" or "send crypto to verify or activate."
- Tokens you never asked for whose name or memo contains a link. The FBI described this tactic with NFTs on Hedera (June 2025) and FBI-branded tokens on Tron (March 2026).
- Direct messages or replies announcing you "qualify". Hijacked accounts are common. In September 2023 an attacker took over Vitalik Buterin's X account and posted a fake NFT giveaway that drained about $691,000.
- Countdown timers, "almost fully claimed" bars or "claim now or lose it" wording.
- A domain that differs from the official one in any character, or a "claim" subdomain the project never announced.
- Discord verification bots without the platform's verified-app mark. Inferno Drainer used a fake Collab.Land bot reached through hijacked, expired Discord invite links.
Is this airdrop claim safe to go ahead with?
Answer a few questions about the airdrop in front of you to see whether to stop, check more, or claim carefully.
Have you already signed something or typed your seed phrase on this claim page?
- Yes → Act now to limit the damage
- No, not yet → next question
Does the page or message ask for your seed phrase, private key, a one-time passcode, or a payment to "pay gas", "verify" or "activate"?
- Yes → Stop: these are red flags
- No → next question
Did you reach the claim page from a direct message, a reply, or a link in the name or memo of a token you never asked for?
- Yes → Do not use that link
- No, I opened the project's site from a bookmark or a link I checked myself → next question
Does the airdrop appear on the project's own website and verified channels, with published rules: a snapshot date, eligibility criteria and a claim deadline?
- Yes, all of these → next question
- No, or only some of them → Treat it as unconfirmed
Does the page show a countdown timer, an "almost fully claimed" bar or "claim now or lose it" wording, or does the domain differ from the official one in any character?
- Yes → Stop: these are red flags
- No → next question
On a block explorer, is the claim contract's code verified, and does a search of the address or URL on a scam-report database come back clean?
- Yes → next question
- No, or I have not checked → Treat it as unconfirmed
Does the wallet prompt ask for an unlimited approval, approval for a whole NFT collection, or a permit for a token the claim does not involve?
- Yes → Reject that prompt
- No, it only covers the claim → next question
Are you claiming from a separate wallet that holds nothing else?
- Yes → Claim carefully, then clean up
- No, it is my main wallet → Switch to a separate wallet first
Revoke the approval from a clean device and move remaining assets to a new wallet with a new seed phrase. If you entered your seed phrase, treat the wallet as permanently compromised. Report to ic3.gov in the US or your national authority, and be wary of anyone offering to recover funds.
A real airdrop never asks for your seed phrase, an upfront payment or a signature you don't understand, and urgency tricks and lookalike domains are common on fake claim pages. Close the page and do not connect a wallet.
Hijacked accounts and unsolicited tokens with links are common ways to reach drainer pages. Ignore the link, and open the project's website from a bookmark or a link you checked yourself, then start again.
If the project's own channels don't announce it, the rules are not published, or the contract can't be checked, do not claim yet. Wait until you can confirm the source, the rules and the contract.
Approvals stay active until you revoke them, and a permit signature can hand over spending rights without a transaction or gas. Refuse unlimited approvals and any permit for a token the claim does not involve.
Set up a wallet that holds nothing else and claim from it, so a bad signature cannot reach your savings.
Read every prompt before you sign. Afterwards, review and revoke the approvals you gave with an approval-checking tool, and keep records of dates, amounts and values for tax.
This checks a claim against the article's safety steps only: it cannot tell you whether an airdrop will be worth anything, cannot spot every scam, and does not cover tax rules in your country.
How the theft actually happens
Approvals
Token approvals let a smart contract spend your tokens. They stay active until you revoke them, so a malicious contract you approved can drain your wallet later. Drainers use approve, increaseAllowance and setApprovalForAll, which gives access to a whole NFT collection.
Permit signatures
EIP-2612 permits grant spending rights through an off-chain signature, so no transaction is sent and no gas is paid when you sign. That makes the request look like a harmless login message. Wallets often show no approval warning for it, and a scammer can use the signature on-chain almost at once. Revocation tools cannot see signatures you have made but which have not yet been used.
Batch signatures
Since Ethereum's Pectra upgrade, EIP-7702 lets one signature bundle several operations. Scam Sniffer recorded drainers using this in 2025.
A four-step check before you claim
- Confirm the source. Open the project's website from a bookmark or from a link you checked yourself, never from a DM or reply. Check that the airdrop appears on the project's own channels.
- Read the rules. Look for a snapshot date, eligibility criteria and a claim deadline. If none are published, treat the page as unconfirmed.
- Check the contract and address. Look the claim contract up on a block explorer: check that the code is verified, its age and its interactions. Search the address or URL on Chainabuse, a reporting database powered by TRM Labs that holds more than 561,000 phishing reports as of late October 2026.
- Claim from a separate wallet. Use a wallet that holds nothing else. Read every prompt. Refuse unlimited approvals and any permit for a token the claim does not involve. Afterwards, review and revoke approvals with a tool such as Revoke.cash.
Our crypto wallets guide covers how to set up that separate wallet, and the DeFi explainer covers the protocols behind most airdrops.
If you signed something you shouldn't have
- Revoke the approval immediately from a clean device, and move remaining assets to a new wallet with a new seed phrase.
- If you entered your seed phrase anywhere, treat the wallet as permanently compromised.
- Report it to ic3.gov in the US, or to your national authority. The FBI asks for wallet addresses, amounts, dates and transaction hashes.
- Be wary of anyone offering to recover funds. The FBI warns this is often a second scam.
Taxes
The rules depend on the country:
- United States: IRS Revenue Ruling 2019-24 treats airdropped units received after a hard fork as ordinary income at fair market value once the taxpayer has "dominion and control", meaning they can dispose of the units.
- United Kingdom: HMRC says Income Tax does not always apply to airdrops received personally without doing anything in return. Airdrops received in return for a service are taxable. Disposing of an airdropped token may trigger Capital Gains Tax.
Keep records of dates, amounts and values, and get advice from a qualified tax professional.
Frequently asked questions
Is an airdrop that asks me to connect my wallet always a scam?
No. Real claims also need a wallet connection. What matters is the domain and what you sign: a real claim should not ask you to approve tokens you already hold.
Should I farm with many wallets?
Projects such as Arbitrum published rules that deduct points from, or disqualify, wallets that look farmed. Separate wallets for security, keeping savings away from the wallet you use to claim, are a different and sensible practice.
What should I do with tokens I never asked for?
Ignore them. Do not visit links in their names or memos, and do not try to swap them.
