Fake airdrop sites that connect to your wallet and drain it

22 September 2026

Fake airdrop sites trick you into connecting your wallet to a malicious phishing-sites/smart-contract-front-end-cloning/">smart contract or signing a transaction that gives the attacker full control of your funds. They impersonate real projects, promises free tokens, and rely on your trust in the "connect wallet" button you've used hundreds of times before.

How a fake airdrop site works

The attacker registers a domain that looks like a real project's site, often with subtle typos or a different top-level domain. They copy the project's branding, layout, and social media links. The site then prompts you to connect your wallet to "claim" a nonexistent airdrop.

Once connected, the site typically asks you to sign a message or approve a transaction. The critical step is what you sign:

• Unlimited token approval: You sign an approval that lets the attacker spend any amount of a specific token from your wallet, without further confirmation.

• Permit signature: A gasless approval that doesn't require a separate transaction. You sign a structured message, and the attacker uses it to drain your tokens.

• SetApprovalForAll (on NFT platforms): The attacker gains permission to transfer any of your NFTs in that collection.

• Malicious swap or transfer: You sign what looks like a "claim" transaction but is actually an order that sends your tokens to the attacker.

Some sites also attempt to drain your wallet by tricking you into importing a malicious seed phrase or private key - but most victims are drained through signed approvals, not by revealing keys.

Why you cannot rely on "it looks official"

Attackers clone real project interfaces precisely. They register domains days before the scam launches, often using privacy services to hide their identity. The site may show a convincing countdown timer, fake social proof ("X users have claimed"), and real-looking links to the project's Twitter or Discord. None of these prove legitimacy.

Even if the URL appears correct at first glance, look carefully. Common tricks include:

• Replacing a letter with a similar-looking Unicode character (for example, using "а" from Cyrillic instead of Latin "a")
• Adding an extra word like "official" or "claim" before the real domain
• Using a .com version when the real site uses .org or .io
• A subdomain that mimics the real project name, such as realproject.fakesite.com

Step-by-step: how to check before you connect

1. Verify the URL manually. Do not click a link from an email, social media post, or direct message. Type the project's URL yourself or use a bookmark you created when you knew the site was legitimate.

2. Check the domain's registration date. Newly registered domains (less than a few months old) are a red flag for airdrop sites. Use a WHOIS lookup tool or a browser extension that shows domain age.

3. Look for the SSL certificate lock icon. A valid SSL certificate means the connection is encrypted, but it does not mean the site is legitimate. Scammers buy SSL certificates too. The absence of one, or a "Your connection is not private" SSL error, is a strong warning.

4. Use a phishing detector or blocklist. Browser extensions like MetaMask's built-in phishing detector or community blocklists will warn you if the domain is known for phishing. The warning appears as a red screen saying "This site is flagged as a known phishing site." Heed it.

5. Test the site with a burner wallet. Before connecting a wallet with real funds, connect an empty wallet you don't care about. See what transaction the site asks you to sign. If it asks for unlimited token approval or looks suspicious, do not use your real wallet.

6. Inspect the transaction in your wallet. Before signing, read the details your wallet shows. If it says "Approve" or "Set approval for all" and the contract address is unfamiliar, reject it. If you are unsure, use a transaction simulation tool that shows what would happen if you signed.

7. Check the project's official channels. Real airdrops are announced across the project's verified Twitter, Discord, or Medium accounts. Look at these accounts directly (not from links on the suspicious site) to confirm if the airdrop is real.

What to do if you connected to a fake airdrop site

If you approved a malicious contract but have not yet been drained, revoke the approval immediately. You can use a token approval checker or the revoke function on a block explorer. Remove the contract's permission to spend your tokens.

If your wallet has already been drained, the funds are gone. No one can reverse a blockchain transaction. Report the scam to your wallet provider and to the domain registrar, but do not expect recovery.

The short version

Fake airdrop sites work because the "connect wallet" interaction feels routine. The attacker does not need your private key - they only need you to sign one approval. Verify the URL manually, use a burner wallet to test, and never sign an approval unless you are certain of the contract and the permission it requests.

Back to phishing