Fake Airdrops: Free Money That Drains Your Wallet

On 11 July 2022, 73,399 addresses belonging to people who had put money into Uniswap's trading pools (Uniswap is one of the biggest crypto trading venues) found a new token in their wallets. It promised 400 UNI, Uniswap's own token, to anyone who claimed it on a website named in the token itself. Uniswap had once really given away 400 UNI per user, so the offer looked plausible. People who clicked "claim" signed a permission that handed over their positions. Within hours the attacker had moved about 7,500 ETH, roughly $8 million at the time, out of victims' accounts and through a laundering service.

Uniswap was never hacked. Its code worked perfectly. The victims had simply signed what was put in front of them.

That is the fake airdrop: free money as bait, with the real cost hidden in the paperwork.

What a real airdrop is

An airdrop is a free handout of tokens, the digital units a crypto project issues, a little like a company mailing free shares to its early customers. Projects use them to reward users and spread ownership. Some have been large. Uniswap's own airdrop in September 2020 gave 400 UNI to every address that had ever used it, worth more than $1,000 each at the time.

Because real airdrops happen, fake ones work. Anyone can create a token in minutes, give it a famous name and send it to thousands of wallets for almost nothing. A crypto wallet is the app that holds a person's coins and the keys to them; unlike a bank account, it accepts anything sent to it, invited or not. The tokens then show up next to the owner's real holdings, sometimes with an impressive-looking price, and sometimes with a website address written into the token's name.

How the "claim" empties the wallet

Most crypto activity runs through smart contracts: programs that move money by themselves, following their own rules, with no bank or broker in the middle. Collectively these programs are called DeFi, short for decentralised finance. To let a smart contract use a person's tokens, for example to trade them, the owner signs an approval.

An approval is the dangerous part. A normal one says "this program may move up to 100 of my tokens". A malicious one says "this program may move all of my tokens, of every kind, forever". It is the crypto version of signing a blank cheque or setting up a standing order with no limit and no end date. The fake claim page asks for exactly that, dressed up as "verify to receive your reward". The attacker can use it immediately, or weeks later when the owner has forgotten clicking anything.

A second version uses a signature instead. Some tokens allow a "permit": a signed message, off the public record, that authorises spending, like a cheque that has been signed but not yet cashed. It costs the victim nothing to sign, shows no obvious transaction, and the attacker cashes it whenever they like. Scam Sniffer, a firm that tracks these thefts, says permit signatures were the most common method in 2025, and the single largest theft that year, $6.5 million in September, used one.

A third version is cruder: the claim page asks for the wallet's recovery phrase, the 12 or 24 words that can rebuild the wallet anywhere. Typing them in hands over the whole wallet. No genuine airdrop ever asks for them.

Other bait in the inbox

Not every unrequested token wants a click on "claim". Some carry a threat. In March 2026 the FBI's New York field office warned that fake "FBI" tokens had been sent to at least 728 wallets on Tron, a blockchain popular for sending digital dollars cheaply. Each token carried a message, readable on a block explorer (a public website where anyone can look up any wallet's transactions, like a bank statement open to the world), claiming the wallet was under a money-laundering investigation and faced "a total block" on its assets unless the owner verified through an online form. The FBI told people to "exercise caution if they encounter a token purported to be from the FBI".

Others are dust: tiny, worthless amounts of crypto sent to many wallets. Some dust is used to map who owns what. A more profitable kind, address poisoning, sends a tiny or zero-value payment from an address that looks almost identical to one the victim really uses, hoping the victim will later copy the wrong one from their history. In December 2025 one trader lost $50 million in USDT, a digital dollar, that way.

The numbers, and what works

Scam Sniffer counted $83.85 million stolen by "wallet drainers", the ready-made toolkits behind most of these claim pages, across 106,106 victims in 2025. That was down 83% from $494 million in 2024, helped by better warnings in wallets such as MetaMask and browser blocklists. The figure is a floor: it counts only thefts the firm could trace on Ethereum-style blockchains. January 2026 alone added $6.27 million.

The defences are simple and dull. Tokens that arrive unrequested are ignored, not sold, swapped or "claimed", and websites written into token names are never visited. Real airdrops are checked only on the project's own official site. Anyone chasing airdrops does so from a separate wallet with little in it, never from the one holding savings. Old approvals are reviewed and cancelled with tools such as Revoke.cash or Etherscan's token approval checker. And any page asking for a recovery phrase is closed at once.