Fake airdrops

Receiving does not require a visit

If a token is already in the account, it arrived by a transfer. You do not have to visit a page, connect a wallet, or approve a spender to 'receive' it. The balance is either there or it is not. A site that says the tokens will not appear until you sign is selling the signature. The signature is the product. The pictured pile of tokens is the advertisement.

Real distributions have existed where tokens simply showed up, or where a project you already used let you claim from a page on its own domain. The difference you can check without a rumour is mechanical. A transfer that has already happened needs no further permission from you. A claim that asks for an approval, a permit, or a seed phrase is asking for something a transfer does not need. This page does not rank which famous distributions were real. It does not need to. The signature in front of you is the question.

The token in the wallet is the bait

Anyone who knows your address can send you a token. Addresses are public once you have used them. The token's name, symbol, and a link inside the metadata are chosen by the sender. Wallets often display that metadata. A link that says 'claim' or a ticker that matches a project you hold is still metadata. It is not a message from the project. Hiding the token in the wallet, when the wallet offers a hide button, is a complete response.

Selling the surprise token is not a way to collect a small prize. The sell can be the hook: a pool that buys your real USDC on the way through, or a token that cannot be sold and whose error page sends you to a claim site. If you did not buy it, you do not need to sell it. Leaving it costs nothing. Approving it can cost the wallet.

Claim pages and the prompts they use

The page will ask you to connect, then to sign. The sign step may be worded as a claim, a verification, or a gasless permit. Gasless does not mean consequence-free. A permit can set an allowance without a separate approval transaction, which is why it is popular with drainers. Read the wallet prompt for a spender and an amount. Unlimited, or a spender you do not know, is a refusal. The drainer page goes further into those prompts. This page stops at the reason you were there: a windfall you were not expecting.

Airdrop Twitter accounts, reply guys, and search ads are not the project. If you want the project's own page, type the host you already verified or open the bookmark. Do not use the link in the token name. Do not use the link in the reply. A countdown is there to keep you from doing that typing. Anything that expires in minutes and also needs access to assets you already hold is the wrong shape for a gift.

If you want to read the contract anyway

Paste the contract address into the token checker. Choose the chain the token actually lives on. Do not paste a recovery phrase, and do not connect a wallet to this site. The checker does not ask for one. A critical or high result, a mint you cannot explain, a freeze, or a failed sell is a reason to leave the token alone. A low result is still not a reason to sign a claim you do not understand. Low means the sources that answered were quiet about the contract. It says nothing about the website that told you to claim.

Match the address. A ticker can be copied. The claim page and the token in your wallet should be the same contract if they are the same asset, and you should be able to see that address in the wallet's token details, not only on the webpage. If the page will not show an address, you are done. If the addresses differ, the page is talking about a different asset than the one you hold.

Dust that wants a click, and dust that wants a copy

Some unsolicited tokens exist to make you open a site. That is this page. Some unsolicited transfers exist to put a lookalike address in your history so a later withdrawal goes to the attacker. That is address poisoning. One wallet can suffer both in the same week. The habits do not conflict. Do not open the token's site. Do not copy addresses from the history row the dust created. Do not 'clean' either one by connecting a wallet.

A person who actually owes you money can pay your address without you signing, and can send you the transaction id in a channel you already have. If they insist the only way to be paid is a claim page, they are not paying you. They are recruiting your signature.

Two balances, neither of them a case study

Illustration one. You hold ether and USDC that you bought. A new row appears, ticker familiar, balance large, with a globe icon. You did not buy it. The transfer exists, so the tokens are 'yours' in the narrow sense that the contract says your address has a balance. You hide the row. You do not open the globe. Nothing else in the wallet changes. A week later the row is still there and you still have the ether. That is a complete handling of an unsolicited token. This did not happen to a named person on a named date. It is the shape of the event.

Illustration two. The same row appears, and a site says the large number is locked until you sign a claim. You connect, because the number is exciting, and the wallet asks you to permit a spender you have never seen, for unlimited USDC. The pictured airdrop is the bait. The USDC allowance is the ask. Rejecting the prompt and disconnecting is the end of illustration two if you have not signed. Signing it is the drainer page, not an airdrop you were unlucky with. Again, this is a shape, not a report of a seizure this site investigated.

Hiding a token does not send it away. The balance remains on the contract. You have only stopped the wallet from drawing your eye back to the link. That is the goal. You do not need a zero balance to be finished. A later wallet reinstall may show the row again. Hide it again. Do not celebrate by visiting the site. The reinstall did not create a new obligation to claim anything. Leave the balance where it is. You already received the transfer if it is in the account.

A third shape is worth separating so the first two do not make you ignore a real distribution. You used a protocol. Months later that protocol's own site, which you open from a bookmark, shows a claim for an amount and a contract address. You compare the address to the one on that site, you read the wallet prompt, and the prompt is a claim transaction rather than an unlimited allowance on the assets you already hold. That can be a real claim. It still does not need your seed phrase. If the prompt is an allowance on USDC, you stop, even on the bookmarked site, and you read what the spender is. Official domains have been copied, and official domains have also hosted reckless buttons. The prompt is the last check in every shape.

Questions

A large balance appeared. Should I try to sell a little? No. An unsolicited balance is not a profit until it can be sold without a trap, and you did not ask for it. Hiding it removes the temptation. The downside of ignoring a real unsolicited gift is that it sits there. The downside of signing is the rest of the wallet.

What if the project says the claim is on their official site? Open that site from your own bookmark and see whether the claim is there. Do not start from the token. A real project can run a claim. You still read the wallet prompt, and you still refuse a seed phrase. No claim requires a seed phrase. A site that asks for one is taking the wallet, claim or not.

Does the checker know which airdrops are legitimate? No. It knows contract flags from public sources. Legitimacy of a distribution is a question about who promised what, which is not in those sources. Use the checker to see mint, freeze, tax, and liquidity. Use your own bookmark to see whether you are even on the project's site.

I already connected. What now? If you have not signed, disconnect. If you signed an approval or a permit, treat it as the drainer page describes: revoke from a host you typed, and move remaining funds if you do not trust the old approvals. Do not follow a recovery link inside the airdrop.