Airdrop Safety: How to Claim Airdrops Without Getting Drained
Airdrop safety comes down to three habits. Never type your seed phrase anywhere except your own wallet app. Never sign a request you do not understand. Never claim from a link you did not verify yourself. Almost every drained wallet we have seen since 2017 broke one of those three rules.
Why Airdrops Attract Scammers
Free tokens pull in people who are new, excited and in a hurry.
That makes airdrop hunters the perfect target. A claim page asks you to connect a wallet and sign something, which is exactly what a drainer needs you to do. The scam hides inside a step that looks normal.
Timing is the second reason. A big claim creates a window of a few hours where everyone searches for the same link. Fake pages buy search ads, hacked accounts post fake links and bots flood the replies. Our breakdown of fake crypto airdrops shows what those pages look like in practice.
The Seven Rules
Each rule exists because someone lost money without it.
- 01The seed phrase stays on paper.No airdrop, wallet support team or verification page ever needs it. Any site that asks is the scam.
- 02You never send crypto to receive crypto.A claim costs gas and nothing else. "Send 0.1 ETH to unlock your allocation" was a scam in 2017 and still is.
- 03The link comes from the source.Open claims from the project's official site or pinned post, or from a listing you trust. Never from a reply, a DM or a search ad.
- 04Farming happens in farming wallets.Long-term holdings belong in a hardware wallet that connects to almost nothing. Our cold wallet guide explains that setup.
- 05Every signature gets read.Approve, permit, setApprovalForAll and account delegation are the four words that should stop you.
- 06Approvals get cleaned after every claim.How to revoke token approvals is a five-minute routine. Run it monthly and after every claim session.
- 07Urgency is the scammer's product.Legit claim windows run for weeks or months. A timer that says you have four minutes is there to switch off your judgement.
The Three-Wallet Setup
Most guides tell you to use a burner. For active farming, three tiers work better, because a year of farming means connecting to hundreds of sites.
Vault wallet
- Holds
- Everything you plan to keep
- Type
- Hardware wallet
- Connects to
- Almost nothing
- If drained
- Never happens, because it never signs
Farming wallets
- Holds
- Gas plus the farm position
- Type
- Hot wallets, several of them
- Connects to
- Bridges, quests, testnets, DEXs
- If drained
- One position is gone, the rest of your portfolio never knew
Claim and clear
- Holds
- Tokens for a few hours
- Type
- The eligible farming wallet
- Connects to
- The verified claim page only
- Then
- Tokens move to the vault or an exchange the same day
A bad approval signed months ago on some testnet can never reach the airdrop itself when the tokens leave the farming wallet right away. Our pick of the best wallets for airdrops covers which wallets handle multi-chain farming well. If you only change one thing after reading this page, split your vault from your farming. Every mistake you make from then on is capped at whatever one farming wallet holds.
The Signature Test
A claim page can only ask your wallet for a handful of things. Learn to tell them apart and most drainers become harmless.
Login signature
Statement: prove you own this address
Nonce: 41c7d0 · Expires in 10 min
No token · No amount · No spender
Claim transaction
Function: claim()
Gas: ~0.0004 ETH
Preview: + 3,180 NOVA arrives in your wallet
Token approval or permit
Token: USDT
Spender: 0xD41e…8c2A (unverified)
Allowance: Max supply, no expiry
Collection approval
Collection: your Pudgy Penguins
Operator: 0x2bC9…e71F
Approved: true, every token in the collection
Account upgrade (EIP-7702)
Your account will run code from
0x8fA3…04dD
Effect: that contract controls everything in the wallet
A sign-in message proves you own the address and nothing more. A claim transaction is fine when the contract belongs to the project and your wallet preview shows tokens arriving. An approval or permit is where you stop, because you came to receive tokens and no site needs permission to spend your USDC for that.
Set approval for all is the NFT version. One signature hands an operator every NFT in a collection. The Magic Eden exploit showed how fast that goes wrong, even on a trusted platform. Account delegation is the newest trap. Since Ethereum's Pectra upgrade, a wallet can sign away control of the whole account to a contract. Any site asking you to "upgrade your wallet" or "enable smart account" during a claim gets rejected.
Pre-Claim Checklist
Run through this before every connect. It saves on your device, so it is ready next time.
- The link came from the project's own site or pinned post, or from our listing, and I typed or bookmarked it rather than clicking a reply or ad.
- The project actually announced a claim today. A surprise drop with no prior announcement is a red flag on its own.
- Every character of the domain matches the real one, including the ending (.xyz vs .com, no extra words like "-claim" or "-portal").
- The wallet I am about to connect is a farming wallet that holds nothing I would miss.
- The request says claim, not approve, permit, setApprovalForAll or upgrade, and the wallet preview shows tokens coming in.
- There is no timer, no "last 200 spots" and no stranger in my DMs telling me to hurry.
- I know what I will do five minutes after claiming: move the tokens out and revoke what I just approved.
What Is Actually Draining Wallets Right Now
Twelve patterns we see on repeat, with the one detail that exposes each.
Cloned claim pages
Pixel-perfect copies of a real claim site on a domain with one character swapped, a zero for an o, or an extra word bolted on. They buy the top search ad for the project name, so the fake often ranks above the real one during claim week.
Giveaway: the page is identical, the address bar is not.
Clones of this site
AirdropAlert gets copied too. Domains such as airdropsalert and airdropalerts have hosted drainers, and one full clone even hotlinked our own banners while posing as us. We broke that one down in our fake AirdropAlert clone warning.
Giveaway: we have one domain, airdropalert.com, and we never ask you to connect a wallet to read a listing.
Approval and permit drainers
The "Claim" button quietly asks for a token approval or a gasless permit instead of a claim. Nothing leaves at that moment, which is why people walk away thinking the claim failed. The sweep comes minutes or days later.
Giveaway: you expected to receive and the popup talks about a spender.
Fake eligibility checkers
"Connect to see your allocation" pages for airdrops that do not exist yet. Checking eligibility never needs a signature, because eligibility is public on-chain data. Our own airdrop eligibility checker works from a pasted address for exactly that reason.
Giveaway: a checker that wants a signature instead of an address.
Helpful strangers
Post a question in a Discord or reply thread and three "admins" appear in your DMs within a minute, each with a form or a "sync wallet" link. Project teams, wallet companies and AirdropAlert staff do not open DMs with users, ever.
Giveaway: the help arrived before you asked that person for it.
Human-check traps
Telegram and Discord "verification" that asks you to run a command on your computer, scan a QR code with your wallet, or log in with your phone number. Each one hands over your machine, your wallet session or your Telegram account.
Giveaway: a captcha should take a click. This one wants your keyboard or your phone.
Bait tokens and NFTs
Random tokens worth "$4,000" show up unannounced, usually with a URL in the ticker. The value is fake and the only way to "sell" is the phishing site in the name. Hide them in your wallet and never interact with them.
Giveaway: you never did anything to earn it.
Address poisoning
Dust transfers from an address engineered to share the first and last characters of one you use often. Weeks later you copy it from your transaction history and send real money to the wrong place. Save addresses in your wallet's address book and never copy from history.
Giveaway: a zero-value transfer you never asked for, from an address that looks familiar.
Security alerts from your wallet brand
Breached vendor mailing lists mean phishing now arrives from the real sender domain. Our founder got a fake Trezor alert that passed every check his inbox runs. The STM32 entropy vulnerability email read better than Trezor's genuine warning the next day.
Giveaway: a hardware wallet company will never ask you to type your recovery phrase into a web form, breach or no breach.
Copycat tokens
When a real airdrop token launches, dozens of same-name tokens launch alongside it within minutes. Buying the wrong one is the most common self-inflicted loss we see. Our founder has done it himself, grabbing a pair address instead of the token. The memecoin due diligence routine exists because of that.
Giveaway: you took the contract from a chart or a reply, not the project's announcement.
Paid alpha groups
Groups selling "guaranteed allocation" lists, insider snapshots or wallet-boosting services. The information is either public or made up, and the payment wallet is the product. Real eligibility is decided on-chain by the project, not sold in a Telegram channel.
Giveaway: anyone selling certainty about an airdrop that has not been announced.
Second-round "recovery"
The moment you post about a loss, accounts appear offering to trace and retrieve the funds for an upfront fee. Blockchains do not have an undo button. Our honest answer on whether stolen crypto can be recovered covers the narrow cases where something is possible.
Giveaway: a fee before any result. That is scam number two.
How We Vet Airdrops, and What Vetting Cannot Do
Every airdrop on AirdropAlert gets tested by our team before it is listed. Vetting has limits, and you should know them.
What we check before listing
- We join the campaign ourselves and walk through every step
- We check the contract and the claim flow for approvals that should not be there
- We read the team, socials and funding against the warning signs on this page
- Paid listings go through the same checks. Listings that fail do not go up
What no directory can promise
- A project that was clean at listing can rug months later. Our crypto rug pull guide shows how often that happens
- An official X account can get hacked and post a fake claim link
- A domain can expire and get bought by a phisher
- We re-check active listings, but nobody can watch every project every hour
Treat a listing as a starting point, not a guarantee. The rules on this page apply to every link on this site, including ours.
If You Think You Have Been Drained
The first hour decides how much you keep. Work down this list and skip nothing.
- On a device you trust, set up a fresh wallet with a fresh recovery phrase and sweep every remaining asset into it, highest value first.
- Open an approval checker and revoke everything on the compromised wallet. Drainers leave approvals open and return when new tokens land.
- If funds moved without any signature from you, the recovery phrase itself has leaked. Retire it for good. Our seed phrase vs private key guide explains why one leak compromises every account in that wallet.
- Flag the drainer address and the phishing domain to the project, to your wallet provider and to a public scam database so the next person gets a warning screen.
- Until you know exactly how it happened, run your remaining holdings in crypto bunker mode: cold storage, no new connections.
Report a Bad Link
If a link on any AirdropAlert page took you somewhere wrong, tell us the same day. Message us on X at @Airdropalertcom or email support@airdropalert.com. We pull the link, re-check the listing and warn our readers. Reports like that have caught compromised projects before most people noticed.
Our Official Accounts
Nobody from AirdropAlert will message you first, ask for a recovery phrase, or ask you to deposit anything anywhere.
- x.com/Airdropalertcom
- t.me/airdrop_alert_dot_com
- support@airdropalert.com
A different handle, a different domain ending or an "AirdropAlert support" account is an impersonator. There is one website, airdropalert.com, and one of each account above.
FAQ
The questions we get asked most about airdrop safety.
Can an airdrop drain my wallet just by connecting?
No. Connecting only shares your public address. The damage happens when you sign. Read every request before approving it.
Is it safe to claim airdrops with my main wallet?
It is a bad habit. Use a separate farming wallet for claims and move the tokens to your vault afterwards.
Does a hardware wallet protect me from airdrop scams?
It protects your keys, not your decisions. A bad approval signed on a hardware wallet works exactly like one signed on a hot wallet.
How do I know if a claim link is real?
Open it from the project's official site or pinned post, or from a listing you trust. Check the URL letter by letter before connecting.
What should I do with unknown tokens that appear in my wallet?
Hide them and never interact with them. Selling them leads to a phishing site or a malicious approval.
Can I get my crypto back after a scam?
Almost never. On-chain transfers are final. Anyone promising recovery for a fee is running a second scam.
Does AirdropAlert vet every airdrop it lists?
Yes, our team tests every listing first. Vetting cannot predict a future rug or a hacked account, so the rules on this page still apply to every link.