Disclosure: I wrote this article as an entry for the AirdropBuzz creator campaign. I was not paid by any project mentioned here, I hold none of the tokens…
Disclosure: I wrote this article as an entry for the AirdropBuzz creator campaign. I was not paid by any project mentioned here, I hold none of the tokens discussed, and every statistic below is quoted from the public report linked in the sources. The page looks perfect. The logo is right, the countdown is ticking, and the button says "Claim". Then the wallet opens and asks you to sign something you do not recognise.
That moment — not the page, not the tweet, not the countdown — is where a fake airdrop either works or fails. The numbers explain why the attackers keep building these pages. Scam Sniffer's 2024 report found that wallet drainers stole roughly $494 million across about 332,000 victim addresses, a 67% increase in losses year over year, with the largest single theft at $55.48 million.
Chainalysis put total on-chain scam revenue in 2025 at at least $14 billion, possibly $17 billion once more addresses are attributed — investment scams were the dominant category, and approval phishing is one of the ways they play out on-chain. The drainer numbers show how the loss happens at the wallet: not from someone voluntarily sending coins to a stranger, but from a signature that looked like a claim. Here are the seven checks I run before I connect a wallet to anything that promises free tokens. 1.
Check where the link came from, not what the page says The first question is not "is this airdrop real?" It is "did this URL come from the project itself?" Open the project's official documentation, GitHub organisation, or verified social account and follow the claim link from there. Do not use a link from a DM, a Telegram forward, a comment, or a sponsored post. Look at the domain character by character.
Drainer operators register lookalikes that swap an l for an I, add a hyphen, or use a different top-level domain. A page that is pixel-identical to the real one costs them almost nothing to build. The domain is the part they cannot copy. If the claim is framed as urgent — "last 30 minutes", "first 5,000 wallets only" — treat that as a design choice aimed at stopping you from doing this check. 2.
This is a source-linked briefing. Read the original report from Dev Community .