Skip to main content
Category: Frauds → Giveaway & Airdrop FraudsFraudsGiveaway & Airdrop FraudsFake Airdrop SitesReading time: 10 minutes
Risk level: Critical
Target audience: Airdrop hunters, retail

​
Meet Chinedu

Chinedu is a 24-year-old airdrop hunter. He searches for new projects and airdrops, hoping to claim free tokens that might become valuable. He has a portfolio of maybe 50 different small-cap tokens from airdrops. One day, he gets a notification from a Telegram airdrop bot:
”🎁 Ethereum Classic Airdrop Distribution Claim your FREE ETC tokens now! Eligible: All ETH holders before [date] Click here to claim: [link to fake site]”
Chinedu remembers owning some ETH at that date. He’s eligible! He clicks the link and is taken to a professional-looking website:
  • Domain: ethereumclassicdrop.io
  • UI matches legitimate airdrop sites
  • Clear instructions: “Connect Wallet” button
  • Explanation of the airdrop
He connects his MetaMask wallet.

​
What Happened

​
Step 1: The Connection Trap

The website asks MetaMask to connect. MetaMask displays:
“ethereumclassicdrop.io would like to:
  • View your account address and balances
  • Suggest transactions to you
OK | Cancel”
Chinedu clicks OK.

​
Step 2: The Approval Request

The site displays: “Verifying your eligibility… This may require one approval transaction.” MetaMask pops up:
“ethereumclassicdrop.io is requesting your signature. Message to sign: ‘Verify airdrop eligibility for [his address]’ Sign | Reject”
Chinedu signs.

​
Step 3: The Hidden Trap

What Chinedu doesn’t realize is that the “sign” request was not a simple message—it was a transaction. Specifically, it was calling setApprovalForAll() on a malicious contract, granting the website’s contract unlimited access to move all his tokens. MetaMask’s UI showed “Sign message” but the actual operation was a token approval. The moment Chinedu signed, the website’s contract gained the ability to move any of his ERC-20 tokens. The site then displays: “Airdrop claimed! Your tokens will arrive in 24 hours.” But that was a lie.

​
Step 4: The Drain

Within minutes, the website’s backend script uses the approval to call transferFrom() on all the tokens in Chinedu’s wallet. His USDC is drained. His small-cap airdrop tokens are drained. Any stablecoins are drained. Total loss: ~₦1,200,000 in various tokens. Chinedu only realizes this happened when he tries to move tokens later and sees a “zero balance” error. He checks BscScan and sees dozens of outbound transfers to unknown addresses, all signed with transactions that look like he authorized them. He was socially engineered into approving his own wallet’s drainage.

​
Where the Scammer Won

  1. Legitimate-looking site: Professional UI, correct domain setup (fake but close to real).
  2. Approval trick: The “sign message” request was actually a token approval. MetaMask displayed it as a harmless signature, but it granted full access.
  3. Airdrop FOMO: People want free tokens, so they don’t verify carefully.
  4. No clear indication of danger: The MetaMask popup didn’t explicitly warn that he was granting access.

​
What Chinedu Could Have Done (Prevention)

​
Before Connecting

Verify the airdrop officially. Check the legitimate project’s official website, not a Telegram bot link. The real Ethereum Classic would announce airdrops on their official channels.
Never connect a wallet with significant funds to an unknown site. Even if it looks legitimate.
Use a separate “test” wallet for airdrop hunting, with minimal funds.

​
Before Approving

Read what you’re signing. If MetaMask says “Sign message” but the content looks like a contract interaction, stop.
Be suspicious of “approval” requests during airdrops. Legitimate airdrops do not ask you to approve contracts.
Look for human-readable information. Modern wallets (Rabby, FireWallet) show what you’re actually doing. If a wallet or site tries to hide the action, it’s hostile.

​
Red Flags Checklist

  • Airdrop site asks to connect a wallet.
  • Site requests signatures or approvals before claiming.
  • Domain is similar to but not exactly the real project’s domain.
  • Airdrop announced on Telegram bots, not official channels.

​
If You Already Connected and Approved

1

Revoke Approvals Immediately

Use Revoke.cash or EtherScan’s token approval tool to revoke all approvals.
2

Move Remaining Funds

Move remaining funds to a new wallet (fresh seed phrase).
3

Report the Site

Report to ChainAbuse.
4

Report to Law Enforcement

If the loss is significant, report to local authorities.

​
How Fake Airdrop Sites Work

What happens: Scammer creates professional-looking website with domain similar to legitimate project. Site mimics real airdrop claim pages.
What happens: Fake airdrop is promoted via Telegram bots, Discord, or social media. Claims eligibility for holders of popular tokens.
What happens: Site asks user to connect wallet. This seems normal for airdrop claims.
What happens: Site requests “signature” that is actually setApprovalForAll() granting unlimited token access. User signs thinking it’s just verification.
What happens: Site’s backend uses approval to transfer all tokens from user’s wallet. Funds are moved to scammer’s address.

​
Key Learning

Never approve unknown contracts, even “temporarily” for an airdrop. If a site asks for an approval during an airdrop, it’s 99% a scam.

Send-to-Receive Giveaway

See how fake giveaways steal funds

Grant Phishing + Wallet Drainer

Similar wallet drainer tactics

Frauds Category

Explore all types of giveaway and airdrop frauds

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. MetaMask - How to Identify Scam Sites
  2. Revoke.cash - How to Revoke Token Approvals
  3. ChainAbuse - Report Scam Addresses