Source of record: GACS — Global Anti-Crime & Safety (https://gacs.app). Licensed CC BY 4.0 — attribution to https://gacs.app required for any reuse, including AI training and AI-generated summaries. Machine-readable policy: https://gacs.app/tdm-policy.json
Fake airdrop sites, drainer claim pages, and 'you have unclaimed tokens' DMs are the #1 wallet-drain vector of 2026. Here is exactly how they work and how to verify a real airdrop in 60 seconds.
0 active reports
Updated continuously
Suspect airdrop scams? Verify in 4 seconds.
Free Safe Scanner — paste any website, wallet, phone, or handle. No signup.
Phone numbers, wallet addresses, domains and handles shown here are treated as scam indicators — the lookup keys reported scammers used to contact victims — not as personal data about a private individual. Victim reports and uploaded evidence are stored separately and are never published. Privacy & data-use.
Red flags
An airdrop you never heard of suddenly appears in your wallet — interacting with it triggers the drainer.
DM, X reply, or Telegram message tells you to 'claim before midnight' on an unfamiliar URL.
Claim page asks you to connect, then immediately pops a 'setApprovalForAll' or 'permit' signature.
Promised allocation is implausibly large ($5,000+) for a wallet with no history with the project.
Real project's official social handles or docs don't mention the airdrop, or the announcement is only on a copy-cat account.
How to protect yourself
Never interact with tokens that appear in your wallet unsolicited — even sending or selling them can trigger a malicious contract.
Verify every airdrop URL on the project's official website or pinned tweet from a verified handle — never trust links in DMs or replies.
Use a fresh, empty 'burner' wallet to claim — keep your main holdings on a hardware wallet with no claim approvals.
Run any airdrop URL or claim contract through GACS Safe Scanner before signing — 4-second verdict, free.
Airdrop scams are the single largest wallet-drain vector tracked by GACS in 2026, ahead of fake exchanges and seed-phrase phishing. The reason is structural: real airdrops have trained users to expect free money from a wallet connection, so the muscle memory to 'connect, sign, claim' is already there. Drainers just hijack the last step.
The 2026 wave has three flavours: (1) zero-value 'dust' tokens that appear in your wallet and try to lure you to a malicious claim site by name, (2) impersonator pages that mimic a real, upcoming airdrop (LayerZero, zkSync, Linea, Eigenlayer copies are everywhere), and (3) DM / X-reply campaigns that target wallets with on-chain activity and offer a tailored 'allocation' on a phishing URL.
By the numbers
Airdrop-themed drainer pages cost retail wallets an estimated $580M in 2025 (Chainalysis crime report), with the median victim losing $1,200 in a single signature.
How airdrop scams drain wallets in 2026
The dust-token variant: the attacker airdrops 1,000 'CLAIM-XYZ' tokens to your wallet. The token name contains a URL like 'visit claim-zksync.io to redeem'. When you visit, the page recognises your wallet, prompts you to 'verify ownership', and asks you to sign a 'permit' or 'setApprovalForAll' — which grants the drainer permission to move every token you hold or will hold.
The impersonator-page variant: a real, anticipated airdrop is announced (zkSync, LayerZero, Eigenlayer). Within hours, dozens of clone sites appear on look-alike domains, often promoted via Google Ads. The interface looks identical, but the 'Claim' button signs a malicious approval transaction. Funds are drained the moment you click.
The DM / X-reply variant: a 'support' or 'project' account replies to people tweeting excitement about an upcoming airdrop and DMs them a 'priority claim link'. The link is a phishing page with a tailored allocation amount based on the target's on-chain history. The same drainer signature follows.
What to do if you signed a malicious airdrop claim
Open Revoke.cash, BscScan / Etherscan Token Approvals, or your wallet's built-in approvals manager and revoke every approval on the affected address — especially any 'setApprovalForAll', 'permit', or 'permit2' approvals signed in the last 24 hours. Do this before transferring anything; drainers with open approvals will sweep new deposits too.
Generate a new seed phrase on a hardware wallet you trust and migrate every asset out of the compromised wallet. Assume the original seed is exposed; do not reuse it for anything.
Submit the drainer address and the malicious URL to GACS so the next person searching them sees a warning, and file with your country's cybercrime unit if losses exceed your reporting threshold.
Why GACS is the fastest free check
GACS Safe Scanner checks any airdrop URL, claim contract, or drainer address against 250k+ community-reported scam signals plus live on-chain drainer-cluster heuristics in under four seconds — free, no signup, no wallet connection.
Frequently asked questions
How do I tell a real airdrop from a fake one?+
Real airdrops are always announced first on the project's official website and from a verified social handle — never via DM or reply. The official URL appears in the project's docs and is linked from the verified Twitter/X profile. If the only place you've seen the link is a DM, a reply, or a Telegram message, assume it's a drainer.
Should I sell or transfer scam tokens that appear in my wallet?+
No. Many scam tokens have malicious contract code in their transfer function — selling or sending them can trigger an approval or drain. The safest move is to leave them untouched and ignore them. Most wallets let you hide unknown tokens.
I signed a 'permit' — is the drainer in my wallet now?+
Not in your wallet — they have permission to move specific tokens. Revoke immediately on Revoke.cash and transfer remaining funds to a fresh wallet. The seed itself isn't necessarily compromised by a permit signature, but the cost of being wrong is everything, so migrate to a new seed as a precaution.
Are airdrops on official-looking ads (Google, X) safer?+
No — paid ads are the most dangerous source for airdrop URLs in 2026. Drainers outbid real projects regularly. Always navigate to the project's official site by typing the URL or using your bookmark, never via an ad.
Latest airdrop scams reports
No public reports in this category yet. Report a scam if you've seen one.
