Short answer
A fake airdrop copies a project's site and promises free tokens to anyone who connects a wallet and claims. The claim is a signature that hands the scammer the visitor's tokens. Links spread through replies on X, fake Telegram admins, Discord DMs and tokens airdropped to wallets. The FBI warned about NFT airdrop phishing in June 2025.
Who this is for: Crypto teams planning a real airdrop and communities targeted by fake ones.
How the scam runs
- The scammer copies the project's site and adds a "Claim" or "Check eligibility" button.
- The page goes up on a lookalike domain, often with the word claim, airdrop or rewards.
- Links spread where the project's users are, timed around a real announcement.
- The claim button runs a wallet drainer: the visitor signs an approval and loses tokens. Some pages ask for a seed phrase instead, to "verify" the wallet.
In June 2025 the FBI warned that criminals were "defrauding cryptocurrency users through the nonfungible token (NFT) airdrop feature", sending NFTs that lead to phishing sites which steal seed phrases.
Where the links come from
| Channel | How it looks |
|---|---|
| X replies | A copy of the project's account replies under the real announcement with a claim link |
| Telegram and Discord DMs | A fake admin writes: "you are eligible, claim before it closes" |
| Airdropped tokens or NFTs | An unknown token in the wallet with a website in its name |
| Expired Discord invites | A scammer claims an old vanity invite link and sets up a copy of the server |
ScamSniffer lists NFT and token airdrops and expired Discord links among the main sources of drainer traffic in 2024.
Real or fake: quick check
- Is the claim page on the project's own domain, the one on its official links page?
- Was it announced on the project's site and its verified accounts, not only in a reply or DM?
- Does it ask for a seed phrase? Then it is fake, always.
- Is there a countdown pushing you to sign now? Slow down.
- Did the token or NFT appear in your wallet without you asking? Do not visit its link.
If you are planning a real airdrop
- Announce the exact claim domain before the claim opens, and repeat it on your official links page.
- Never ask users to share a seed phrase or sign anything outside the claim domain.
- Watch new domains and X replies closely in the days around the launch; that is when fakes peak.
- Prepare report templates in advance. See the takedown request template.
Sources
- FBI IC3 public service announcement, June 3, 2025
- ScamSniffer 2024 report
- Discord: custom invite link
Frequently asked questions
How can users tell a real airdrop from a fake?
A real airdrop is announced on the project's own site and verified accounts, and the claim page sits on the official domain. Anything found in a reply, a DM or an unexpected token in a wallet should be treated as fake.
When are fake airdrops most common?
Around real announcements: token launches, snapshots and claim windows, when users expect a claim link and check it less carefully.