Fake Airdrops and the Tokens That Appear in Your Wallet
Unsolicited tokens arriving in a wallet are not a gift. They are bait, and interacting with them is the attack.
Priya Raman · 3 min read
A token you did not buy appears in your wallet, apparently worth several hundred dollars. There is a website name in the token’s description telling you where to claim or swap it.
Everything about this is constructed, including the apparent value.
Why the balance looks valuable
Token prices in a wallet interface come from whatever liquidity pool exists for that token. The attacker creates the pool themselves and seeds it so the quoted price is high.
Nobody will buy at that price. The pool exists to produce a number in your wallet interface, and it costs very little to maintain.
The three ways it converts into a loss
The claim site. You visit the site named in the token, connect a wallet to claim or swap, and sign an approval. The approval covers assets you actually hold. The drain follows, sometimes immediately and sometimes weeks later.
The honeypot swap. You attempt to sell the token on a decentralised exchange. The contract permits buying and blocks selling from addresses other than the creator’s. Your transaction fails and you pay gas. Some versions require an approval first, which is the real objective.
Transfer-triggered logic. Some malicious contracts execute code when you attempt to move the token. This is less common and does occur.
What to do with an unexpected token
Nothing. That is the complete answer.
Do not visit the site. Do not attempt to swap it. Do not approve anything for it. Do not send it anywhere.
An unsolicited token sitting in a wallet is harmless as long as you never interact with it. It cannot move your other assets by existing.
Most wallets allow you to hide a token from the display. That is the correct response: hide it and forget it.
How to tell a real airdrop from a fake one
Legitimate distributions have properties that fakes generally do not.
| Real | Fake |
|---|---|
| Announced in advance through the project’s own channels | Appears with no prior announcement |
| Eligibility based on prior activity you actually did | Arrives at random addresses in bulk |
| Claim through the project’s documented domain | Domain appears only inside the token’s name |
| Contract address published in official documentation | Contract address matches nothing verifiable |
| No urgency | Expires in 48 hours |
The single most reliable check: go to the project’s official site by typing the address yourself, and see whether the airdrop is mentioned. If the only evidence of the distribution is the token that appeared in your wallet, there is no distribution.
The scale of this
These campaigns are sent to millions of addresses at a time. The cost per address is fractions of a cent on cheap networks, and the economics work on a very low success rate.
If you have an active wallet, you will receive these continuously. Receiving them is not a sign that you have been targeted or that anything is wrong.
The structural defence
A separate wallet for anything unfamiliar, holding a small balance, with long-term assets in a wallet that has never connected to a website.
Under that arrangement, a fake airdrop arriving is an item in a list you ignore rather than a decision you have to get right. Removing the decision is more reliable than making it correctly every time. The same logic applies to where you buy: assets acquired through an exchange you can actually contact do not arrive with a claim site attached.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.