Crypto Phishing: How Fake Airdrops and Wallet Drainers Get You

Hardly anyone loses crypto because a hacker cracked their private key. They lose it because they signed something they didn't read. Fake airdrops, address poisoning and wallet drainers look like three separate scams, but they finish the same way: you approve a transfer, an allowance or a signature, and control passes to someone else. The cryptography holds up fine. You authorised the theft.

Here's the useful part. Each of these scams leaves something you can check before you hit confirm. Below I walk through how each one works, step by step, and the single habit that beats it.

Why your signature is the whole game

A wallet does one job: it signs messages with your private key. Everything you do on-chain is a signed message, whether you're depositing to a casino, swapping on a DEX or minting an NFT. Scammers can't sign for you. So they need you to sign for them.

You'll run into four kinds of signing request, and the risk differs a lot between them:

• Plain transfers. Send X tokens to address Y. What you see is what happens. The danger is sending to the wrong Y.
• Token approvals. Functions like approve, increaseAllowance or setApprovalForAll. They let another address move your tokens later, without asking you again. An 'unlimited' approval stays valid until you revoke it.
• Typed-data signatures (Permit and similar). These are signed off-chain, cost no gas and often pass for a harmless login. A Permit signature can authorise a spender to take a set amount of a token before a deadline. The attacker submits it later.
• Login or message signatures. Usually a line of text proving you own the wallet, and normally harmless. Raw hash signing, often displayed as a meaningless string of hex, is another matter. Many wallets now block or warn on it, and for good reason.

Hold onto this split. Transfers go wrong when the destination is wrong. Approvals and Permits go wrong when the spender is wrong. Nearly every drainer you'll meet is an approval or a Permit wearing a costume.

Fake airdrops: the free money that costs everything

A typical fake airdrop runs like this:

1. A token you've never heard of lands in your wallet. Sometimes it's named after a real project. Sometimes the token name itself is a URL, like 'Claim at rewards-site.xyz'.
2. You try to sell it. It won't sell, or the swap fails. That's deliberate.
3. You visit the site in the token name, or follow a link from a reply under a real project's post. The site looks right: same logo, same colours, a countdown timer.
4. You connect your wallet and click 'Claim'. The wallet pops up a request.
5. That request isn't a claim. It's an approval or a Permit naming the attacker as spender for your most valuable token. Some kits scan your balances first and ask for the biggest one.
6. Seconds or hours later, the attacker uses that approval to sweep the tokens.

The habit that stops it: never interact with tokens you didn't ask for, and never reach a claim page through a link someone sent you. Legitimate airdrops are announced on the project's own site and verified channels. Type the address yourself or use a bookmark you saved earlier. Hide the junk token and leave it alone. Even trying to swap an unsolicited token can mean approving its contract, and that contract may be written to do something nasty.

One more tell. A real claim almost never needs you to approve a token you already own. You're receiving something. Why would the contract need permission to spend your USDC?

Address poisoning: the scam that lives in your history

This one doesn't need you to visit a website at all. It preys on a lazy habit: copying an address from your recent transactions.

1. The attacker watches the chain and sees you regularly send funds to an address, such as your exchange or casino deposit address.
2. They generate a vanity address with the same first and last several characters. With modern hardware, matching four to six characters at each end is cheap.
3. They send a transaction into your history from that lookalike. It might be a zero-value transfer of a real token, a tiny 'dust' amount, or a fake token with the same ticker as a real stablecoin.
4. Next time you go to send, you open your history, spot an address that starts and ends the way you remember, and copy it.
5. You send to the attacker. On-chain transfers are final. No chargeback.

The habit that stops it: keep a saved address book and never copy from history. When you add a new address, check the full string once, slowly, against the source. That means the deposit page of your exchange or casino, reached by typing the URL yourself. After that, always pick it from the address book. Sending a large amount to a new address? Send a small test first and confirm it arrived on the other side before you send the rest.

Wallets abbreviate addresses to something like 0x7a3F...91cE. That shortening is exactly what this attack targets. Expand it. Check the middle.

Wallet drainers: phishing as a product

Drainers are software kits sold or rented to scammers, often for a cut of the theft. The scammer brings the fake site and the traffic. The kit does the stealing. That's why drainer sites feel so polished: the hard part was built by people who do this full-time.

Common entry points:

• Fake mint pages for NFT drops, often promoted through hijacked social accounts or Discord servers.
• Copycat DEX, bridge or staking sites bought as search ads above the real result.
• Fake 'wallet verification' or 'sync' pages claiming your wallet needs fixing.
• Fake casino or trading bonus pages offering a deposit match if you 'connect to verify'.

Once you connect, the kit reads your balances and asks for the most valuable thing first. On EVM chains that's usually setApprovalForAll for NFT collections, an unlimited approve or Permit for your biggest token, or a batched transaction bundling several transfers. On Solana, watch for transactions that transfer tokens or change the owner or authority of a token account. A real mint doesn't need to do either to your existing holdings.

The habit that stops it: read the request, not the website. The website can claim anything. The wallet prompt shows what will actually happen. Many wallets now simulate transactions and show the expected balance change. If the simulation says you'll lose tokens you weren't planning to send, stop.

What to check before you sign

Run through this whenever a wallet prompt appears and you're not 100% sure what it is. It takes about thirty seconds.

1. Check where you are. Look at the full domain in the address bar. Did you arrive by bookmark or by typing it? If you came from a link in a DM, reply, ad or email, close the tab and go in fresh.
2. Name what you expect. Before the prompt opens, say what you're trying to do. 'Deposit 200 USDC to the casino.' 'Mint one NFT for a set price.' Anything in the prompt beyond that is a red flag.
3. Identify the request type. Is it a transfer, an approval, a typed-data signature or a plain text message? If the wallet shows raw hex you can't read, reject it.
4. For transfers, check the destination. Compare the full address with your address book or the official deposit page. Every character, not just the ends.
5. For approvals and Permits, check the spender. Find the spender field. Is it the contract of the app you meant to use? Look it up on a block explorer: real protocol contracts are usually verified and labelled. A fresh, unlabelled address is a warning.
6. Check the amount. If you mean to swap 200 USDC, the approval should be close to 200, not 'unlimited' or a 78-digit number. Most wallets let you edit the allowance. Do it.
7. Check the deadline on Permits. A signature that stays valid for years hands an attacker plenty of time.
8. Read the simulation. If your wallet shows expected balance changes, make sure they match step 2.
9. On a hardware wallet, read the device screen. The device shows what it's actually signing, even if your computer is compromised. If the screen says 'blind signing' or shows a hash you can't interpret, don't approve.
10. Use a burner for anything risky. Claims, mints and new apps get a separate wallet holding only what you need for that one action.

Worked example: what one check is worth

All figures here are hypothetical.

Sam keeps 6,000 USDC in a hot wallet and withdraws casino winnings to an exchange about once a week. Sam's exchange deposit address, shortened, looks like 0x7a3F...91cE.

On Monday, Sam's history shows an incoming zero-value USDC transfer from 0x7a3F...91cE. It's actually the attacker's lookalike, with a different middle section.

On Thursday, Sam wants to move 4,500 USDC to the exchange. There are three ways this can go:

The test transaction caps the damage at a few dollars. The address book stops it outright. Neither costs more than a minute. The habit that protects you from nothing is the one most people lean on: glancing at the first and last four characters.

Same week, different trap. Sam gets a token called 'BONUS-claim-site' and visits the page. The 'claim' prompt is a Permit naming an unknown spender for an unlimited amount of USDC, valid for five years. Step 5 catches it: Sam expected to receive tokens, yet the request lets a stranger take them. Reject, close the tab, hide the token.

Common mistakes

• Thinking 'no gas fee' means 'no risk'. Permit signatures are gasless. They can still hand over your tokens.
• Checking only the ends of an address. That's precisely what poisoning is built to beat.
• Trusting search ads. Scammers buy ads for the names of popular DEXs, bridges and wallets. Use bookmarks.
• Leaving unlimited approvals around for years. If a protocol you used once gets exploited, every old unlimited approval to it is exposed. Review and revoke approvals now and then with your block explorer's approval checker or a reputable revoke tool.
• Using your main wallet for everything. Your savings and your mint-chasing shouldn't share an address.
• Believing support DMs. Real support never messages you first and never asks for your seed phrase, a 'validation' signature or a test payment.
• Assuming a hardware wallet makes you immune. It protects your key from malware. It can't stop you from approving a bad request on purpose.

If you already signed something bad

Speed matters. Drainers often act within seconds, but not always.

• For on-chain approvals: revoke the approval right away, then move your remaining funds to a fresh wallet. Revoking costs a small fee and only stops future use of that approval.
• For Permit signatures: the attacker may not have submitted it yet. Move the token out of the wallet and there's nothing left to take. Some Permit systems also let you cancel outstanding signatures by invalidating their nonce, but moving the funds is the quick, sure fix.
• If you typed your seed phrase anywhere: assume the wallet is gone. Revoking does nothing, because the attacker can sign as you. Create a brand-new wallet with a new seed and move whatever's left.

FAQ

Can I claim a real airdrop without risk?

You can cut the risk a lot. Get the claim link from the project's official site, reached by typing the URL, not from social replies. Claim with a burner wallet if eligibility allows, or transfer eligible assets in only when needed. A legitimate claim should show tokens coming in, not an approval for tokens you already hold.

Is it safe to just ignore spam tokens?

Yes. Holding a junk token doesn't hurt you. Interacting with it does: trying to sell it, approving it or visiting the site it advertises. Hide it and move on.

Does a transaction simulator catch everything?

No. Simulation shows what would happen if the transaction ran right now. It can miss Permit signatures that will be used later, and some contracts behave differently once they're live. Treat simulation as one check among several, never as permission to stop reading the spender and amount yourself.

None of these scams need you to be careless in general. They need you to be careless once, for about four seconds, on one prompt. So the real question isn't whether you're careful. It's whether you have a routine that still works at 2am after a big win, when you're in a hurry to cash out.