Giveaways that are not
The version that asks you to send first is a decade old and still running. The version that asks you to claim is newer, costs nothing to try, and empties the wallet instead.
Two different frauds share one costume. Understanding which one you are looking at matters, because they take your money by opposite mechanisms and only one of them requires you to send anything.
Version one: send to receive
"Send 1 and get 2 back." It runs under the borrowed name of an exchange, a founder, a company or a state, usually with verified-looking accounts, a livestream re-uploaded from a real event, and a countdown.
Every instance of this, for more than a decade, in every language, has been theft. The address never sends anything back, because there is no mechanism by which it could. It persists for one reason: it costs nothing to run, and out of a hundred thousand viewers a handful try it.
Version two: claim your allocation
Newer, more convincing, and more dangerous — because it asks for nothing up front. A page announces that your wallet is eligible. You connect, you press claim, and one of three things happens.
The transaction is an approval granting a contract permission to move a token you already hold — often unlimited, often for the most valuable thing in the wallet. Or it is a signature that is not a transaction at all, authorising a transfer to be executed later, which is why nothing appears to happen when you sign. Or, worst, the claim page asks you to import your wallet to receive the tokens, and that is simply the phrase, requested politely.
The mechanics are the subject of wallet drainers and signatures; this page is about how you end up on the page in the first place.
A real airdrop does not need permission over your existing tokens
Receiving something requires nothing from you at all — coins can be sent to an address without its owner doing anything. If a claim asks for an approval on an asset you already hold, the thing being claimed is your asset.
Where the pages come from
Tokens that appear in your wallet by themselves. Anyone can send a token to any address. The name is often a URL, and the entire purpose of the token is to advertise the claim site. Do not interact with it — not to sell it, not to "get rid of it".
Replies and comments under real announcements. When a genuine project does announce a distribution, the replies fill with copies of it within minutes, including copies of the official account.
Paid search results and sponsored posts, same as clones.
Aggregators listing "upcoming airdrops", some legitimate, some paid placements, some links to claim pages that harvest.
Checking one before you connect anything
- Find the announcement on the project's own siteNavigated to yourself, not through the link that brought you. If the distribution is real, it is documented there.
- Check whether a claim is even requiredMany real distributions simply arrive. A mandatory claim page is where the risk lives.
- Use a wallet holding nothingA separate address with only the fee asset. Then a malicious approval has nothing to approve.
- Read what you are signingAn approval names a token and a spender; a transfer names a recipient and an amount. A wallet warning about an unlimited allowance is the last honest signal you will get.
- Treat urgency as the answerCountdowns exist to prevent step one. A genuine allocation that expires in four minutes has never existed.
If you have already signed something and the wallet is emptying, speed matters more than understanding — the ordered steps are here.