Fake Airdrop Tokens: Why Free Coins Appear in Your Wallet

If tokens or NFTs you never bought appear in your wallet, often with a name like “$5000 USDT reward — claim at xyz-site”, leave them alone. They are an advertisement for a phishing site. Sending a token to millions of addresses costs the attacker little, and anyone who visits the site and connects a wallet risks signing an approval or a drainer transaction. Receiving the token does not harm you; interacting with it can.

What happens, step by step

The scam follows the same path almost every time. The timeline below shows where the damage is done — and where you can stop it.

1. Drop. A token or NFT appears in your wallet. Its name, symbol or image contains a URL or a promise: “Visit … to claim”, “Voucher 2,500 USDC”.
2. Curiosity. The wallet shows it as an asset, sometimes with a fake price. You search the name or type the URL.
3. Site. A polished page imitating a known project asks you to connect your wallet to “claim” or “convert” the reward.
4. Signature. You are asked to sign — an approval, a Permit2 message, an NFT setApprovalForAll, or on Solana a transaction that transfers your assets.
5. Drain. Within minutes the valuable tokens leave your wallet. The “reward” was never real.

Some variants skip the website: the token’s own contract makes selling it impossible or triggers a fee, or the token is used to plant a look-alike address in your history — see address poisoning.

Where these tokens show up

What to do with a spam token

• Ignore or hide it. Most wallets let you hide a token from the list. That is enough.
• Do not try to sell or swap it. The swap page it points to is the trap, and some tokens are designed to fail or charge you on sale.
• Do not send it anywhere. Transferring it may require an approval, and moving scam tokens to an exchange can cause support questions.
• Burning is offered by some Solana wallets and recovers the rent deposit of the token account. It is safe when done through the wallet’s own feature, not a website.

Why wallets still show these tokens

A blockchain does not ask permission to credit an address, so the token really is in your wallet. Wallets decide what to display: some hide tokens without a known price or verified contract, others show everything they find. Fake liquidity pools can give a spam token a quoted price, so it may even appear in your portfolio total. Turning on “hide unknown tokens” or a spam filter in the wallet settings removes most of the noise without affecting real assets.

How real airdrops work

Genuine airdrops exist: projects distribute tokens to early users, often based on a snapshot of past activity. Their pattern differs from the scam in clear ways.

• They are announced on the project’s official site and verified accounts, usually with documentation of eligibility.
• Claiming happens on the project’s official domain, which you reach yourself, not through a link inside a token name.
• Some airdrops arrive without any claim; then there is nothing to sign at all.
• No real airdrop asks for a seed phrase, a payment “to unlock” or an unlimited approval of your other tokens.

When a claim really requires a signature, read it: the EIP-712 signature decoder shows whether it is a harmless claim message or a permit giving someone your tokens. Check the domain first with the phishing link checker.

A quick way to verify a claim: search the project’s name together with “airdrop” on its official website or documentation, not in a search engine’s ads. If the official site says nothing about a distribution, there is none.

If you already connected and signed

1. Revoke approvals on that network immediately — how to revoke token approvals.
2. Move remaining assets to a new address if you signed a transaction you do not understand, especially on Solana where the transaction itself may have moved ownership.
3. Report the site to your wallet provider and to phishing lists; report losses to the police with the transaction hashes.