On a "claim your free airdrop" page, the "Claim" button may bring up an approval in your wallet: consent for a contract to spend your USDT from then on. What the pop-up says decides whether you are receiving tokens or handing over control of the ones you hold.
- "Claim", "Activate" or "Verify eligibility" on a claim page may have you sign an approval. Once it is given, the other side can take that token at any time.
- An approval can be for an unlimited amount with no expiry date. It stays valid until you revoke it.
- An off-chain signature that costs no gas, such as a Permit2 signature, can work as an approval too. Cancel any confirmation you can't read.
- If you have already signed: move anything valuable to a new wallet first, then revoke the approval.
How claiming an airdrop gets a wallet drained
Airdrops exist: some projects give tokens away to early users or to wallets that meet certain conditions. A fake airdrop copies how that looks.
It goes like this. In a group chat, a post or a direct message you see "the XX airdrop is open, first come first served", or you open your wallet and find a token you don't recognize. You follow the prompt to a claim page, and the page asks you to connect your wallet. Nothing has gone wrong yet. Next it brings up a window to confirm, worded "Claim", "Activate" or "Verify eligibility", and what you sign when you tap it is an approval transaction.
After that, the other side can move that token out of your wallet without your private key or seed phrase. It feels as if you never sent anything, and you didn't. What you gave away was permission for someone else to send it.
What a token approval is, and why one is enough to take your tokens
Tokens such as USDT and other ERC-20 tokens work this way: before a decentralized app (DApp) can trade or stake a token for you, you approve its contract to spend that token, and from then on it can move the token when you start an action. DeFi needs this step for ordinary use, and it is not a bad thing in itself.
Think of a direct debit on a bank account. Once you set one up for a merchant, it can take money within the agreed limits without asking for your PIN each time.
Look at the amount and the expiry
An approval request can ask for an unlimited amount (a very long number in the pop-up, or the word "unlimited") with no expiry date. In direct-debit terms, that is a mandate for any amount of that currency in the account, with no end date, where you might have expected a cap of $100. If the approval went to the other side's contract, that contract decides when the token is taken.
That is how tokens can leave a wallet that hasn't been used for a long time: the approval was signed earlier and acted on later. ethereum.org's guide to revoking token access states that there are no expiration dates on contract permissions. It recommends never allowing projects unlimited access to your tokens and revoking token allowances regularly.
It was only a signature and cost no gas. Can that drain you too?
Yes. Wallet confirmations all tend to get called "signing", but there are two kinds, and they carry different risks.
| Ordinary off-chain signature | Approval / transaction (approve) | |
|---|---|---|
| Typical use | Proving the wallet is yours, for example to log in to a DApp or join an allowlist | Giving a contract permission to spend one of your tokens |
| Goes on-chain? | Mostly not, and no network fee | Yes, and it costs a network fee (gas) |
| Moves assets directly? | Not in normal use | Once approved, the other side can take that token within the permission |
| Risk in a phishing attempt | A signature built to look harmless that works as an approval or a transfer of assets | With an unlimited amount and no expiry, one approval is enough to empty a token |
Wallets and chains display signatures and approvals differently. If you can't read a confirmation, cancel it and find out what it is asking for.
"Off-chain, so it costs nothing" does not mean safe. A request that amounts to "allow my tokens to be moved" can be presented as a signature pop-up with no gas and no mention of "approve". Permit2 signatures are the typical case. MetaMask's help center article on signature phishing explains that Permit2 is a token approval smart contract designed by Uniswap that works by using an off-chain signature. Signing is not recorded on chain, the signature can be configured to remain valid for a specified duration, and the attacker may not steal assets immediately. So the question to ask is not whether it costs money. It is whether you understand what is being requested and whether the address on the other side is one you trust.
The three ways a fake airdrop reaches you
① A fake claim page that has you sign an approval
An "airdrop claim page" made to look like the project's own site brings up a confirmation as soon as your wallet is connected. It looks like claiming tokens, but the request is an approval over the USDT or other tokens in your wallet. A countdown or "only N spots left" pushes you to tap straight through.
② A fake token or NFT lands in your wallet first, then draws you to interact
You did nothing, and a token or an NFT is in your wallet, with a web address in its name or image telling you to go there to "claim" or "redeem". Sitting in your wallet it can't hurt you. Interacting with that site can.
③ A fake "remove risk" or "check approvals" page
It presents itself as an "approval security check" or a "one-click revoke for risky approvals", claiming to scan for dangerous approvals and revoke them. The "revoke" you tap is a new approval.
An airdrop is only one wrapper. The same method turns up as an imitation DApp, bridge or NFT platform that ads and community groups send you to; as someone claiming to be official support who says your account has a problem and you must "verify your wallet"; and as "guaranteed high yield" or "staking" offers that describe the approval as the first step to earning. What they share is an invented reason why you have to sign something before you can continue.
When not to tap Confirm
- A token or NFT you never bought or took part in appears in your wallet unasked, with a web address in its name.
- "Claiming the airdrop" requires you to connect your wallet and sign a confirmation you can't read, especially one that mentions approve, unlimited or a very long number.
- The page uses a countdown, limited spots or "activate now or lose it" to keep you from reading.
- The link came from a stranger's direct message, a group "admin" or a shortened URL, that is, a way in that someone else handed you.
- It claims to check or remove risky approvals for you, and asks you to sign again.
The more a page hurries you, the more reason to cancel and read the pop-up properly before you decide.
You want to claim airdrops: how to limit what you can lose
You can take part in airdrops, as long as you have arranged beforehand that a wrong signature costs you only a limited amount:
- Set up a separate small wallet just for claiming airdrops and trying new projects, holding only an amount you can afford to lose.
- Read the pop-up before every confirmation. Is it a signature or an approval? Which contract address is it for? Is the amount unlimited? If you can't tell, cancel.
- Where you can set the amount, approve only as much as you need and don't let an unlimited amount through.
- Revoke old approvals regularly: clear out DApps you stopped using and contracts you don't recognize, and go through the list again after claiming an airdrop or connecting to an unfamiliar DApp. The tools and the steps are in the next section.
- Keep valuable assets in a hardware (cold) wallet that mostly stores and rarely interacts. Bear in mind that a hardware wallet protects the private key and cannot stop an approval you confirm yourself. If you connect a hardware wallet to a phishing site and confirm an unlimited approval, that token can still be taken. So leave trying out new projects to the small wallet above.
- Anything that turns up in your wallet unasked: don't tap it, claim it or redeem it.
You signed a suspicious approval: how to revoke it
Don't wait to find out whether anything will actually happen. Work through these in order:
Move valuable assets out first
If the wallet holds a significant amount, start by moving the assets to a brand-new wallet that has never interacted with the suspicious site. Approvals have to be revoked one at a time, and moving the assets is more direct.
Open a revoke tool and connect your wallet
The ethereum.org guide lists tools for viewing and revoking approvals, among them Etherscan's Token Approval Checker (etherscan.io/tokenapprovalchecker, Ethereum), the equivalent page on Blockscout, and Revoke.cash (revoke.cash), which covers multiple networks. Type the address into the address bar yourself. Don't arrive through a search result, an ad or a link someone sent you, because these are the tools that the third kind of page above imitates. Once there, click "Connect wallet".
Find the approval and revoke it
The tool lists the approvals this wallet has given. Find the one for the suspicious contract and click Revoke. Your wallet will bring up a new transaction to confirm. According to the guide, you have to pay the fee for the cancellation to be successful. Until the approval is gone, don't add more of the same token to this wallet. Write down the suspicious contract's address, because you will need it when you report.
Revoke the other approvals you don't recognize
While the list is open, revoke the ones you stopped using long ago and the ones you can't identify.
Keep only small amounts in this wallet from now on
A wallet that has signed something on a suspicious site shouldn't hold important assets again. Manage those from a new wallet.
If tokens have already been taken, keep the suspicious site's domain, the transaction hashes and screenshots of the chat, and see Scammed in Crypto? What to Do and Where to Report It for where to report.
Related pages
- 0 USDT in Your Wallet? How Address Poisoning Works: another use for things that turn up in a wallet unasked.
- Domain checker: its made-up examples show the tricks a fake claim-page domain uses; the tool itself only knows five exchange domains.