In crypto, an airdrop is a real thing — projects sometimes give away free tokens to early users. Scammers borrow that excitement to run one of the most draining tricks in the space: “claim your free airdrop, just connect your wallet.” The moment you do, your wallet can be emptied. Our GetMyPassword team explains how to recognize a crypto airdrop scam.
How the scam works
You see a post, DM or ad announcing a free token airdrop and a link to claim it. The site looks slick and urgent — limited time, limited supply. To “receive” the tokens, you are told to connect your crypto wallet and approve a transaction or sign a message. That approval is the trap: instead of sending you tokens, it grants the scammer’s contract permission to move your funds, and your wallet is drained. Other versions simply phish for your recovery phrase under the guise of “verifying” your wallet.
Red flags to watch for
- An unsolicited airdrop you never signed up for, often promoted by a random or hacked account.
- A demand to connect your wallet and approve a transaction to “claim” free tokens.
- Any request for your recovery phrase or private keys — never legitimate.
- Urgency and scarcity — “claim in the next hour or miss out.”
- A look-alike or brand-new domain impersonating a known project.
Why connecting a wallet is the danger
Receiving tokens does not require you to approve outgoing permissions — money coming in needs no signature from you. So when an “airdrop” insists you sign a transaction or grant approval to collect it, that signature is doing the opposite of what you think: it is authorizing the scammer to take what is in your wallet. And no genuine project ever needs your recovery phrase; anyone who has it controls your entire wallet forever.
Money coming to you never needs your signature. When a “free airdrop” asks you to approve a transaction or share your recovery phrase, you are not claiming tokens — you are handing over your wallet.
How to protect yourself
Treat unsolicited airdrops as scams, never connect your wallet or sign transactions to “claim” free tokens, and never enter your recovery phrase anywhere online. Use a separate, near-empty wallet for any experimental connections, and review and revoke token approvals periodically. For everything that protects access — your exchange accounts, email and recovery info — use a unique password from our password generator, two-factor authentication, and keep recovery phrases offline.
Frequently asked questions
What is a crypto airdrop scam?
It is a scam that advertises a free token airdrop and tells you to connect your wallet and approve a transaction to claim it. The approval actually authorizes the scammer to drain your wallet, or you are phished for your recovery phrase.
Why is connecting my wallet to an airdrop risky?
Receiving tokens never requires you to sign an outgoing transaction. If an airdrop asks you to approve one to “claim,” that signature can grant the scammer permission to move your funds. Real incoming transfers need no approval from you.
Should I ever enter my recovery phrase to claim an airdrop?
Never. No legitimate project or wallet needs your recovery phrase, and anyone who has it controls your entire wallet. Any request for it is a scam — keep your recovery phrase strictly offline.