A crypto airdrop may be a legitimate distribution, an unsolicited token, or a lure to a fake claim page. Seeing a token in a wallet does not prove that it is valuable or safe to interact with. Before connecting a wallet or signing anything, verify the campaign and understand exactly what the requested action does.
Start with the project’s official channels
Navigate to the project’s website using a bookmark or a link from a well-established official account. Check that the domain is spelled correctly and that the airdrop announcement is published by the project itself. Be cautious of direct messages, paid search ads, comments, and forwarded links that claim a deadline or guaranteed reward.
Look for consistent details across official sources: eligibility rules, supported networks, token contract address, claim dates, and the exact steps required. If the project has no clear announcement or the terms conflict across channels, stop and verify through another official route.
Inspect the token and network details
Confirm the network and token contract address against the project’s official documentation. Similar names and logos are easy to copy. A block explorer can show a contract and transaction history, but it cannot establish that a token is endorsed by a project unless the address matches a trusted source.
Some scam tokens are sent to wallets without permission. MetaMask’s safety guidance warns users not to follow unsolicited token prompts that lead to sites requesting personal data or a recovery phrase. Never enter a seed phrase or Secret Recovery Phrase into an airdrop site; a legitimate claim should not need it.
Read the wallet request before signing
A wallet connection alone generally shares an address with a site, but the next prompt may ask you to sign a message or submit a transaction. Read the full request and verify the network, destination, and permissions. Treat requests to approve token spending, set a broad allowance, or transfer assets as high risk unless you understand and independently expect that action.
- Reject requests that ask for your recovery phrase, private key, password, or remote access.
- Do not sign a transaction whose purpose, token, amount, or destination is unclear.
- Check whether an approval grants access to one amount or an unlimited allowance.
- Use a separate wallet with limited funds for unfamiliar applications when appropriate.
- If you already approved a suspicious contract, use the relevant network’s trusted tools to review and revoke permissions; revocation itself may require a network transaction fee.
For a broader review of suspicious pages, see our guide on verifying a crypto website before connecting a wallet. Our articles on common crypto phishing scams and reviewing wallet prompts cover related warning signs.
A quick claim checklist
- Open the project’s official site independently; do not trust a link from a stranger.
- Confirm the campaign, eligibility, network, and contract address from official documentation.
- Check the domain carefully and look for a clear privacy policy and claim terms.
- Read every wallet message and transaction before approving it.
- Never reveal a seed phrase or private key to claim tokens.
- Walk away from urgent pressure, guaranteed returns, or a request to send funds first.
Legitimate campaigns can still involve phishing around them, and eligibility is not a promise of token value. If the claim flow is unclear, do not proceed. MetaMask’s guides to token safety and airdrop phishing scams provide additional examples.
Sources
This article is for educational purposes only and does not guarantee the legitimacy or value of any token or campaign.