Airdrop Scams: Malicious Tokens Flooding Your Wallet

On most public blockchains, anyone can send a token or NFT to any address without permission from the recipient. A scammer deploys a token contract, generates or buys a list of active wallet addresses, and mass distributes their asset in bulk. The cost per recipient is tiny, so a single campaign can target hundreds of thousands of wallets in one batch.

Because you never opted in, these tokens simply appear in your balance or NFT gallery. They often mimic the look of legitimate projects, using familiar logos, similar names, or trendy themes to seem credible at a glance.

• The token name or symbol frequently contains a website address or an instruction such as claim your reward.
• NFT versions may include images urging you to visit a site to unlock a prize.
• The same asset is sent to many wallets, so a quick search shows thousands of identical recipients.
• You did not sign any transaction, yet the asset shows a nonzero balance.

The airdrop is not the attack. It is the advertisement. The entire purpose of dropping a token into your wallet is to get you to read its name, grow curious, and follow the trail to a website the scammer controls.

Token metadata is fully attacker controlled, so the name field becomes free advertising space inside your own wallet. A token might be named after a fake claim portal, a counterfeit version of a real project, or an urgent message designed to trigger fear of missing out.

• The name promises a large reward that feels too good to ignore.
• It implies urgency, suggesting the claim window is closing soon.
• It impersonates a brand or event you already trust or recognize.

Every one of these techniques exists for a single reason: to move you off your wallet and onto a phishing site where the real theft happens.

When a curious user visits the website named in a scam token, they typically land on a polished page offering to let them claim their reward. The page asks you to connect your wallet, and from there the attack unfolds.

Connecting a wallet by itself only shares your public address, but the scam does not stop there. The site immediately prompts you to sign a transaction or approve a permission, framing it as a required step to complete the claim.

• A malicious token approval can grant the scammer permission to move your real tokens, not the junk one.
• A deceptive signature request may authorize a transfer or drain through a hidden delegation.
• Some pages mimic a normal claim button while quietly requesting unlimited spending allowance.

The moment you approve, the attacker can sweep the valuable assets out of your wallet. There is no real reward. The claim button is the trap, and the worthless airdropped token was only the breadcrumb that led you to it.

A more elaborate version turns the airdropped token into bait for a honeypot. Here the scammer wants you to find the token, see that it appears to be trading, and buy more of it on a decentralized exchange.

The token shows a rising price chart and apparent liquidity, so it looks like an early opportunity. You swap real cryptocurrency to buy in, expecting to sell later for a profit. The problem is hidden in the contract code.

• The contract is written so that only the creator can sell, while everyone else is blocked.
• Sell transactions revert, get taxed at extreme rates, or silently fail for ordinary holders.
• Liquidity may be pulled by the creator once enough buyers are trapped, leaving the token worthless.

In a honeypot, buying is easy and selling is impossible by design. The money you spend to buy in is the loss, and no amount of waiting unlocks it because the restriction is coded into the token itself.

Two related tactics use tiny transfers rather than flashy reward tokens. Both rely on small amounts to manipulate or track you.

Dusting sends a minuscule amount of a token or coin to many addresses. Analysts then watch how that dust moves to cluster addresses together and de-anonymize wallet owners, which can fuel targeted phishing or extortion later.

Address poisoning is more direct and aims to steal during your next transfer. The scammer creates a lookalike address that shares the same first and last characters as one you frequently use, then sends a token from it so it appears in your transaction history.

• You later copy an address from history instead of your saved contact, and the lookalike slips in.
• You verify only the first and last few characters, which match, and miss the different middle.
• You send funds to the attacker rather than your intended recipient.

The defense is to never copy addresses from transaction history and to verify the full address, not just the ends.

The safest response to an unexpected token is to do nothing with it. These assets cannot harm you while they sit untouched in your wallet. The risk only appears when you interact, approve, or visit the linked site.

• Do not click, swap, send, or approve the token in any way.
• Do not visit any website printed in the token name or NFT image.
• Hide or mark the token as spam in your wallet interface to remove it from view.
• Never connect your wallet to a claim site associated with an unsolicited token.
• Never sign a transaction or approval you did not initiate yourself.
• If you want certainty, inspect the contract on a block explorer before assuming anything, and still avoid interacting.

Most modern wallets let you hide spam tokens, and many automatically flag known scam contracts. Leaving the junk in place and ignoring it costs you nothing. Engaging with it is the only path to loss.