How do crypto airdrops work, and how do you spot an airdrop scam?

A crypto airdrop is a free distribution of tokens to a list of wallet addresses, usually to reward early users or spread ownership of a new project. The project takes a snapshot of on-chain activity, decides who qualifies, and either sends tokens directly or lets eligible wallets claim them through a smart contract. Scams copy this process to trick you into signing a harmful transaction or revealing your seed phrase, but a real airdrop never needs your seed phrase and never asks you to send funds first.

Why projects do airdrops

• Reward early users. People who used a protocol before it had a token get a share of it.
• Decentralize ownership. Governance tokens spread across many holders give voting power to a wider group.
• Marketing. A widely held token gets attention, listings and new users.
• Bootstrap a community. Recipients have a reason to keep using and promoting the project.

The most cited early example is Uniswap. In September 2020 it gave 400 UNI to every address that had interacted with the protocol before a cutoff date. Many later projects followed the same basic template.

How an airdrop works, step by step

1. Set the rules. The team decides what qualifies: past transactions, holding a certain token, providing liquidity, using a testnet, or collecting points.
2. Take a snapshot. At a specific block, the team records which addresses met the criteria and how much each should receive.
3. Filter out Sybils. A Sybil is one person pretending to be many by using lots of wallets. Teams analyze funding patterns and behavior to remove suspected farm accounts.
4. Publish the distribution. Either tokens are sent directly to wallets, or a claim contract is deployed.
5. Claim window. Users visit the official site, connect a wallet and submit a claim transaction. Unclaimed tokens often return to the project treasury after a deadline.

Push versus claim

Method	How it works	Who pays the fee
Direct transfer (push)	The project sends tokens to every address	The project
Claim contract (pull)	Each user proves eligibility and claims	The user

Claim contracts are more common for large lists because sending to thousands of addresses is expensive. Most use a Merkle tree, a data structure that lets the contract store one short fingerprint (the Merkle root) of the whole eligibility list. When you claim, the website supplies a short proof that your address and amount are in the list, and the contract checks it:

claim(index, account, amount, merkleProof)
  -> verify proof against stored merkleRoot
  -> mark index as claimed
  -> transfer amount to account

A legitimate claim transaction calls a function like this. It does not ask you to approve spending of your other tokens.

Types of airdrops

• Retroactive: rewards past use, announced after the fact.
• Holder: goes to people holding a specific token or NFT at the snapshot.
• Points-based: users earn points for activity, later converted into tokens. Conversion rates are often unknown in advance.
• Task-based: requires social media follows, sign-ups or small transactions. Low-effort tasks attract many bots.

There is no guarantee any activity will be rewarded. Using a protocol only because you hope for an airdrop can cost more in fees than you ever receive.

How airdrop scams work

Scammers exploit the fact that people expect free tokens and act quickly. The main techniques:

Fake claim sites. A lookalike website, promoted through fake social accounts, replies to real announcements or paid search ads, asks you to connect your wallet and "claim". The transaction you sign actually grants the attacker permission to move your tokens or NFTs.

Malicious approvals and signatures. On Ethereum-style chains, a token approval lets a contract spend your tokens later. Scams request unlimited approvals, setApprovalForAll for NFT collections, or off-chain permit signatures. A permit is a signed message, not a transaction, so it costs no gas and can look harmless, but it can authorize a transfer just the same.

Seed phrase requests. A "wallet validation" or "sync" page asks for your recovery phrase. Anyone with that phrase controls your wallet completely.

Unsolicited tokens. Random tokens appear in your wallet, often with a website address in the token name. Visiting the site leads to a drainer. Some of these tokens are also built so that approving or selling them triggers a malicious contract.

Pay-to-claim. You're told to send a "gas fee" or "unlock fee" to receive your airdrop. The payment is simply stolen.

Address poisoning. Scammers send tiny or zero-value transfers from an address that looks like one you use, hoping you'll copy it from your history next time you send funds.

Impersonated support. Fake "support agents" in Discord, Telegram or X direct messages offer help with your claim and steer you to a malicious link.

Red flags

Legitimate airdrop	Likely scam
Announced on the project's official site and verified accounts	Found through DMs, replies, search ads or a token in your wallet
Claim transaction calls a claim function	Asks for token approvals, setApprovalForAll or a permit signature
Costs only the normal network fee, paid to the network	Asks you to send tokens or a fee to an address
Never asks for a seed phrase or private key	Asks you to "validate", "sync" or "restore" your wallet
Eligibility can be checked on the official site	Urgent countdowns and "only 10 minutes left" pressure

How to claim safely

1. Get the link from the source. Navigate to the project's official website yourself, and cross-check the claim URL with its official documentation and verified accounts. Bookmark it.
2. Use a separate wallet. Keep long-term holdings in a wallet that never connects to new sites. Use a different wallet for claims and experiments.
3. Read what you sign. Wallets increasingly show whether a request is an approval, a permit or a simple transfer. If it mentions spending, approving or "all" of anything, stop.
4. Ignore tokens you didn't expect. Don't visit links in token names, and don't try to sell or approve unknown tokens.
5. Check addresses in full. Compare every character, not just the first and last few.
6. Review and revoke approvals. Block explorers such as Etherscan have token approval checkers, and there are dedicated revoke tools. Remove approvals you no longer need.
7. Use a hardware wallet for anything valuable. It won't stop you signing a bad transaction, but it keeps the key off your computer.

Also remember that in many countries, airdropped tokens count as taxable income when received. Rules vary, so check local guidance.

Key takeaways

1. An airdrop distributes free tokens to addresses chosen from a snapshot of on-chain activity.
2. Most large airdrops use a Merkle-tree claim contract that you call to collect your share.
3. A real claim never needs your seed phrase and never asks you to pay a fee to an address.
4. Approvals, setApprovalForAll and permit signatures on a "claim" page are the classic drainer signs.
5. Use official links, a separate wallet for claims, and revoke approvals you don't need.