A message lands in your Telegram or X inbox: "Congratulations, you qualify for the community airdrop. Connect your wallet to claim 500 tokens before midnight." You connect, click a few buttons, and nothing arrives. Two days later your stablecoins are gone, and you never typed your seed phrase anywhere.
That is how a wallet drainer usually works. It doesn't need your secret words. It needs you to sign one permission, and most people don't know what they just signed. This guide explains the mechanics, how to spot the traps, and how to check and cancel old permissions today.
What an airdrop really is, and why scammers copy it
A genuine airdrop is a project giving free tokens to wallet addresses, usually to reward early users or build a community. Some are real and some are marketing. Many legitimate ones simply deposit tokens into your wallet, or ask you to claim on the project's official site.
Scammers copy this format because the word "free" lowers your guard, and because connecting a wallet feels harmless. It isn't always harmless. What matters is what you approve after connecting.
How a wallet drainer works
There are three common mechanics. Knowing them helps you read a wallet pop-up properly instead of tapping "Confirm" out of habit.
1. The token approval (allowance)
On networks like Ethereum, BNB Chain and Polygon, tokens such as USDT or USDC can be spent by an app only after you approve it. The approval can be for a small amount or "unlimited". A drainer site asks for an unlimited approval, then later moves your whole balance of that token to the scammer's address. You may not notice until days afterwards, because the approval and the theft happen separately.
2. The blind signature
Some pop-ups show a block of unreadable text and ask you to "sign". Certain signatures can authorise transfers without sending a transaction from your side at that moment. If your wallet can't show you in plain words what you are allowing, treat it as a warning.
3. The fake token that "claims" itself
A random token appears in your wallet with a name like "Claim Rewards at some-site.xyz". Visiting that site and connecting is the trap. The token itself costs the scammer nothing to send you, and it exists only to lure you. Ignore it. Don't sell it, swap it or interact with it.
Note that a drainer doesn't need your seed phrase for any of these. If someone does ask for your seed phrase, that is a different and even simpler scam. Our post on choosing and securing a crypto wallet covers how to protect it.
Warning signs of a fake airdrop
- Urgency. "Claim in the next hour" is pressure, not a feature.
- You were messaged first. Real projects rarely send unsolicited direct messages with claim links. Hacked accounts of real projects do, so a familiar name doesn't prove anything.
- The link is slightly off. Extra words, odd endings, swapped letters. Always compare with the address on the project's verified profile, and be aware that scammers also buy search ads.
- You must pay first. A "gas fee" or "verification deposit" to receive free tokens is a classic sign.
- Unlimited approval for a claim. Claiming free tokens should not need permission to spend your USDT.
- Guaranteed returns attached. "Claim, stake and earn daily" is often a investment scam in disguise. See our guide to crypto scams targeting Nigerians.
- A "support agent" appears. If you post a problem in a public group and strangers DM offering help, they are almost always scammers.
Step by step: check and revoke your approvals
Do this now, even if you've never clicked a suspicious link. Old approvals from apps you tried months ago stay active until you cancel them.
- Collect your public wallet addresses. The address you share to receive funds is public and safe to use for checking. Never paste your seed phrase anywhere in this process.
- Open an approval checker. Revoke.cash is a well-known tool, and block explorers such as Etherscan and BscScan have their own "Token Approvals" pages. Type the address into the site yourself instead of following a link from a message or an ad.
- Select the right network. Approvals exist per network. Check Ethereum, BNB Chain, Polygon and any other chain you've used.
- Read the list. You'll see the token, the spender (the contract allowed to move it) and the amount allowed. Look for "unlimited" entries and spenders you don't recognise.
- Revoke what you don't need. Each revoke is a small on-chain transaction, so you'll pay a network fee in that chain's native coin (ETH, BNB and so on). Keep a small amount for this.
- Re-check the list. Confirm the entries disappeared.
Solana and some other networks handle permissions differently, so the exact tools differ. Check your wallet's help pages for its own permission or connection settings.
Revoking a connection is not revoking an approval
Disconnecting a site in your wallet only removes the link between the site and your wallet. It does not cancel a token approval already granted. You need both: disconnect the site and revoke the approval.
A worked example (hypothetical)
Say Amaka holds the equivalent of ₦400,000 in USDT in a self-custody wallet for dollar savings. She sees an airdrop post, connects her wallet and signs what looks like a "verification". The site had actually requested an unlimited USDT approval.
Three days later, a transfer empties the balance. If she had noticed within minutes, a revoke would have cost a small network fee and saved the whole amount. Once the funds move, a blockchain transfer generally can't be reversed, and tracing the receiving address rarely gets money back.
The lesson: the approval is the dangerous step, and a monthly five-minute check is cheap by comparison.
If you think you've already been drained
- Stop signing anything. Don't try to "recover" funds through a new site.
- Move remaining assets. Create a brand new wallet with a new seed phrase, written down offline, and transfer what's left. A wallet that signed a malicious request may stay at risk, and a compromised seed phrase can't be fixed.
- Revoke approvals on the old wallet if you still hold anything there, keeping in mind the network fee.
- Save evidence. Screenshots of the site, the message, your wallet address, the transaction hashes and the scammer's address and profile.
- Report it. Report the scam account to the platform where it contacted you, and to the exchange if funds were sent to one. For Nigerian authorities, check the official websites of the police and relevant regulators for current reporting channels, since these can change.
- Beware recovery scammers. People who promise to "trace and return" your crypto for an upfront fee are usually a second wave of the same fraud.
Habits that cut your risk
| Habit | Why it helps | Cost |
|---|---|---|
| Use a separate "hot" wallet for experiments | A drained wallet only loses what's in it | Free, a few minutes |
| Keep savings in a wallet you rarely connect to sites | Fewer approvals, fewer chances to sign something bad | Free |
| Approve exact amounts when the app allows it | Limits the damage of a bad approval | Possibly an extra transaction fee later |
| Monthly approval check | Catches forgotten permissions | Small network fees per revoke |
| Hardware wallet for larger amounts | Shows transactions on a separate screen and keeps keys offline | Device purchase |
| Bookmark official sites | Avoids fake look-alike links from ads and DMs | Free |
A hardware wallet doesn't make you immune. If you approve a malicious request on it, the funds still move. It only protects the keys, not your judgment.
Common mistakes
- Testing the link with a small wallet "just to see". The drainer takes whatever is there, and the wallet may then be flagged by the same operators for future attacks.
- Assuming a verified badge means safety. Accounts get hacked and badges can be bought.
- Trusting a mobile browser inside a wallet app without checking the address. Small screens hide the full URL. Expand it.
- Ignoring wallet warnings. If your wallet flags a site as suspicious, close it.
- Joining a "claim party" in a group chat. Social proof from other accounts is easy to fake.
- Keeping unlimited approvals "because it's convenient". It's convenient mainly for whoever exploits that app later.
Frequently asked questions
Can a drainer steal from me if I only connect my wallet?
Connecting alone usually only lets the site see your public address and balances. The loss happens when you sign an approval or a message. Still, treat connecting to unknown sites as a risk and decline anything you can't read.
Does a hardware wallet protect me from fake airdrops?
It protects your private keys from malware on your phone or laptop. It can't stop you from approving a bad request. Read every prompt.
Are all airdrops scams?
No, but unsolicited ones are risky. If you're interested in a project, go to its official site by typing the address yourself, and check whether others have confirmed the claim process independently. Never pay to receive an airdrop.
Can I get stolen crypto back?
Rarely. Blockchain transfers are generally irreversible. Reporting helps and, if funds reached a regulated exchange, it may be able to act on a valid request, but don't count on it. Prevention is where the real protection is.
Is it safe to paste my wallet address into a revoke tool?
Yes, a public address can be checked by anyone. It's never safe to enter your seed phrase or private key into any website, including revoke tools.
Your next step
Open an approval checker today, type in your address manually, and revoke every unlimited allowance you don't recognise. Then set a reminder for the first day of each month to do it again. If you're unsure whether the platform you trade on is legitimate, start with our guide on checking whether a crypto platform is registered with the SEC.
This article is for general information only and is not financial, legal, or tax advice. Prices, rates and rules change quickly, so check current details before making money decisions.