Airdrops are a real distribution mechanism, which is what makes the fake version effective. The counterfeit version appears in replies to project announcements, in direct messages, and as tokens that simply arrive in your wallet with a website name attached.
What the claim page actually does
Connecting a wallet is harmless by itself. The theft happens at the signature. The page presents what looks like a claim transaction; what you are actually signing is an approval granting a contract permission to move your tokens, or a transfer of assets directly. The interface says "Claim". The transaction says something else, if you read it.
Dust tokens as bait
Unsolicited tokens arriving in your wallet with a website in the name are placed there deliberately. Attempting to sell or swap them routes you to a malicious contract. The correct response is to ignore them entirely. They cost you nothing while you leave them alone — and hiding them in your wallet interface is safer than interacting.
Protecting yourself
- Navigate to any project site yourself. Replies under official announcements are overwhelmingly fraudulent.
- Read what you are signing. If a "claim" requires approval to spend your tokens, close it.
- Keep a separate wallet for experimentation, holding only what you can afford to lose.
- Keep long-term holdings on a hardware wallet that never touches unfamiliar sites.
- Review and revoke standing approvals periodically.
If you have signed
Move remaining assets to a new wallet immediately, starting with the most valuable, and revoke outstanding approvals from the compromised address. If the seed phrase itself was entered anywhere, revocation is insufficient — the wallet is fully controlled by someone else and must be abandoned.