A fake airdrop scam offers free tokens to get you onto a site where a single signature empties your wallet. The offer is the bait, urgency is the pressure, and the actual attack is one transaction you approve without reading. These scams work because genuine airdrops exist and genuinely require claiming, so the request itself is not suspicious. What distinguishes them is structural: a real airdrop is announced through channels you already follow, and a fake one finds you — through a token pushed into your wallet, a reply under a popular post, or a message you did not expect.
Key Facts
- The scam needs exactly one thing: a signature. Everything before that is theatre to get it.
- Delivery is usually a dusted token, a reply on social media, or a direct message.
- Countdown timers and limited allocations exist purely to prevent you from checking.
- Signature phishing losses jumped 207% in January 2026 versus December 2025, taking $6.27M from 4,741 victims.
- Wallet drainer losses totalled roughly $494M across 332,000+ wallets in 2024 before falling to about $83.85M in 2025.
- Real airdrops distribute to addresses that already qualified — no connection is needed to find out.
- A hardware wallet does not help, because the signature is legitimate.
How the Funnel Works
Delivery first. Most commonly a token appears in your wallet whose name or image advertises a claim site — the mechanics of which are covered in how dusting works. Alternatively the lure arrives as a reply under a legitimate project’s announcement, from an account with a near-identical handle, or as a direct message about an allocation you supposedly qualified for.
Then pressure. A countdown, a claim window closing in hours, a warning that unclaimed allocations are forfeited. The function of every one of these is the same: prevent you from spending five minutes verifying, because five minutes is all it would take. Finally the site asks you to connect and sign — and the transaction it presents does not claim anything. It transfers your tokens, or grants an authority that lets someone else transfer them later.
Real Versus Fake
| Genuine airdrop | Fake airdrop | |
|---|---|---|
| How you hear about it | Official channels you already follow | Unsolicited — token, DM or reply |
| Eligibility | Based on past on-chain activity | “Everyone qualifies”, or you specifically |
| Time pressure | Weeks or months to claim | Hours, with a countdown |
| What you sign | A claim instruction, sometimes nothing | Transfers or authority changes |
| Requires connecting to check | No — eligibility is published | Always, immediately |
| Domain | The project’s known domain | Lookalike, new, or a link shortener |
The “requires connecting to check” row is the single most reliable tell. Legitimate distributions publish eligibility lists or let you paste an address into a form — nothing about checking whether you qualify requires wallet access. Any site demanding a connection before it will tell you anything is designed around the connection, not around the airdrop.
Read the Transaction, Not the Page
The page can say anything. The transaction cannot lie about what it does, though it can be hard to read. Before approving anything on a claim site, look at what the wallet is actually presenting: a claim should receive tokens, not send them, and it should not request SetAuthority over your token accounts or set a delegate. If the simulation shows outgoing transfers of assets you already hold, the “claim” is a drain — which is the shape described in how drainer sites operate.
If you cannot parse the transaction, reject it. That is not caution, it is the only rational response to an instruction set you do not understand, and the losses in the figures above are almost entirely people who approved something they could not read under time pressure.
Verifying an Offer Properly
Find the project’s official channel independently — search for it rather than following the link you were sent — and check whether the airdrop is announced there. Look at the token’s mint on Solscan: a real distribution has a visible, funded distribution mechanism, while a lure token typically has no liquidity, no history and thousands of identical tiny balances. Check whether any pool exists at all on DEXScreener, since a token with nothing to trade against is not going to be worth claiming regardless.
Why $DOLAN Never Ran a Claim Site
DOLAN Duck ($DOLAN) fair launched with a fixed 98.3M supply — no presale, no allocation held back and no airdrop, which means every one of the roughly 10,700 holders bought on the open market. That matters here for one practical reason: any site offering a $DOLAN airdrop is fabricating a distribution that never existed, and the same logic applies to most fixed-supply fair-launch tokens. When a token’s entire supply was distributed by trading, there is nothing left to claim, so an unexpected claim offer identifies itself as fake by construction. Buying happens on ordinary trading venues, never through a claim page — and that is true of the majority of Solana memecoins, not just this one.
A fake airdrop offers free tokens to lure you onto a site where you approve a transaction that drains your wallet. The offer is bait; the attack is the signature you give at the end.
Genuine airdrops are announced through channels you already follow and let you check eligibility without connecting a wallet. Fake ones find you unsolicited and demand a connection immediately.
Connecting alone typically does not move funds — it reveals your address. The danger begins with the transaction the site then asks you to sign, which is where the drain happens.
No. The device signs whatever you approve, and a drain uses a perfectly valid signature. Hardware wallets protect the key, not the decision to sign.
Signature phishing losses rose 207% in January 2026 compared with December 2025, taking $6.27 million from 4,741 victims. Broader drainer losses were about $83.85 million across 2025.
Reject it. A claim should receive tokens, not send them, and should never request authority over your accounts. An unreadable transaction under time pressure is the standard shape of a drain.
To prevent you from verifying. Checking a project’s official channels takes about five minutes, so every countdown and closing window exists specifically to make you skip that step.