In short
An airdrop distributes cryptoassets under a project’s conditions; it does not guarantee cash value. Verify the original announcement and understand every wallet request before acting. Unexpected tokens can be phishing lures, and disconnecting a site does not necessarily cancel an existing spending approval. Keep recovery secrets private. [1][2][4]
Key takeaways
On this page 12 sections
- What is an airdrop, and is it really free money?
- How do legitimate distributions differ from fake claims?
- What are you authorizing when the wallet opens?
- Is a network fee the same as paying to unlock a prize?
- Why does a fake balance sometimes look valuable?
- Does disconnecting a website remove its spending permission?
- What should you do if you already interacted with the claim?
- How can you make a calm decision about a new offer?
- Common mistakes
- Frequently asked questions
- Glossary
- Sources
What is an airdrop, and is it really free money?
An airdrop distributes cryptoassets to selected wallets, often to promote a project or reward earlier participation. Eligibility may depend on holding assets or completing tasks. Receiving a token does not guarantee that it has a usable sale value or that you can withdraw money from it. [1][2]
As of November 4, 2026, the useful first step is to examine the offer, its permissions and its payment demands. It is general information, not financial advice. A service mentioned as a source is not a recommendation or a statement that it supports residents of Iran.
Before doing anything, identify what you have received: an unsolicited token, a message saying you qualify, or a genuine announcement about an account you already use. Those situations require different checks. Do not begin by clicking the claim link in the message.
MetaMask's guidance explains that an unsolicited token deposit alone does not give the sender access to your funds. The danger can arise when the recipient follows a lure and approves an action or reveals a secret. An unfamiliar balance is a reason to investigate calmly, not to rush into a claimed rescue procedure. [2]
How do legitimate distributions differ from fake claims?
A legitimate project should provide information you can locate independently: the operator, eligibility conditions, relevant network, asset and claim process. Coinbase describes several distribution models, including rewards based on holdings or activity. Do not assume every airdrop follows the same procedure. [1]
Find the project's website through a route you already trust, then compare the announcement with the message you received. Check the spelling of the domain and the exact destination before opening a wallet connection. A copied logo is not an identity check.
Ledger identifies urgent language, suspicious URLs, unsupported reward promises and requests for recovery secrets among airdrop warning signs. Use these as reasons to stop and verify, not as a mechanical score that can certify an offer as safe when a few boxes look reassuring. [5]
If the project has no clear explanation of why you qualify, leave the asset alone. You do not need to sell, transfer or destroy every unexpected token visible in a wallet. Avoid experimenting with a suspicious asset simply to make the balance screen look tidy.
What are you authorizing when the wallet opens?
Read the proposed action rather than assuming that every wallet prompt means receiving a gift. In the Ethereum token model explained by MetaMask, an approval can allow a smart contract to spend a specified token on your behalf. A large or unlimited allowance can create exposure beyond the small reward being advertised. [3]
Identify the account, network, asset, recipient or contract, and amount involved. If the wallet cannot show the meaning clearly enough for you to understand, cancel and seek an explanation through the wallet's official documentation. Do not let a promoter interpret an unreadable request for you.
Some signatures and token mechanisms differ from a conventional approval transaction. MetaMask's documentation describes those distinctions, so do not assume that the absence of a familiar fee or approval screen means an action is harmless. Review the specific request and the documentation for the network and wallet you are using. [3]
These Ethereum examples are not instructions for every blockchain. A TON wallet or another network may use different authorization flows. The general habit is the same: understand the actual permission or transfer before consenting, and reject a request that does not match the stated purpose.
Is a network fee the same as paying to unlock a prize?
No. Ethereum's documentation explains that transactions require network fees, called gas, and that fees vary with network conditions. A genuine network fee is part of processing a particular transaction. It does not establish that the transaction or the promised reward is legitimate. [6]
Distinguish the fee shown by the wallet for an action you understand from a stranger asking you to send money to a separate address. A payment described as verification, activation or release still needs a clear, independently verified purpose. The label itself is not evidence.
Do not accept the opposite oversimplification either: a claim involving any fee is not automatically fraudulent. Inspect the network, action, destination and written conditions. If you cannot explain what the fee pays for, pause without signing or sending funds.
For a user in Iran, also separate receiving a cryptoasset from eligibility for an exchange or other withdrawal service. Verify the current conditions of the actual provider before spending time or money. Before treating a token as spendable income, check whether you can actually use the required trading and payment services.
Why does a fake balance sometimes look valuable?
MetaMask describes a lure in which an unexpected token appears to have value on a listing or explorer, but attempts to trade it lead to an error or a fraudulent website. The website then asks for a dangerous approval or a recovery phrase. A displayed estimate is therefore not proof of money you can obtain. [2]
Treat the claim as unverified until you understand the asset and a legitimate transaction path. Do not calculate personal wealth by multiplying an unsolicited token quantity by an unexplained price. Keep the token's existence, quoted valuation and actual ability to sell as separate questions.
Ledger also describes cloned sites and urgent claim messages. A deadline can make a dubious offer feel like a decision you must make immediately, but missing an unverified promotion is preferable to authorizing an action you do not understand. [5]
If you want to document the message, save its text, destination and time without exposing wallet secrets. Do not forward a live claim link to friends as a recommendation. Share a warning or ask a trusted technical person to inspect the public information instead.
Does disconnecting a website remove its spending permission?
Not necessarily. MetaMask distinguishes disconnecting a site from revoking a token allowance. Disconnecting the interface does not itself cancel existing approvals; revocation is the separate action that removes the relevant spending permission. This distinction concerns the approval system described in its documentation. [4]
If you signed an unexpected approval, use the wallet's official guidance to inspect the relevant account and network. Reach any review tool through that documentation, not through an unsolicited direct message offering to clean your wallet.
Revoking a permission does not reverse a completed transfer. It also does not solve every kind of compromise. If you disclosed the recovery phrase or private key, the problem is broader than a single site's allowance and needs the wallet provider's compromise-response guidance. [4][7]
Keep a note of the action you took and the transaction record where relevant. Avoid repeatedly signing new repair requests when you do not understand what they do. An explanation should identify the specific permission or account problem, rather than promise that one mysterious transaction will make everything safe.
What should you do if you already interacted with the claim?
First distinguish what happened: viewing a page, connecting an account, approving an action, signing a transfer, installing software or revealing a recovery secret. Write down the sequence and stop interacting with the suspicious site. This record helps you find the appropriate response without assuming every incident is identical.
For an unfamiliar transaction, MetaMask recommends checking details such as the time, recipient and amount against activity you recognize. If the transaction is unauthorized, follow the official compromised-wallet guidance. It warns that completed transactions cannot simply be reversed by the wallet provider. [7]
If only an allowance is at issue, review the official revocation instructions. If a recovery secret was exposed, do not treat disconnecting a site as a repair. The relevant response may involve a new wallet with a new secret, using a trustworthy device and the provider's instructions. [4][7]
Do not add funds repeatedly to a compromised account in an attempt to rescue a displayed balance. MetaMask specifically warns about automated sweepers that can take newly added funds. Seek help through a verified support route, and never send a recovery phrase to someone who contacts you first. [7]
How can you make a calm decision about a new offer?
Use a short written checklist before connecting anything. Identify the announcement, operator, asset, network, eligibility, requested action and potential costs. Keep uncertain entries marked unknown. An unresolved question is a reason to pause, not an invitation to borrow confidence from a group chat.
Compare the request with its purpose. A distribution announcement does not explain why a site wants authority over an unrelated asset. MetaMask's approval guidance gives the relevant question: which token can this contract spend, and within what allowance? [3]
Keep wallet security and expected reward separate. Even a real distribution may not be worth the time, fees or exposure for you. An airdrop's promotional purpose and uncertain token value are part of the decision, not a promise of reliable income. [1][2]
Pouyam's phishing guide covers the broader habit of verifying messages and destinations. Apply it before a claim, and retain your own record afterward. You can decline an offer without proving fraud, especially when the operator cannot explain what you are being asked to authorize.
| Situation | What to inspect | Reason to pause |
|---|---|---|
| Unexpected token | Independent project information | A claim link hidden in an error message |
| Wallet approval | Asset, contract and spending allowance | Permission unrelated to the reward |
| Claim with a fee | Network transaction and written purpose | Separate unexplained payment request |
| Previously connected site | Existing allowances as well as connection | Assuming disconnect removed all permissions |
Common mistakes
Trading an unknown token just to remove it
Fix: Leave it alone while checking the public information.
Reading every prompt as a reward receipt
Fix: Inspect whether it authorizes spending or a transfer.
Disconnecting and assuming all permissions ended
Fix: Review relevant allowances using official guidance.
Sharing a recovery phrase with a helper
Fix: Keep recovery secrets private and use verified support.
Frequently asked questions
Does receiving an unknown token automatically drain my wallet?
MetaMask says a deposit alone does not give the sender access. The lure can lead to harmful approvals or disclosure afterward. [2]
Are all airdrops scams?
No. Airdrops also serve legitimate promotional and reward purposes, but their value and conditions need checking. [1]
Can a legitimate claim involve a network fee?
Blockchain transactions can require fees. A fee alone proves neither legitimacy nor fraud; inspect the actual action. [6]
Will disconnecting a site revoke an Ethereum token approval?
No. MetaMask explains that disconnecting and revoking existing approvals are separate actions. [4]
Glossary
- Recovery phrase
- A secret used to restore control of the associated wallet accounts; it must not be shared with claim sites.
- Token allowance
- Permission for a contract to spend a specified token under the applicable authorization rules.
- Gas
- The name used for Ethereum network transaction fees.
- Block explorer
- A tool for inspecting public blockchain records such as transactions and addresses.
Sources
- What is a crypto airdrop? Coinbase
- How to tell the difference between a regular airdrop and airdrop phishing scams MetaMask
- What is a token approval? MetaMask
- How to revoke smart contract allowances/token approvals MetaMask
- Airdrop Scams Ledger · 2025-07-29
- Ethereum fees: what is gas and how to pay less? ethereum.org
- I have been hacked or scammed (unauthorized transactions on my account) MetaMask
Comments
Top comments