The airdrop that empties your wallet

"You're eligible for 1,250 tokens — claim now." If you've used DeFi for more than a week, you've seen some version of this message. Real airdrops exist, which is exactly what makes fake ones so dangerous: the fake claim page is the single most common doorway to a wallet drainer.

The bait

Fake airdrops arrive through every channel: a token that mysteriously appears in your wallet with a website in its name, a reply from a lookalike account under a project's post, a Discord DM, a search ad above the real result. The page always has three ingredients: a familiar brand, a reward sized to be exciting but plausible, and urgency — a countdown, a limited allocation, "unclaimed tokens return to the treasury".

The trap

You connect your wallet and click "Claim". What your wallet actually shows you is one of three things, none of them a claim:

• An unlimited approval — permission for the scammer's contract to spend your tokens forever. They empty you minutes or months later.
• A setApprovalForAll — hands over every NFT in a collection at once.
• A signature (Permit, eth_sign) — an off-chain approval that costs the scammer no gas to collect and drains you in one later transaction.

The page may even show a friendly "Claiming…" animation while the drainer script inventories your wallet and picks the most valuable things to take first.

The smell test

• Real airdrops are announced on the project's official channels — the website you already know, its verified account. Not DMs, not replies, not ads.
• Real claims never need your recovery phrase — anyone asking is a scammer, full stop.
• Be suspicious of claims that ask for unlimited approvals or signatures before giving you anything.
• Check the address bar character by character — fake claims live on lookalike domains like uniswaap.org or claim-lido.xyz.

Where CapyGuard steps in

CapyGuard checks every site against tens of thousands of known scam domains and catches lookalikes of real projects before the page loads. If you do land on a claim page, CapyGuard pauses exactly the requests drainers need — unlimited approvals, setApprovalForAll, Permit and blind signatures — and explains in plain language what the site is asking for, so "Claim" can't smuggle a handover of your wallet past you.