What Is a Fake Token Claim Site? How Wallets Get Drained

A fake token claim site is a phishing page designed to look like a legitimate airdrop or token distribution portal. It convinces you to connect your wallet and sign a transaction or message, which — instead of claiming free tokens — grants the attacker permission to move assets out of your wallet. These sites are one of the most common vectors for wallet-draining scams in the current market.

Real airdrops do exist and have distributed significant value to early users of legitimate protocols, which is exactly why fake claim sites work: people have seen genuine airdrops pay off and don't want to miss the next one.

How the scam typically unfolds

Step 1: Bait. You see a post on X, a Discord announcement, or a search ad claiming a project you've heard of (or one mimicking a well-known name) is airdropping tokens to eligible wallets. Urgency is common — "claim before the deadline expires."

Step 2: The lookalike site. The site is a near-perfect copy of the real project's design, often on a domain that's one character off from the legitimate one, or hosted on a deceptive subdomain.

Step 3: Wallet connection. You're prompted to connect your wallet to "check eligibility." This step alone isn't necessarily dangerous — connecting reveals your public address, not your funds.

Step 4: The malicious signature. This is where the damage happens. Instead of a straightforward claim transaction, the site requests a signature that actually grants token approval, sets an operator permission on an NFT collection, or signs a permit message that authorizes a transfer. Because many wallets don't clearly display what a signature request actually does — a problem discussed in our piece on blind signing — victims often approve it without understanding the consequence.

Step 5: Drain. The attacker's contract executes the transfer, often within seconds, moving valuable tokens, stablecoins, or NFTs out of the wallet.

Why "just connecting" isn't the real danger

A lot of security advice oversimplifies to "never connect your wallet to unknown sites." Connecting a wallet is closer to sharing your name tag than handing over your keys — it discloses your address. The actual danger is the signature or transaction request that follows. Understanding this distinction matters because it shifts your attention to the right moment: read every signature prompt, not just the initial connect button.

Red flags on claim sites

Signal	What it suggests
Countdown timers pushing urgency	Designed to short-circuit careful review
Domain slightly different from the official one	Classic typosquat pattern
Request to sign before showing any token details	Attempting to bypass scrutiny
Requests for "gas fee" payment to unlock a claim	Legitimate airdrops don't require advance payment
Site only found via ad or DM link, not the project's official channels	No independent verification path

Why these sites are effective even against experienced users

Fake claim sites don't only target beginners. Legitimate protocols do sometimes distribute surprise airdrops, and experienced users often watch closely for new distribution announcements from projects they've genuinely interacted with, which makes them a reasonable target too — the anticipation of a real reward lowers everyone's guard somewhat. Attackers exploit this by researching which wallets have interacted with a specific protocol on-chain (this information is public) and specifically targeting those addresses with a fake claim page tailored to look exactly like what that protocol's real airdrop might resemble.

Some fake claim campaigns go further, distributing a real but worthless token to a wallet unprompted, specifically so that when the victim later visits a fake "claim more" or "stake to unlock" site associated with that token, it looks more credible because they already hold something related to it. This is sometimes called an address-poisoning or dust-token tactic, and it preys on the assumption that receiving a token implies a legitimate connection to a real project.

The role of urgency and scarcity

Nearly every fake claim site uses some version of artificial scarcity: a countdown timer, a claimed limited allocation, or language suggesting the opportunity will vanish imminently. This isn't incidental — it's a deliberate design choice to prevent the kind of careful, unhurried verification that would otherwise expose the scam. Legitimate airdrops from established projects are typically documented clearly in advance, with generous claim windows measured in weeks rather than hours, precisely because the project has no incentive to rush honest users into a decision.

How to verify a claim is real

Go directly to the project's official website and socials by typing the URL yourself, not by clicking a shared link. Cross-check the claim announcement across multiple official channels — a real distribution is usually documented on the project's own domain and social accounts simultaneously, not solely through a single ad or DM. Check whether the token or contract shows up on reputable DeFi or chain data pages, and treat requests to connect a wallet from search ads with heavy suspicion, since attackers frequently buy ad placements above the genuine site.

Bottom line

Fake token claim sites weaponize the excitement around legitimate airdrops. The real risk isn't the wallet connection — it's the signature request that follows, so read every prompt before approving anything, verify claim announcements through a project's official channels, and never pay a fee to "unlock" a free claim. For a broader view of how these scams fit into the wider threat landscape, see our guide to common DeFi scams and wallet security.