What is a crypto airdrop, and how do fake ones work?

A token turns up in a wallet that nobody remembers buying. Its name points to a website, and the website has a large button that says Claim. Sometimes that is how a project rewards its early users. Sometimes it is the opening move of a theft, and from the outside the two can look almost identical.

What is a crypto airdrop?

A crypto airdrop is a distribution of free tokens to a set of wallet addresses, usually chosen by what those addresses did on-chain before a cut-off date. A project announces the rules, and records the state of the chain at a fixed moment. Qualifying wallets then receive or claim an allocation. No purchase is involved, which is the part that draws attention, and also the part that draws imitators.

Projects airdrop tokens for a few overlapping reasons: to spread ownership across real users, to reward people who used a product before it had a token, and to attract attention at launch. The first reason shapes how the token behaves later. Many airdropped tokens are governance tokens (opens in a new tab), which give their holders a vote on how a protocol changes.

How did airdrops become a standard launch tool?

Airdrops became a standard launch tool after the decentralised exchange Uniswap distributed its governance token in September 2020. Every address that had used its contracts before a 1 September snapshot could claim at least 400 UNI. More than 250,000 addresses qualified, and the community allocation as a whole came to 15% of the token's supply.

The Uniswap distribution is the classic retroactive airdrop: it rewarded past use that nobody knew would be rewarded. Many later projects copied the idea but changed one thing. They said in advance that using their product would count towards a future airdrop. People could then use a product on purpose to qualify, rather than being rewarded by surprise.

What is airdrop farming?

Airdrop farming is using a protocol mainly to qualify for a future token distribution, rather than for the service itself. Projects often encourage it with a points programme that scores activity before any token exists. Points are not tokens. Nothing guarantees they will ever be swapped for tokens. The project sets the conversion rules and can change them.

Farming creates a Sybil problem. In a Sybil attack, one person operates hundreds or thousands of wallets to look like many separate users, and collect many allocations. Projects respond with filters that cluster wallets funded from the same source, or acting in identical patterns at fixed intervals. Before its 2025 airdrop, the Ethereum layer 2 (opens in a new tab) network Linea flagged roughly 517,000 of about 1.3 million eligible addresses as likely Sybils, with an appeal route for wallets that believed they had been flagged in error.

Why can airdropped tokens come under selling pressure?

Airdropped tokens can come under selling pressure at launch since many recipients have no cost to recover, and no particular reason to hold. A farmer running many wallets may sell every allocation at once. How a given token trades depends on far more than that, including how much supply unlocks on day one, and how much is still to come. Supply schedules are among the tokenomics red flags (opens in a new tab) that can be checked before any launch price is treated as meaningful.

Free also does not always mean costless. Claiming usually requires an on-chain transaction, and that transaction pays a gas fee (opens in a new tab). Receiving or selling airdropped tokens may also count as taxable in some jurisdictions, and the treatment differs from place to place.

How do fake airdrops steal from wallets?

Fake airdrops steal through a copied claim page that asks the visitor to connect a wallet and sign. The signature claims nothing. It grants a token approval (opens in a new tab), or signed permit that lets the attacker's contract move tokens out of the wallet, often within minutes. The toolkits built for this are commonly called wallet drainers.

The lures arrive in several forms: an advert placed above the real project in search results, a direct message, a reply under an official announcement, or a token sent to the wallet unprompted with a website in its name. The unsolicited token is the most confusing because it appears inside the wallet itself. Receiving a token needs no action from the owner. Interacting with it is what creates the risk.

How can a real airdrop be told apart from a fake one?

A real airdrop is announced by the project itself and claimed on the project's own website. The safe way to reach that website is to type its address or use a saved bookmark, not to click a link from a stranger. That one check catches most fake claims. A few other signs also help. A genuine claim never asks for a recovery phrase, a countdown is a pressure tactic rather than proof, and a wallet's signing prompt shows what a transaction will permit before anything is approved.

Some people claim airdrops from a separate wallet holding little else, so a bad signature can only reach what that wallet holds. A block explorer (opens in a new tab) also shows which contract issued an unfamiliar token, and whether its code is verified. Verified code is not proof of safety.

Where Northtape fits

Northtape runs no airdrop and connects to no wallet. It is a news desk. Stories about drained wallets, and exploited smart contracts are detected by the Risk Radar protocol lens.

FAQs

Is an airdrop free money? Not quite. The tokens cost nothing to receive, but claiming can cost a gas fee, the tokens may carry tax consequences and their market price can move sharply after launch.

Is a token that appears in a wallet unprompted dangerous? Not on its own. Receiving it requires nothing from the owner. The risk starts when someone follows its link, signs a transaction or tries to sell it through an unfamiliar site.

What is an airdrop snapshot? A snapshot is a record of wallet balances or activity at a fixed block, which a project uses to decide who qualifies. Activity after the snapshot does not count towards that distribution.

Do points always turn into tokens? No. Points are a project's own scoring system. The project decides whether they become tokens and how many.

None of this is investment advice. It describes how airdrops are run and how fake ones work, not whether any token is worth claiming, holding or selling.