You open your wallet and find a token you never bought. It has a name, a logo, sometimes a dollar figure attached. A note says you can claim more. That token is the opening move of a fake airdrop, and the claim site behind it exists to get one signature out of you: the one that lets a stranger move your assets.
No seed phrase changes hands in most of these thefts. The victim approves, the balance drops, and the attacker never needed a password.
The setup: a free token and a short window of curiosity
Deploying a token takes minutes and costs little on most chains. Scammers mint one, push it to thousands of addresses, and wait for the small percentage of people who look it up. The token name itself often carries a URL, and a direct message or a promoted post may point to the same place.
The claim page is the product. It copies the layout and logos of a project people already trust, and it usually has a countdown or a limited-supply notice to keep you from thinking it through.
Where connecting ends and signing begins
Connecting a wallet to a site reveals your address. That alone rarely moves funds. The damage happens at the next prompt, when the site asks you to approve a contract or sign a message to "verify" eligibility. Read that prompt as a contract, because that is what it is.
The drain tricks worth knowing by name
Token approvals
An approval grants a contract permission to spend a token on your behalf. Scam sites request approval for assets that have nothing to do with the airdrop, such as your stablecoin balance or a large holding. The claim is small; the permission is not.
Permit and off-chain signatures
A permit signature authorizes spending without an on-chain approval transaction. Because nothing appears in your gas history at the moment of signing, the wallet prompt can look like a harmless login. It is not. The signature is enough for the attacker to act later.
Address poisoning
Attackers send dust from an address that closely resembles one you have used before, so it appears in your history. If you copy it from there instead of your saved contacts, the next transfer goes to them.
Fake support in DMs
A message arrives offering to "fix" a stuck transaction or "recover" a failed claim. The fix is a drainer link. Real teams do not open support conversations in your inbox with a wallet-connect button attached.
Free mints that ask for blanket approval
The mint itself costs nothing. The approval it requests covers everything else in the wallet. Free is the price of entry, not the cost.
One signature, most of a wallet gone
Consider a wallet holding roughly $3,000 across stablecoins and one long-term position. A token worth about $40 shows up, labeled as a reward from a project the holder half-recognizes. The name contains a link. The page is polished, the logo is right, and the button says claim.
The holder connects, clicks, and approves. The approval covers the stablecoins and the long-term position, not the $40 token. Within a minute, the balance is mostly gone. No phrase was typed. The only mistake was signing a permission without checking what it covered.
Checking a claim before you sign
- Assume any token you did not buy or earn is bait. Do not visit links in its name or description.
- When a wallet prompt appears, read which assets and how much the contract can spend. If it exceeds the claim, close the tab.
- Keep a separate wallet for mints, new platforms, and anything unverified. Fund it with what you can afford to lose.
- Review and revoke stale approvals on a schedule, and always after trying an unfamiliar site.
- Ignore unsolicited help. No legitimate team needs your signature to resolve a problem.
| Action | Risk |
|---|---|
| Seeing an unknown token in your wallet | Low |
| Connecting a wallet without signing | Low to moderate |
| Approving an unknown contract | High |
| Signing a permit or verify message | High |
If you have already signed
Revoke the approval through a reputable approval manager before doing anything else, then move whatever remains to a fresh wallet. Walk your transaction history for approvals you do not recognize; older ones are easy to forget and just as usable. If assets have already moved, report it to the exchange where you cash out and to local authorities, though recovery is uncommon.
The same rules apply on any exchange or self-custody setup, including KoinBXe: no platform will ask for your seed phrase or a signature to "unlock" a reward. Treat that request as the scam it is.
Questions that come up after a near miss
Can connecting alone drain me?
Rarely. Connecting exposes your address and sets up the next step. The signature is what moves funds.
Do drainers need my seed phrase?
No. Approvals and permit signatures are enough, which is why the prompt matters more than the phrase you never type.
Is every random token a scam?
Treat it as one until you have independent proof otherwise. Legitimate projects seldom distribute tokens to wallets that took no action.
How often should I revoke approvals?
Monthly is a reasonable baseline, and immediately after using any site you have not used before.
Before you click the next claim link, open the token's contract on a block explorer and look at where it came from. If you cannot verify the source, leave the token alone and revoke any approval you have already given.