How to check whether an airdrop is legitimate
Check whether an airdrop is legitimate by matching it to the project's official website and social accounts, then verifying its token contract on Etherscan.
Vahe HakobyanEditor-in-chief
Updated Oct 6, 20263 min readFact-checked
On this page
Start with the project's own announcements before you connect a wallet.
What is the quickest legitimacy check?
Start at the project's official website and find the announcement that names the airdrop. Check the project's verified social media accounts for the same claim link. A verified account alone is not proof.
How do I verify an airdrop?
Verification means matching the airdrop to the project's own records. You need the official contract address and a block explorer.
- 1Find the official contractGet the address from the project's website or verified social accounts, not a direct message.
- 2Verify it on a block explorerPaste it into a block explorer and check the token name. Etherscan has shown Ethereum contract details since 2015.
- 3Inspect the claim page and requestRead the address bar and confirm the domain matches the project's official website. Then read what the page asks your wallet to approve; a claim should not request control of your balance.
- 4Do not share your seed phraseDo not enter your seed phrase or private key on a claim page; a real claim signs a transaction without them.
What should I do after checking?
After you claim, revoke unused approvals so a malicious approval does not drain tokens later. The IRS treats airdropped tokens as ordinary income when you receive them.
Frequently asked questions
Disconnect your wallet and revoke any approvals you granted. If you shared your seed phrase, move funds to a new wallet.
Open your wallet's approval settings or a block explorer's token approval checker. Revoke approvals you no longer need.
You report the value as income when you receive the tokens. If they later become worthless, you may claim a capital loss.
Yes. You can confirm the announcement, contract address, and claim page domain before you connect anything.
