Crypto Wallet Drainers and Fake Airdrops: How to Stay Safe

Nov 5, 2026 · 4 minute read · By IsSiteLegit

No real site, wallet company or support person will ever ask for your seed phrase. If a page asks for it to "claim" a free airdrop, close it. Do not connect your wallet to a site you reached from an unexpected message, ad or post.

That one rule stops most wallet theft. The rest of this article explains how the tricks work and how to spot them.

How fake airdrops empty wallets

An airdrop is a free gift of crypto tokens, usually sent to people who already hold a certain coin. Real ones exist. Scammers copy the idea because it sounds exciting and urgent.

There are two common tricks.

The seed phrase trick

The page says you must "verify" or "restore" your wallet to claim your tokens. It asks for your seed phrase (also called a recovery phrase). That phrase is the master key to your wallet. Anyone who has it can move everything out, from any device, and nobody can undo it.

The wallet drainer trick

This one looks safer, because you only click "Connect wallet". But connecting is just the first step. The site then asks you to approve a transaction or a "signature". It may be described as a harmless claim button. In reality you may be giving the site permission to move tokens out of your wallet.

A drainer can work in seconds. You may not notice anything until the balance is gone.

Warning signs of a fake airdrop

It asks for a seed phrase. No exceptions. This is the clearest sign of a scam.
You did not ask for it. The link came in a direct message, a reply under a post, an email or a pop-up.
There is a countdown or a "limited spots" banner. Pressure is meant to stop you from thinking.
The address is a near-copy of a real brand. For example, a made-up address such as metamask-claim.example imitates the real metamask.io.
The site is on a free hosting service. Anyone can publish a page there in minutes.
The approval pop-up is unclear. If you cannot tell what you are signing, do not sign.

What the public data shows

In the phishing links listed by public security feeds on 2026-11-05, there were 300 entries. MetaMask, a well-known wallet brand, appeared as an imitated name in 1 of them. That is a small share on that day, but it shows that wallet brands are copied like any other.

The same feeds showed something useful about where these pages live. About 52% of those phishing links sat on free hosting platforms, with pages.dev alone accounting for 100 of the 300. A page on a free platform is not automatically fake, since many honest projects use them. But it means a polished look tells you very little about who is behind a page.

Safer habits for anyone with a wallet

Never type your seed phrase into a website. Not for support, not for a claim, not for an upgrade. Store it offline, away from photos and cloud notes.
Go to the project yourself. Type the real address, or use a bookmark you made earlier. Do not follow the link you were sent.
Check the link first. Our guide on how to check a link before clicking walks through it step by step.
Read every approval. If a pop-up asks for broad permission to spend your tokens, reject it.
Use a separate wallet for experiments. Keep only a small amount in the wallet you use to try new sites.
Review and revoke old permissions from time to time, using the tools your wallet provides.
Be wary of "support" messages. Real support will not contact you first in a private message.

For a broader routine, see how to check if a website is legit.

What a check can and can't tell you

A site checker looks at public signals: how old the domain is, whether it appears on security blacklists, whether the name imitates a known brand, and what the page says. IsSiteLegit shows you this evidence so you can judge for yourself.

There are limits. A brand-new scam page may not be on any blacklist yet and may have no history at all. A clean result is not a guarantee of safety. Treat it as one input, and let the seed phrase rule override everything else.

In our own checks over the last 7 days, 214 sites were checked. 188 came out as likely legit, 22 as caution and 4 as high risk. Most checks are for ordinary sites, so a good result for a crypto page should still be met with care.

If you already paid or clicked

Act quickly, and stay calm.

If you only clicked a link, close the page. Do not connect your wallet or enter anything. Run a scan on your device if you downloaded a file.
If you connected your wallet, revoke the site's permissions using your wallet's tools, and move your remaining funds to a new wallet.
If you typed your seed phrase, treat that wallet as lost. Create a new wallet with a new seed phrase right away and move everything you can. Do not reuse the old one.
Change passwords on any account that shares a password with the affected ones, and turn on two-factor authentication.
Report it. In the US, use reportfraud.ftc.gov and ic3.gov. In the UK, use Action Fraud. In Australia, use Scamwatch.
Keep records: the link, screenshots and transaction details.

Crypto transfers are hard to reverse, so reports do not always bring money back. They still help others avoid the same trap.

Before you connect a wallet to anything unfamiliar, you can paste the address into the free IsSiteLegit checker and look at the evidence it shows.

Written with AI from IsSiteLegit's data and published after an automatic fact check: every number in this post comes from that data. Figures from security feeds describe the links listed on the day of the post. Where we link to a website’s IsSiteLegit result, a "likely legit" rating describes what our automated checks found when they ran. It is not an endorsement of the company, its products or its offers. How we write.