Airdrop scams, wallet drainers and pig-butchering: how they work and how to avoid them
The playbook behind fake airdrops, drainer kits, romance and 'investment' scams, fake job offers and address poisoning, with the specific defence for each.
Key facts
- Scams, not protocol hacks, are the largest source of losses for individual crypto users; every variant creates urgency or greed, moves you to a channel the scammer controls, and needs one signature or one transfer.
- Unsolicited tokens in your wallet are bait; the theft happens when you try to sell or claim them on the site named in the token.
- Pig-butchering is a weeks-long relationship scam ending in a fake trading platform; anyone met online who steers the conversation toward crypto investing is running it.
- Address poisoning sends zero-value transfers from look-alike addresses so you copy the wrong one from your history; verify the first and last six characters of every pasted address.
- Recovery services that ask for an upfront fee are a second scam aimed at the same victims; stolen crypto is rarely recoverable.
Scams, not hacks, are the biggest source of losses for individuals. The techniques evolve, but the structure repeats: create urgency or greed, move you to a channel the scammer controls, and get one signature or one transfer. Here is the current playbook and the counter to each move.
Fake airdrops and drainer sites
How it works. A post, DM or unsolicited token points you to a claim site for a hyped project. The site asks you to connect and sign. The signature is a setApprovalForAll, a Permit for your stablecoins, or a direct transfer. Drainer kits are sold as a service and split proceeds with the affiliate who lured you.
Defence.
- Real airdrops are announced on the project’s verified channels, and you check eligibility from a bookmarked official site, never a link in a DM.
- Use a burner wallet for any claim. It holds nothing, so it can lose nothing.
- Read every signature prompt. Anything mentioning
approve,permit,spenderorsetApprovalForAllwhen you only expected to connect is a drain attempt. See the approvals guide.
Fake support and account recovery
How it works. You post a complaint about an exchange or wallet. A “support” account replies or DMs within minutes and asks you to “validate” your wallet on a form, share your screen, or install remote-access software.
Defence. No exchange or wallet company initiates DMs. Use only the in-app support chat. Never share a screen while your wallet or exchange is open.
Pig butchering and fake trading platforms
How it works. Weeks of relationship building, then an introduction to a platform (often a polished app) with fake charts and a “mentor”. Early small withdrawals succeed. Then you are asked to deposit more to unlock profits, pay “tax” or “verification fees”. The platform vanishes.
Defence.
- Anyone you met online who steers conversation toward crypto investing is running this scam. There are no exceptions.
- Real exchanges are on our ranking. If the “platform” is not on CoinGecko and has no regulatory footprint, it is fake.
- Guaranteed returns do not exist.
Fake job offers and malicious “test tasks”
How it works. Recruiters offer a well-paid Web3 role and ask you to run a coding test from a GitHub repo, install a “video call app” or open a PDF. The payload steals wallet extensions and seed files. This is how the Ronin Bridge was breached and how Lazarus Group targets developers today.
Defence. Run untrusted code only in a disposable VM. Keep no wallets on your work machine. Verify recruiters through the company’s official careers page.
Address poisoning and clipboard hijacking
How it works. Scammers send you 0-value transfers from an address whose first and last characters match an address you use, so it appears in your history. Malware can also swap addresses in your clipboard.
Defence. Copy addresses only from the destination service or your saved contacts, verify the first and last six characters after pasting, and use your exchange’s whitelist so poisoned addresses cannot receive funds.
Poisoning bots target anyone whose balance is visible on-chain, including thieves. Within hours of the September 2026 Bitget hack the attacker’s main wallet had received 23 counterfeit-token transfers and dozens of zero-value payments from look-alike addresses mimicking its own parking wallets, as our on-chain analysis documented. If it can happen to a wallet holding $180 million, it will happen to yours.
SIM swap
How it works. The attacker convinces your mobile carrier to port your number, receives your SMS codes and resets your email and exchange passwords.
Defence. Remove SMS 2FA everywhere, set a carrier port-out PIN, and use an authenticator app or hardware key. See exchange account security.
Universal rules
- Nobody legitimate asks for your seed phrase, ever.
- Nobody legitimate DMs you first.
- Nobody legitimate needs you to send funds to receive funds.
- Urgency is the scammer’s tool. Slow down.
- Use a burner wallet for anything new; keep the vault offline.
Work through the security checklist to close every gap on this page in one sitting.
Questions
I received tokens I never bought. Is my wallet hacked?
Almost certainly not. Anyone can send tokens to any address. Unsolicited tokens are bait: the scam happens when you try to sell or 'claim' them on the site named in the token, which triggers a drainer. Ignore them; hide them in your wallet UI.
What is pig butchering?
A long-con investment scam. A stranger builds a relationship over weeks (dating app, wrong-number text, LinkedIn), then introduces a 'trading platform' showing fake profits. Small withdrawals work to build trust, then a large deposit is demanded and the platform disappears. Losses average tens of thousands of dollars per victim.
Can stolen crypto be recovered?
Rarely. Exchanges can freeze funds if the thief deposits to a KYC account and you report quickly with transaction hashes. 'Recovery services' that ask for an upfront fee are a second scam targeting the same victims.