A checker saying yes is where the risky part starts. When you finish this page you'll have the tokens in a wallet you control and no leftover permissions for anyone to use later, and it takes less time than the farming did. The one thing to know before you start is that a claim sends tokens to you. If a signing prompt asks for permission to spend tokens, stop there.

What you need

  • The protocol's own announcement

    Its official X account, docs or blog. A reply, a DM or an ad does not count.

  • A wallet to sign with

    Use a hardware wallet with its own screen if the claiming wallet holds anything worth keeping. If it doesn't, use a fresh burner.

  • The chain's native token for gas

    It has to be on the chain the claim contract lives on, which the protocol's docs will name.

The claim, step by step

  • Get the claim URL from the protocol's own channel

    AirdropAlert reports fake claim sites going up [in under an hour of a token launch](https://airdropalert.com/blogs/guide-how-to-claim-crypto-airdrops-safely/), and D'CENT notes they use lookalike domains with swapped characters or different endings. Type the address in yourself. You'll know it worked when the domain matches the one in the announcement letter for letter.

  • Read the claim terms in the docs

    Look for the deadline, and for any vesting, lockup or escrow that means you won't hold everything on day one. Take these from the protocol's own page, not from a thread summarizing it. What you're after is a date and a clear sense of what arrives when.

  • Choose the signing wallet

    AirdropAlert recommends keeping cold storage, farming and burner wallets separate. If your eligible address holds real value, sign on the hardware device. You've got this right when the wallet you're about to connect has nothing in it that you can't afford to lose, or the device is plugged in.

  • Fund gas on the claim chain

    Keep only as much as the claim needs. When the wallet shows a native balance on the right network, you're set.

  • Connect and read the prompt before signing

    MalwareTips puts it bluntly: "Connect Wallet opens a session a drain script can spend." A request for unlimited token approval is the red flag AirdropAlert lists, and D'CENT describes it as the way attackers drain wallets days or weeks later. If the prompt asks you to approve or permit spending, close the tab.

  • Check the transaction on the device screen

    A hardware screen shows what you are actually signing, whatever the browser displays. Once you confirm, the tokens show up in the wallet.

  • Move the tokens out if you claimed to a burner

    Send them to the wallet you actually keep. You'll see the burner's balance drop to gas dust.

  • Revoke stray approvals

    AirdropAlert suggests doing this within 24 hours using Revoke.cash. You're done when the list of active approvals is empty.

The fairest objection is that a hardware wallet or a burner is overkill for a small drop. I understand why people think so, but the numbers don't support it. DeepStrike puts the average drained wallet at about $790 in 2025, and it lists fake airdrops and token claims as the main lures. A drainer takes everything in the wallet, however small the claim was.

One more point. An eligibility result you see today doesn't promise tokens at claim time, because terms, allocations and windows are the protocol's to set. If you want to know whether the tool that said yes can be trusted, that's a separate question, covered in our review of eligibility checkers.

When it goes wrong

It's a scam, with no exceptions. D'CENT says no legitimate airdrop requires your recovery phrase under any circumstances, and Bright Coding says any site charging a fee to "release" an airdrop is a scam. Close the page.

That's bait. The FBI has warned that criminals put malicious links in the memo field of unsolicited airdrops to send people to fake claim dApps, and D'CENT describes dust tokens used the same way. Don't click it, and keep an eye on the wallet for activity you didn't authorize.

AirdropAlert treats that as a major red flag, because a legitimate checker only needs your public address. You can check with a pasted address instead.

Revoke the approvals straight away, then move whatever is left to a brand-new wallet, as MalwareTips advises. Report it at IC3.gov with the transaction details. Also expect the "recovery service" DMs that tend to follow, and ignore them.

What comes next

With the tokens in a wallet you control and no approvals left open, the rest is paperwork. Depending on where you live, that can include taxes, and other farmers have been swapping notes on it.