Crypto Wallet Drainer and Fake Airdrop Scams: How to Stay Safe (2026)

How a fake airdrop and wallet drainer scam works

The FBI’s IC3 describes how criminals abuse the airdrop feature of non-custodial wallets, where tokens or NFTs can be sent to you without your asking. Some airdropped tokens carry a text memo, and criminals put links to third-party sites in that memo, telling you to click to accept the tokens or earn rewards. IC3’s June 2025 notice is about Hedera Hashgraph wallets, and it frames the technique more generally.

The linked site asks you to connect your wallet and enter login details or seed phrases. That gives the criminal access to the funds. IC3 says criminals also promote fake airdrop links on social media, on third-party sites, and in phishing emails, and that clicking them can lead you to enter passwords or link your wallet, after which the criminal drains it. A wallet emptied this way is what people mean by a “wallet drainer”.

IC3 has separately noted that scammers may direct victims to specific websites or apps and may ask for two-factor codes or one-time passcodes, and that anyone who claims they can recover your funds may be another scam. The FTC adds that only scammers demand payment in cryptocurrency and that crypto payments usually cannot be reversed. For fake investment pitches, see investment scams.

Eight warning signs

1. Tokens or NFTs you never asked for. IC3 describes unsolicited token giveaways, called airdrops, appearing in non-custodial wallets. A gift you did not request is a lure, not a reward.
2. A memo or message with a link to “accept” the reward. IC3 says criminals put links to third-party sites in the memo field and ask you to click to accept the tokens or earn rewards. Do not click, and do not interact with the token.
3. A site that asks you to connect your wallet. IC3 says the linked site asks you to connect your wallet and enter login details. Connecting to a look-alike site is the step that gives the criminal access.
4. A request for your seed phrase or password. IC3 says to never share passwords, seed phrases, or one-time passwords in response to unsolicited requests. A seed phrase is the key to your funds.
5. A free-token offer on social media or email. IC3 says fake airdrop links are promoted on social media, on third-party sites, and in phishing emails. Confirm any free-token offer with the provider through its official site before accepting.
6. A “support agent” asking for codes. IC3 advises that if someone claims to be a company representative, you should end the contact and call back on a verified customer service number, not one from the message. It also notes scammers may ask for one-time passcodes.
7. Anyone demanding payment in crypto. The FTC says only scammers demand payment in cryptocurrency, and no legitimate business or government agency asks for it to buy something, pay taxes or fines, or “protect” your money.
8. A recovery service that offers to get funds back for a fee. IC3 warns to be wary of anyone claiming they can recover your funds. That is often a second scam. See recovery scams.

How to stay safe before you click

1. Treat any unrequested token as untrusted. Do not click its links, visit its site, or try to swap or sell it.
2. Never type your seed phrase into a website, a chat, or a form. IC3 says never to share seed phrases, even when a message seems to come from a known project.
3. Find the project’s official channel yourself, through its real website or a source you already trust, and check whether the offer exists there.
4. Do not click links or call numbers in a suspicious email to verify it. IC3 recommends using official contact information.
5. Watch your accounts for unfamiliar logins, account changes, and unrecognized transactions, as IC3 advises.

If you connected your wallet or lost crypto

Speed matters, because crypto transfers usually cannot be reversed. The steps below combine IC3’s and the FTC’s advice.

1. Contact your account providers right away. IC3 says to secure your accounts, change passwords, and set alerts for suspicious activity. If you used an exchange, tell it too.
2. Ask the exchange to act. The FTC says to contact the exchange or ATM operator, say the transaction was fraudulent, and ask for a reversal and refund. Recovery can be hard, because crypto lacks the protections cards have.
3. Gather the details. IC3 asks for cryptocurrency addresses, the amount and type of crypto, the date and time, and the transaction ID (hash), plus how you met the scammer and the websites or apps used.
4. Report it at ic3.gov, and see the list below for other countries. The FTC takes reports at ReportFraud.ftc.gov. File even if you only have partial details.
5. Ignore recovery offers. IC3 warns they may be another scam. See recovery scams.
6. Check your other accounts. If you entered a password or code anywhere, change it and see SIM swap and account takeover scams.

Where to report

• United States: ReportFraud.ftc.gov (FTC) and ic3.gov (FBI Internet Crime Complaint Center).
• United Kingdom: Report Fraud, the national reporting service that replaced Action Fraud, or 0300 123 2040. In Scotland, call Police Scotland on 101.
• Australia: Scamwatch, and ReportCyber for cybercrime. IDCARE (1800 595 160) offers free help if your personal details were exposed.
• Canada: the Canadian Anti-Fraud Centre, 1-888-495-8501.
• India: National Cyber Crime Reporting Portal or helpline 1930.

More help from official sources

• FBI IC3: NFT airdrop scams (PSA250603)
• FBI IC3: Cryptocurrency scams (PSA230824)
• FTC: Did someone insist you pay them with cryptocurrency?
• FTC: What to do if you were scammed

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. How these guides are researched is on the editorial policy.

Frequently asked questions