Fake airdrop, claim and mint sites
Look-alike pages promise a token airdrop, a reward or a mint. Connecting and signing is the drain.
How it works
Scammers clone a real project's site, buy ads on search engines, or post the link from hacked X accounts and in replies under real announcements.
The page asks you to connect and 'claim'. Behind it is a drainer kit that picks the most valuable thing in your wallet and asks for the signature that steals it.
Timing is everything: these pages appear within minutes of a real airdrop or token launch.
Red flags
- Claim links in replies, DMs, Discord announcements or sponsored search results
- Domains that are almost right: an extra letter, a different ending, a dash
- Countdown timers and 'only 100 spots left'
Protect yourself
- Go to the project's site by typing it or from a saved bookmark
- Assume every airdrop link in replies is fake
- Use a burner wallet for claims and move rewards out after
If you already signed
- Revoke approvals or delegates and move funds to a fresh wallet
- Report the domain to your wallet and to the project
Incidents using it 4
-
Medium✕Still active
Fake $CJUP 'Jupuary' tokens airdropped to Solana wallets lead to drainer sites
In May 2026, Solana Floor warned that scammers were sending counterfeit '$CJUP' tokens to Solana wallets while impersonating Jupiter's Jupuary airdrop. The tokens point holders to phishing 'claim' sites that drain any wallet that connects. Losses were not quantified. Jupiter had not announced a new airdrop at the time, and its only official site is jup[.]ag. If a token you never bought appears with a claim link, ignore it.
Jupiter (JUP) community and Solana wallet users·Solana·Since May 22, 2026·
-
Medium◐Partly contained
Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site
On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time.
Arbitrum DAO followers on X·Arbitrum·Since Feb 3, 2026·
-
High✓Contained
DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana
SlowMist's hack database lists a $130,000 phishing loss on Nov 20, 2025, filed under Solana, tied to the DMT token airdrop promoted by the X account @dexmaxai. The airdrop claim was the lure for the phishing. If you claimed DMT, check your wallet for token delegations or unexpected outgoing transfers and move what is left to a new wallet.
DMT airdrop claimants (@dexmaxai)·Solana·$130K stolen·Since Nov 20, 2025·
-
Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections
Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.
Aave and other DeFi users receiving fake reward emails·Multiple EVM chains·Since Jun 17, 2025·