Prerequisites
- You have a wallet address for airdrop queries (it is recommended not to use your main wallet that holds large core assets).
- You clearly understand the difference between two distinct actions: "connecting a wallet" and "signing a transaction".
Do you need to connect your wallet to airdrop checker websites? The answer depends on the blockchain network. "Read-only connections" that do not require signatures are relatively safe, while any page that asks you to click "sign" to grant authorization should be closed immediately.
Connecting a wallet is not equal to granting authorization. Many legitimate query tools (such as Dune, Etherscan) only need to read address information, and this type of connection is read-only and cannot access your funds. However, phishing websites use "check airdrop eligibility" as a cover to trick users into signing an "authorization transaction" — which is equivalent to giving the scammer an unlimited blank check.
Step 1: Judge if the site requests "read-only connection" or "signature authorization"
Operation Goal: Identify the nature of the connection request to decide whether to proceed.
Operation Method: After clicking "Connect Wallet", check the content of the pop-up window in your crypto wallet.
Case A: The pop-up shows "View Address" or "View Only" with no signature button required → Safe. The site can only read your wallet address and public on-chain data, and cannot operate your assets, so you can check airdrops safely.
Case B: The pop-up asks you to click "Sign" or "Confirm" and displays a string of unreadable contract code → Extremely high risk. This operation is most likely authorizing a malicious contract. Once signed, scammers can transfer all tokens of that specific type on the chain out of your wallet. Reject the request immediately and close the page. Legitimate airdrop check tools will never require you to sign to "verify eligibility".
Completion Check: Confirm you only performed a "read-only connection" and did not execute any signature action.
Step 2: Cross-verify via official authoritative channels
Operation Goal: Confirm the site you are visiting is the official entry specified by the project, not a fake phishing domain.
Operation Method: Find the airdrop check link from the project's official Twitter, Discord or official website announcement. Never click links directly from social media DMs or group chats.
Case A: The airdrop check link fully matches the one published on official channels → You can proceed.
Case B: The link comes from DMs, emails or untrusted group chats, and the domain contains suspicious strings such as bitget-claim.com, airdrop-net → Close the page immediately. This is a typical phishing website that uses lookalike domains to trick users.
Completion Check: You can find the exact matching domain on the project's official public channels.
High-Risk Warning
The mnemonic phrase is the highest permission of your crypto wallet. Any webpage, app or customer service that asks you for your mnemonic phrase is 100% a scam. Legitimate projects will never ask you to enter your mnemonic phrase on a webpage to "verify identity" or "claim airdrops". Once you enter it, your assets will be transferred away in seconds, and blockchain transactions are irreversible and cannot be recovered.
Step 3: Isolate risks with a dedicated airdrop wallet
Operation Goal: Use a wallet with very little funds for all airdrop check operations, to completely separate your main assets from high-risk operations.
Operation Method: Prepare a dedicated wallet that only holds a small amount of tokens for gas fees (such as ETH, BNB), and no other large-value assets.
Case A: Use your main wallet to connect to unknown check websites → Extremely high risk. If you accidentally sign a malicious authorization, all your assets may be stolen.
Case B: Use a low-balance "airdrop-only dedicated wallet" for checks → Risks are fully controllable. Even if you make a misoperation, your loss will be limited to the small amount of funds in this dedicated wallet.
Completion Check: You have created a dedicated wallet and only use it for airdrop query operations.
Step 4: Check and revoke authorizations regularly
Operation Goal: Clean up previously granted contract authorizations to prevent old approvals from being misused by malicious parties.
Operation Method: Use tools like Revoke.cash or the built-in authorization management tool of your wallet (such as the security center of Binance Wallet) to check your wallet authorization list regularly.
Case A: You find "Infinite Approval" granted to an unknown address → Revoke it immediately. This means that address can transfer all tokens of that specific type out of your wallet at any time.
Case B: The authorization list only contains limited approvals for well-known legitimate DApps you have actively used (such as Uniswap) → This is normal, you can keep monitoring it.
Completion Check: There are no suspicious addresses or unlimited authorization records in your approval list.
Common Risk Misconceptions
Many users mistakenly believe that "I am only checking eligibility, not claiming airdrops, so there is no risk". In fact, malicious authorization has nothing to do with whether you claim airdrops or not. Scammers only need you to click the "Sign" button. Many victims do not understand why they lost assets after "just connecting the wallet" until their funds are gone. Remember: Only a signature action can transfer your assets away. Connecting a wallet itself only reads your public address, and cannot cause asset loss.
Operation Verification and Long-Term Good Habits
Verification method: Enter your wallet address on Revoke.cash and check the "Token Approvals" list. If the list is empty or only contains approvals for known DApps, you have no active malicious authorization risk.
Recommended long-term habit: After every airdrop check, open Revoke.cash to check if any new suspicious authorization is added to the wallet. If you find any, revoke it immediately.
