The airdrop claim page that asks for one signature

The page is well built. It knows your wallet, it shows an allocation, and there is a countdown. One signature to claim, no gas — the site explains that it is covering the fee. You sign, the page thinks for a moment, and then the tokens you already held are gone.

An airdrop claim is the transaction or signature that moves an allocated token distribution into your wallet. Real ones exist and are usually unremarkable. The fraudulent version depends on a single fact most people have never been told: a signature that costs nothing can still authorise the transfer of everything you own.

Free is what makes it work

An airdrop claim that costs nothing bypasses the instinct that protects people elsewhere, which is cost. A request for money produces suspicion; a request that costs nothing does not.

Gasless signatures are the mechanism. Permit and Permit2 let a token holder sign a message granting an allowance, which someone else then submits and pays for. This is a legitimate design — it exists so that users can approve and swap in one action rather than two — and it is what a fraudulent airdrop claim page borrows.

The consequence is precise: you can lose a token balance without ever sending a transaction. Nothing left your wallet at the moment you signed. Your balance was unchanged, your history showed nothing new, and the transfer happened afterwards, submitted and paid for by someone else.

A gas fee is not a security boundary. The signature is the authorisation, and it can be free.

This is also why "I would have noticed a transaction" is not a defence. There was no transaction from you to notice.

What the signature actually said

The wallet showed you something. In most cases it was one of these.

Rows two through four are the dangerous ones, and they share a property: the wallet presents structured data rather than a sentence, and the fields that matter — spender, value, deadline — are technical enough that people scroll past them.

Three specific things to read before signing anything on an airdrop claim page:

• The spender address. If you cannot identify it, that is the whole answer. A legitimate claim contract is one you can find named in the project's own announcement.
• The value. An allowance set to the maximum integer is unlimited. There is no reason for a claim to need unlimited access to a token you already hold.
• The token. A claim for a new token should not require an allowance over a different, valuable one. That mismatch alone is conclusive.

The third point is the fastest tell in practice. You are being offered token X and asked to sign something concerning token Y.

How the page reached you

An airdrop claim page reaches you by a route as engineered as the page itself.

The token arrived in your wallet already. Anyone can send tokens to any address, so a balance appearing unannounced means nothing except that someone paid to put it there. Frequently the token's name is a URL, which is the entire purpose — it plants the destination inside your own wallet interface, where it looks like information rather than an advert.

A search result or an advert. Paid placement above the real project, live for a few hours around a genuine announcement.

A reply under the official post. Timed to a real distribution, from an account with a plausible name.

A direct message with a deadline. Frequently to holders of a specific NFT collection, since that list is public.

The first of these deserves care because it is passive. You did nothing, and the invitation is now sitting in your wallet permanently. Do not interact with an unexpected token at all — not to claim it, not to swap it, not to send it away. Interacting is the request.

Checking a real distribution

A genuine airdrop claim is checkable without touching a wallet.

1. Start from the project, never from the link. Go to the official site or account by a route you already had — a bookmark, an exchange listing, a repository. Announcements are made there first.
2. Compare the claim contract address on the page against the one in the announcement, character by character at both ends.
3. Check the date. Fraudulent pages cluster around real news and often outlive the actual claim window.
4. Look for a support channel with history, not a Telegram group created last week.
5. Scan the contract before you connect. A tool such as Riskira will show its age, its verification status and what it has interacted with — facts that settle most cases before a wallet is involved.

The single strongest habit is the first one. Almost every loss in this category begins with a link that arrived, and almost none begins with a project's own site opened deliberately.

There is also a structural defence that costs nothing: claim from a wallet that holds nothing else. Send the claimed tokens onward afterwards. A signature can only reach what the signing address holds, so a claim wallet with a nil balance converts this entire attack into an inconvenience.

If you have already signed

After signing on an airdrop claim page, speed matters, because an allowance is exercised when the attacker gets to it rather than immediately.

1. Revoke the allowance now, from the wallet that signed. Check both token allowances and NFT approvals, which appear on different tabs.
2. Move remaining assets to a new wallet if anything of value is still there. Revocation is a transaction that can be front-run; moving out does not depend on winning that race.
3. Check for a second signature. These pages often request two — one for tokens, one for NFTs — and people remember only the first.
4. Look at what actually moved, in the block explorer, so you know the scope rather than guessing at it.
5. Do not engage with recovery offers. Anyone contacting you after a loss is running the follow-on scam, without exception.

Step two is the one people skip while working through a revocation interface. If the balance is large enough to matter, move it first and revoke afterwards.

More on the permission model in web3 security, what a decoded transaction shows in transaction safety, and the follow-on scams in crypto scams. The signature format itself is documented in EIP-2612, which is worth reading once to see how little the wallet can tell you about intent.

The short version

An airdrop claim page that asks for one free signature is asking for authorisation, not for proof of identity. Permit signatures cost no gas and can grant an unlimited allowance over tokens you already hold, which is why "there was no transaction" is not reassurance.

Never start from a link. Never interact with a token that appeared unannounced. Read the spender, the value and the token before signing — and claim from a wallet that holds nothing else, because that alone reduces this to a wasted afternoon.