In the world of cryptocurrencies, decentralized finance (defi), and Web3, airdrops have become commonplace in the industry. However, while airdrops sound like free money, there’s been a growing trend of airdrop phishing scams that steal people’s money when they attempt to get the so-called ‘free’ crypto assets. The following is a look at two different ways attackers use airdrop phishing scams to steal funds and how you can protect yourself.
Airdrops Don’t Always Mean ‘Free Crypto’ — Many Airdrop Giveaway Promotions Are Looking to Rob You
Airdrops have been synonymous with free crypto funds, so much so that a rising crypto scam called airdrop phishing has become prevalent. If you are a participant in the crypto community and use social media platforms like Twitter or Facebook, you’ve probably seen a number of spam posts advertising airdrops of all kinds.
Usually, a popular Twitter crypto account makes a tweet and it is followed by a slew of scammers advertising airdrop phishing attempts and plenty of accounts saying that they have received free money. Most people won’t fall for these airdrop scams but because airdrops are considered free crypto, there’s been a bunch of people who have lost funds by falling victim to these types of attacks.
The first attack uses the same advertising method on social media, as a number of people or bots shill a link that leads to the airdrop phishing scams web page. The suspicious website may look very legitimate and even copy some of the elements from popular Web3 projects, but in the end, the scammers are looking to steal funds. The free airdrop scam could be an unknown crypto token, or it could also be a popular existing digital asset like BTC, ETH, SHIB, DOGE, and more.
The first attack usually shows that the airdrop is receivable but the person must use a compatible Web3 wallet to retrieve the so-called ‘free’ funds. The website will lead to a page that shows all the popular Web3 wallets like Metamask and others, but this time, when clicking on the wallet’s link an error will pop up and the site will ask the user for the seed phrase.
To get support, open MetaMask and navigate to “Support” or “Get Help” within the dropdown menu. Do not trust anyone who has sent you a direct message. UNDER NO CIRCUMSTANCES should you ever give your Secret Recovery Phrase to anyone or input it into any site!
— MetaMask Support (@MetaMaskSupport) April 29, 2022
This is where things get shady…