Fake Airdrop Scam, Phishing and Fake Wallet Apps Explained
Lesson 2 of 10 · Beginner
What is phishing in crypto after?
Phishing means tricking you into handing over the vault key yourself. In crypto, that “key” is usually one of three things:
- A recovery phrase or private key: with it, the attacker takes your whole wallet.
- A signature or approval: with it, the attacker gets permission to withdraw specific tokens (covered in detail in the next lesson).
- Exchange login details: the password, the 2FA code or the confirmation email.
It does not matter whether the attack looks like a website, an app, a Telegram bot or a support message; in the end it always asks you for one of these three. If you remember this rule, you will recognise most attacks.
Copycat sites and fake apps
Copycat sites imitate the original site exactly and differ only slightly in the address: an extra letter, two swapped letters, a different suffix, or characters that look like Latin letters but are not. These sites sometimes appear above the real one in search results through ads, so “the first Google result” is no guarantee.
Fake wallet apps are more dangerous, because users trust the official store. According to BleepingComputer, between 8 and 11 April 2026 a fake app named Ledger Live was published on Apple's App Store and took about 9.5 million dollars from roughly 50 victims. The mechanism was simple: the app asked users to enter their recovery phrase “to sync”. A genuine hardware wallet app never asks for this; the recovery phrase is entered only on the hardware device itself and only during recovery.
Checklist before installing or logging in
- Find the official site address once from a trustworthy source and save it as a bookmark; from then on, only log in through the bookmark.
- In the app store, compare the developer name with the maker company's name and check that the official site links to that same app.
- Any app or site that asks for a recovery phrase “to verify”, “to sync” or “to fix an error” is fake, without exception.
Telegram airdrops and the “claim your prize” page
An airdrop is a free distribution of tokens among users. Real projects do run airdrops, but that popularity has made them the main bait for scammers. Tap-to-earn games on Telegram became hugely popular in 2024; according to Decrypt, the HMSTR token (from the Hamster Kombat game) fell more than 70 percent within a few weeks of listing. So even a genuine airdrop does not necessarily hold lasting value.
Common patterns in fake airdrops:
- An unknown token that appears in your wallet by itself and whose name or description points you to a “Claim” site. On that site, by connecting your wallet and signing a message, you grant permission to take your real assets.
- A Telegram bot or mini-app that asks for your recovery phrase to “register your wallet” or “verify your airdrop”.
- A release fee: “To receive the airdrop, first send some Tether as a fee.” A real airdrop never asks for an advance payment.
- Copy channels with the original project's name and logo that spread a fake “official” link.
The general rule: do not touch an unknown token that arrived in your wallet unasked; do not sell it, do not transfer it and do not visit its site.
Impersonated support and the burner wallet
You ask about a withdrawal problem in a public Telegram group, and a few minutes later “support” messages you directly. This is one of the oldest and still most effective tricks. A more advanced version is when the scammer has your real details: according to CNBC, in May 2025 several overseas Coinbase support staff took bribes and leaked customer data, and that data fuelled fake calls “from Coinbase”. So the fact that a caller knows your name and balance is not proof they are genuine.
Practical defence:
- Never follow up through a link or number the caller provides; open a ticket yourself from the official app or site.
- To try out sites, airdrops and mini-apps, use a burner wallet that holds nothing except a little for fees.
- Never connect the burner wallet to your vault, and never connect the vault directly to unknown sites.
Warning signs at a glance
Scammers change their wording, but the pattern stays the same. Keep this table handy:
| What you hear | The reality |
| “Your wallet needs syncing; enter your recovery words.” | No genuine wallet or exchange makes this request. |
| “You have only 24 hours to claim your prize.” | Manufactured urgency exists so you have no time to think. |
| “Send a fee to release your airdrop.” | An advance payment to receive free money is always a scam. |
| “I am from support; send a screenshot of your screen or install this app.” | Remote-access apps let the attacker do anything on your device. |
| “This signature is only for login and costs nothing.” | Some “free” signatures are token withdrawal permissions. |
If you clicked a suspicious link but signed nothing and entered no words, usually nothing has happened; close the page. If you did sign or enter something, go straight to the lesson on what to do if you get hacked.
Common mistakes
- Reaching an exchange or wallet site through a search ad or a Telegram group link.
- Entering the recovery phrase into an app that claims to need it to “sync” or “fix an error”.
- Trying to sell or transfer an unknown token that appeared in your wallet unasked.
- Paying a “release fee” to receive an airdrop or prize.
- Trusting a support agent who messaged first just because they know your name and account details.
- Joining airdrops with the same wallet that holds most of your assets.
What do volume and data say here?
Before you trust an airdrop or an unknown token, check a few things yourself in an explorer:
- The token contract: compare the contract address with the one announced on the project's official site or documentation. Anyone can copy a token's name and symbol; they cannot copy the contract address.
- The distribution pattern: if the same token was sent to thousands of random addresses in identical amounts, it looks more like a bait campaign than a real airdrop.
- Holders and liquidity: the number of holders, concentration in a few addresses and the presence or absence of a real market paint a clear picture. A token that shows a lot of “value” in your wallet but has no real market is only a number on a screen.
These checks are not conclusive, but they expose many traps before the first click.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
How can I tell a real Telegram airdrop from a fake one?
A real airdrop never asks for a recovery phrase or an advance payment, and its details are published in the project's official channels and site. Any request for a release fee or for recovery words is a definite sign of a scam.
An unknown token has appeared in my wallet. What should I do?
Do nothing: do not visit its site, do not sell it and do not transfer it. The token itself is usually harmless, but interacting with the site it advertises can end with signing a malicious approval.
The wallet app is in the official app store, so is it safe?
Not necessarily. The April 2026 fake Ledger Live case showed that a counterfeit app can temporarily appear in an official store. Match the publisher against the official website.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.