Orca Crypto
Tokens Book a session
Menu
Start Here
Start from zeroBuy your first cryptoHow to buy cryptoCoinbaseCoinbase AdvancedBinance.USUpholdApps we useCoinbase WalletJupiterBrave BrowserTradingViewWalletsWallets by chainHot vs cold walletsMetaMaskPhantomLedgerSlushWallet pickerBook a one to one session
Learn
Open the learning pathChoose your levelFind your levelBeginnerIntermediateAdvancedExpertTest your knowledgePopular guidesWhat is cryptoWhat is blockchainWallets explainedSeed phrasesGas feesYour first swapReading what you signCrypto taxesCompareAll comparisonsCoinbase vs Binance.USMetaMask vs PhantomLedger vs TrezorEthereum vs SolanaUniswap vs PancakeSwapCompare any twoEvery question we answer
Chains
Compare all networksBy layerLayer 1 networksLayer 2 networksLayer 3 networksBridges explainedName servicesBlock explorersPopular chainsBitcoinEthereumSolanaBaseSuiRobinhood ChainMining and stakingMining and staking explainedStakingMiningLiquid staking and restakingValidators and nodesProof of work vs proof of stake
Exchanges
Exchanges explainedDEX vs CEXDEX vs CEXCentralized exchangesDecentralized exchangesTop ten DEXsDEX viewersSwap guides by chainPopular DEXsUniswapJupiterPancakeSwapAerodromeSushiSwapKyberSwapLaunchpadsAll launchpadspump.funLetsBonk.funZoraMoonshotFOMOLaunchpads on Robinhood Chain
Markets
What moves the marketLive dataMarket meters, liveTop 1000 by market capFear and greedBitcoin dominanceAlt season indexUSDT dominanceGas trackerPrice driversFOMC and interest ratesInflation and CPIETF flowsBitcoin halvingLiquidity cyclesStablecoin supplyElections and policyWar and geopoliticsCharts and tradingCharts 101CandlesticksChart patternsIndicatorsRisk managementTrading simulator
Tools
All eighteen toolsWork out a numberPosition sizeProfit and lossLiquidation priceImpermanent lossSwap fee comparisonMarket capUnlock and dilutionCost basisCheck something liveToken safety checkerScam message checkerTransfer costGas trackerFear and greed indexExplorer routerPractice and referenceAll simulatorsTrading simulatorPhishing simulatorChart pattern trainerSlang decoderWallet pickerSeed backup sheet
Safety
Open the safety hubKnow the attacksAttacks and scamsCommon scamsPhishing and drainersSpotting a rug pullToken approvalsPig butcheringSIM swap attacksProtect yourselfSecurity checklistSelf custodySeed phrase securityHardware walletsMultisig explainedRecovery planningIf it goes wrongWallet drained? Start hereSent to the wrong addressWhat went wrong, every caseFTXTerra and LunaMt. GoxThe Bybit hackTry the phishing simulator
Glossary
Open the glossaryFoundationsBlockchainWalletSeed phrasePrivate keyAddressGasTransactionTrading and DeFiDeFiMarket capSlippageLiquidity poolStablecoinImpermanent lossLiquidationSlang, decodedSlang decoderHODLFUDWAGMIDegenRektDiamond hands
More
Book a sessionEvery question answeredContactFollow on XJoin on Telegram
Our tokens Book a session
Drainer

Malicious airdrops and claim sites

A free token you did not ask for, and a claim page built to empty the wallet.

Loading live prices
Attacks
All attacksPhishing emails and messagesSextortion phishingRansomwareWallet dustingPig butchering and romance scamsFake support and impersonationGiveaway and doubling scamsSIM swap attacksMalicious airdrops and claim sitesClipboard hijackingCounterfeit wallets and extensionsPhysical safety and operational securityDeepfakes and AI impersonationSafety hubSecurity checklistSelf custodySeed phrase securityHardware walletsToken approvalsRecovery planning
By the Orca Crypto teamUpdated 2026-09-01How we check this5 min read
The short answer

A free token you did not ask for, and a claim page built to empty the wallet. Tokens appear in your wallet, or an advert offers a claim for a project you actually use. The claim page asks you to connect and sign. The signature is not a claim, it is an approval that lets a contract move your tokens, or a transaction that transfers them outright.

What it is

Tokens appear in your wallet, or an advert offers a claim for a project you actually use. The claim page asks you to connect and sign. The signature is not a claim, it is an approval that lets a contract move your tokens, or a transaction that transfers them outright.

How it plays out

  1. The bait arrives

    An unrequested token, a reply under a real project’s post, or a paid search advert above the real site.

  2. The site looks correct

    Cloned front ends are cheap and the URL is one character out.

  3. The signature is the trap

    A blind signature, an unlimited approval, or a permit that authorizes a transfer without a further transaction.

  4. It empties in one go

    Drainer kits check what is worth taking first and take the most valuable thing in a single transaction.

What gives it away

  • Any airdrop you did not sign up for.
  • A claim window with a countdown.
  • A signature request you cannot read in plain language.
  • A search advert for a crypto site. Scroll past the ads, always.

How to not be caught by it

  • Claim only from the project’s own domain, typed by you or reached from a bookmark.
  • Use a burner wallet for claims, funded with only the gas needed.
  • Read what you are signing. A wallet that simulates transactions makes this realistic.
  • Never approve an unlimited allowance for a contract you do not know.
  • Check approvals periodically and revoke everything you are not actively using.
The hard part is not technical
None of these require technical skill to avoid. They require doing the boring check at the exact moment you feel most rushed, which is the whole difficulty.

If it already happened

  • Move remaining assets to a fresh wallet immediately. Speed matters more than tidiness.
  • Revoke approvals for the compromised wallet afterward, not before moving funds.
  • Assume the wallet is permanently untrusted, including for future airdrops.
  • Check whether a hardware wallet seed was ever entered anywhere. If so, that seed is burned too.
Recovery scams
Anybody who contacts you offering to recover lost crypto for a fee is running the second scam on the same victim. There is no recovery service that can reverse a blockchain transaction, because nobody can. Report it through official channels and ignore everyone else.

Where to go next

All attacksThe full list, side by side.Security checklistDo the fixes in order.Self custodyHolding your own keys properly.

Check your setup before you need to

An hour on a screen share, going through your wallets, your approvals, your backups and your recovery plan. You click everything and we never ask for keys.

Book a sessionSee all attacks

Common questions

Is it dangerous just to hold an unexpected token?
Holding it is generally safe. Interacting with it is not. The attack is the claim page or the swap that asks you to approve something, not the token sitting in your list.
The token shows a large dollar value. Is that real?
Usually not. The price is set in a pool the attacker created, precisely so you go looking for a way to sell it and end up on their page. Treat a surprise five figure balance as bait.
Share this page

Was this page useful?