Crypto Airdrops: How They Work and Where the Trap Is

Key points

An airdrop is not a gift. It is marketing spend and governance distribution: the project buys users, attention and a supply split it can present as decentralised.
At August 2026 gas prices (0.151 gwei), farming an airdrop costs cents in gas. The real cost is locked capital, time, and the risk of signing something you do not understand.
The same 144 transactions would have cost roughly $6,250 at the 50 gwei that was normal in 2021: the cost of farming depends on the cycle, not on the campaign.
In 2025, according to Chainalysis, personal wallets lost $713m across 158,000 incidents with more than 80,000 unique victims. The fake airdrop is one of the front doors.
When a token shows up in your wallet unannounced, the correct move is to do nothing: trying to sell it is exactly the step the attacker needs you to take.

Market data: Market data on this page was collected on 28 August 2026 and changes constantly. Check the linked sources before relying on it.

An airdrop is a delivery of tokens to a set of addresses without those addresses paying for them. Put that way it sounds like a supermarket promotion, and that is exactly the reading that suits whoever is handing them out. No project gives away part of its supply out of generosity. It does so because it is cheaper than the alternatives and because the distribution solves specific problems for it.

There are two entirely different conversations packed inside the word "airdrop." One is economic: what it costs to chase them and what the real probability is of receiving anything. The other is about security, and it is the one that actually causes damage. The fake airdrop is one of the most effective attack vectors against individual wallets, precisely because it exploits the part of your brain that hears "free" and stops reading.

What the project gains by handing out tokens

Distributing governance. A protocol that wants to present itself as decentralised needs its voting token not to sit in five wallets. A broad airdrop creates thousands of holders in a day and a distribution chart that looks far more presentable to users, partners and regulators.

Bootstrapping liquidity and usage. Distributed tokens come back into the system: they get deposited in pools, posted as collateral, traded. The project converts its own supply into measurable activity.

Buying attention. It is advertising paid in kind. Instead of spending money on acquisition, the project issues an asset it creates itself at an accounting cost close to zero, and in return gets sign-ups, transactions and users trying the product. Many of those users vanish the day after they sell; the project knows this and accepts it.

There is a fourth, less glamorous motive: a retroactive distribution rewards people who were already using the protocol, which reduces resentment when the token also ends up with funds that got in earlier and cheaper. It is the same allocation-and-unlock dynamic we cover in the guide to ICOs.

The four types, and what each one asks of you

Type	Distribution criterion	What it asks of you	Characteristic risk
Retroactive	Past activity in the protocol, with an unannounced cut-off date	Nothing at the moment of announcement	Criteria defined after the fact; a detail can exclude you
Task-based	Completing actions: transactions, bridges, social media, referrals	Time, gas and sometimes personal data	Data harvesting, campaigns that never distribute
Holding-based	Holding an asset on a specific date (snapshot)	Maintaining a balance	Encourages moving funds to worse platforms for convenience
Fork	Holding the original coin when the chain splits	Nothing	New chains with weak security and fake claim tools

The retroactive type is the cleanest for users and the hardest to chase, because the whole point is not announcing the criteria. The task-based type is the one that created an industry.

Farming and the anti-sybil arms race

Farming means artificially generating the behaviour a future airdrop might reward: many wallets, many small transactions, activity spread across protocols that do not have a token yet. A sybil attack is the industrial version: hundreds or thousands of addresses controlled by the same person.

Projects respond with filters: transaction graph analysis to spot wallets funded from the same source, identical timing patterns, cloned amounts, absence of organic activity. Recent campaigns have excluded addresses in bulk on these grounds, and the exclusion lists are almost never published in detail or open to any real appeal.

The result is an asymmetric game: you take on certain costs up front and the project defines the distribution rules afterwards, with no obligation to be transparent. Any framing that treats farming as a predictable income source ignores that asymmetry.

Worked example: what farming really costs

Assume a twelve-month campaign in which you interact with three protocols four times a month each: 144 transactions a year, plus two bridge operations in and out.

Scenario A — on a layer 2, at April 2026 costs: the median transaction cost was $0.04 on Arbitrum One, $0.02 on Base, $0.03 on Optimism and $0.05 on zkSync Era. At $0.04:

144 × $0.04 = $5.76 in gas.
Two bridge operations on mainnet, taking the high end of the August 2026 range ($0.24): $0.48.
Total direct cost: ≈ $6.24.

With Ethereum gas at 0.151 gwei and a Uniswap swap costing around $0.131 as of 28 August 2026, gas has stopped being the barrier. That is the honest conclusion, and it cuts against the usual cliché. Now the part that does hurt:

Locked capital. If you keep $2,000 in positions all year just to "look like a user," the opportunity cost at the 2.67% APR Ethereum staking paid in August 2026 is $53.40. Eight times the gas.
Time. 144 transactions at three minutes each is 7.2 hours a year, before you count following announcements.
Estimated total cost: ≈ $60 plus your time.

The break-even point. If you estimate — and this is your hypothesis, not a data point — that one campaign in five ends up distributing something to a profile like yours, the average airdrop needs to be worth around $300 just to avoid losing money. That number is worth writing down before you start, not after.

Scenario B — the same effort in a different cycle. August 2026 gas is extraordinarily low by historical standards: in 2021, 50–200 gwei was routine. Scaling the cost of a swap linearly (from $0.131 at 0.151 gwei), those same 144 transactions on mainnet would cost on the order of $6,250 at 50 gwei, and double that at 100 gwei. The cost of farming is not set by the campaign. It is set by network congestion. How that is calculated is in the gas fees guide.

The fake airdrop: the attack vector

This is where the word "free" becomes the problem.

In 2025, according to the Chainalysis Crypto Crime Report published on 8 January 2026, personal wallets lost $713 million across 158,000 incidents, with more than 80,000 unique victims: 20% of everything stolen that year. These are not exchange hacks. These are individuals signing things. The average scam payment went from $782 in 2024 to $2,764 in 2025, a 253% increase, and impersonation scams grew 1,400% year on year. The FBI, for its part, recorded more than $11 billion in cryptocurrency fraud across 181,565 complaints in its April 2026 IC3 report.

The attack follows a very stable choreography:

The token appears. Someone sends a token to your address, usually to thousands of addresses at once. You signed nothing; sending to a public address requires no permission from you.
It looks like it is worth money. The attacker creates a pool with minimal liquidity so explorers and wallets display a price. You see "$1,400" in a token you never asked for.
You look for how to sell it. The token's name, or its description, contains a URL. That is the entire purpose of the delivery.
The site asks for a signature. It does not ask you to sell. It asks for an approve or an increaseAllowance over the tokens in your wallet that do have value, or an off-chain permit signature that costs no gas, never shows up as a transaction and authorises just the same. For NFTs, the equivalent is setApprovalForAll.
The drainer sweeps. With the authorisation granted, the contract empties the approved balances. There is no reversal, no customer service and no insurance.

There are variants: honeypot contracts that let you buy but block selling, so every attempt burns gas and fails; and address poisoning, which means sending you tiny amounts from addresses that look visually similar to the ones you normally use, so you copy the wrong one out of your history.

Signing is not the same as sending. A transaction that moves funds is visible coming: there is an amount and a recipient. An authorisation moves nothing at that instant, costs little or nothing, and can grant unlimited, permanent access to a balance. If a website insists you sign "to verify" or "to unlock," that is the attack.

What to do with a token that appeared on its own

Nothing. Literally nothing.

That answer is disappointing because it looks passive, so it is worth explaining why selling it is the trap. To sell a token you must authorise a contract to spend it, and the contract you will be offered is theirs. On top of that, the token "worth" $1,400 on screen has no real market: its price comes from a pool the attacker controls and can drain. You are paying a certain risk for revenue that does not exist.

Do not visit the website that appears in the token's name, symbol or metadata.
Do not try to sell it, transfer it or "move it to another wallet just to test."
Do not connect your main wallet to any claim page, not even "just to look."
Do not search for how to sell it in a search engine: ads for cloned sites live off that exact query.

What you can do: hide the token in your wallet interface, review and revoke old authorisations through the block explorer's token approvals tool, and get on with your life. For the full catalogue of traps, it is in the most common crypto scams.

Security checklist before claiming anything

Confirm the announcement on the project's official channel, and reach the site by typing the domain by hand, never from a social post or a direct message.
Remember that a legitimate claim never needs your seed phrase or private key. Ever. No exception.
Use an empty secondary wallet to connect and claim; move the proceeds afterwards.
Read the signature you are being asked for: if it says approve, permit or setApprovalForAll and you thought you were claiming, stop.
Distrust any claim that requires you to send funds first "to cover gas": legitimate airdrops do not charge you in order to pay you.
Revoke authorisations you no longer use, with a periodic review in your calendar.
Keep significant balances in a wallet you never connect to any dApp.

Tax: an unusually unsettled area

Airdrops are one of the least settled corners of crypto taxation anywhere, and the divergence between countries is wider here than for trading or staking.

Broadly, three treatments exist in published guidance around the world. Some jurisdictions treat tokens received for free as income at the moment you gain control of them, valued at market price that day, with a later sale taxed separately on the difference. Others treat them as an acquisition with a zero cost basis, so nothing is due until disposal and the whole sale proceeds are then the gain. A smaller group distinguishes between airdrops received in return for something — completing tasks, providing a service, promoting the project — and genuinely unsolicited ones, taxing the first as income and the second only on sale.

Whichever applies to you, two practical problems recur and no ruling reliably solves them. The first is valuation: if the only price available comes from a pool with almost no liquidity, or from a market that did not exist until the day of the drop, the "market price on the day of receipt" is a number nobody can defend well. The second is unsolicited tokens: assets you never asked for, never claimed and cannot sell. Most tax guidance simply does not address them, and the practical position taken by advisers in different countries is not consistent.

Record every receipt as it happens, regardless of your country. Date, sending address, token, quantity, and the best local-currency valuation you can evidence with a source. If you later face a review, contemporaneous records with a stated, consistent methodology are worth far more than a reconstruction. This is not tax advice: check your own tax authority's published guidance, and speak to a professional if amounts are meaningful.

Where things stand in 2026

The joint SEC and CFTC interpretation of 17 March 2026 addresses airdrops expressly within its crypto-asset taxonomy, alongside protocol mining and protocol staking, and starts from the position that most crypto assets are not themselves securities. In the European Union, MiCA does not prohibit giving tokens away — free offers are among the cases carved out of the white paper regime — but it places public offers under disclosure obligations and issuer liability, which pushes serious projects to document a distribution rather than improvise it.

None of that protects your wallet. Regulation disciplines whoever is distributing; the fake token that lands in your address tomorrow will still come from someone with no intention of complying with anything. The defence is the same as it was five years ago and has not improved: do not sign what you do not understand, and be especially suspicious when the thing on offer is free.

Frequently asked questions

Is it dangerous when an unknown token appears in my wallet?

Receiving it is not. Anyone can send a token to any address and you have signed nothing. The danger starts when you interact with it. Hide it from your wallet interface, do not visit the website that appears in its name or description, and do not try to sell or transfer it.

Can I lose funds just by connecting my wallet to a website?

Connecting on its own shares your public address; it moves nothing. The theft happens on the next signature: an approve or a permit authorising a contract to spend your tokens. Many drainers use off-chain signatures that cost no gas and never appear as a transaction, which is what makes them look harmless.

Is farming airdrops worth it?

It is a bet, not an income strategy. You pay certain costs — gas, time, locked capital — for an uncertain reward decided by criteria the project defines afterwards and does not publish in advance. Many campaigns end with no airdrop at all, or with anti-sybil filters that exclude precisely the repetitive activity farming produces.

How is a received airdrop taxed?

Treatments differ sharply by country and this is one of the least settled corners of crypto tax. Several jurisdictions treat tokens received for free as income or as a gain valued at market price on the day you gain control of them, with a later sale taxed separately on the difference. Others tax nothing until disposal. Unsolicited tokens with no real market are frequently not addressed at all in published guidance. Check your own tax authority and take advice for meaningful amounts.

Sources and references

Important notice. InfoCrypto is an educational site. Nothing here is financial, tax or investment advice. Crypto assets are high risk: you can lose all the capital you invest. Always verify data against the original sources before making any decision, and consult a licensed professional if you need to.