Almost every wallet drain that starts with the word "claim" follows the same script. Knowing the script is the best defence, because the pages themselves are often pixel-perfect copies of the real thing.
Step 1: the lure
The link arrives as a reply under a popular post, a Telegram DM from an "admin", a sponsored search result or a QR code in a Discord announcement that was posted from a hacked account. The message creates urgency: claim window closes in 2 hours, eligibility confirmed, final round.
Step 2: the lookalike domain
The domain is close to the real one: an extra letter, a swapped letter, a hyphen, a different top-level domain, or international characters that render like Latin letters (an IDN homograph). trojan-claims.xyz, tr0jan.app and xn--trjan-... addresses are all common patterns. Run any link through the claim link checker before you click connect.
Step 3: connect, then sign
Connecting a wallet only shares your public address. The damage comes from the next prompt. On EVM chains it is usually an approve, setApprovalForAll or an off-chain permit signature that gives the attacker permission to move your tokens later. On Solana it is a transaction that transfers tokens or reassigns token-account ownership, often bundled with harmless-looking instructions.
Step 4: the sweep
A bot watches for the approval and moves everything it can, often within the same block. Because the permission was valid, there is nothing to reverse.
The checks that stop it
- Type the project address yourself or use a bookmark. Never use a link from a DM.
- Real airdrops do not require you to send tokens or "verify" a wallet with a payment.
- Read what you sign. Paste EVM calldata into the signature decoder to see the spender and amount.
- Use a separate claim wallet with nothing else in it.
- Work through the claim checklist every time, even when you are in a hurry.
Educational only. #DYOR #NFA