Airdrop scam vocabulary explained by Ilia Zavialov: the words that hide a permission
Almost nothing in a fraudulent token offer is a lie in the ordinary sense. The words are technically accurate and deliberately chosen so that the dangerous step reads like a formality. Connect, verify, activate, claim, unlock: each has a precise meaning on a blockchain, and only one family of them hands over control of money. Losses from this kind of phishing came to 83.85 million dollars across 106,106 people during 2025 in networks running the Ethereum virtual machine. This is a short dictionary of the words that matter, arranged by what they actually authorize.
Airdrop scam vocabulary explained by Ilia Zavialov: the words that hide a permissionConnecting reveals an address. Signing executes an instruction.
Connect and sign are not the same word
Connecting a wallet to a site shows the site your public address and nothing else. It cannot move anything, and treating it as dangerous makes people ignore the step that is.
Signing is where authority changes hands. A signature is an instruction your wallet carries out, and the wallet will not warn you that the instruction is a bad idea, because from its point of view you asked for it.
The scheme relies on those two being blurred together in the reader's mind. If connect and sign feel like one action called getting started, the dangerous half arrives unexamined.
The four words that hand over money
Approve, setApprovalForAll, Permit and Permit2 all mean the same thing in plain language: somebody else may now move a named asset out of your wallet without asking again.
None of this requires a password, an exchange login or a secret recovery phrase. That is the part people find hardest to accept, because every warning they have ever read was about the phrase.
The word all in setApprovalForAll is doing real work. It covers a whole collection rather than one item, and it stays valid until it is revoked by hand.
The scale is industrial rather than artisanal. One known operation accounts for more than 215 million dollars over its lifetime, 200,000 victims across 28 networks, with 80 percent of the proceeds paid out to affiliates who simply drive traffic to it.
Gas, network fee and activation
Gas is the payment a network takes for processing a transaction. It goes to the network and never to a person, and it cannot be paid to a site or a support agent.
Any wording that asks for an activation payment, an unlock fee, a verification deposit or a gas top up sent to an address is describing something that does not exist in the protocol.
A genuine claim costs gas paid by your own wallet to the network. A payment to somebody in exchange for receiving free tokens is the whole scheme stated out loud.
Claim, unlock and verify
Claim is a real mechanism and that is exactly why it works as bait. Genuine distributions do exist, they are announced by the project itself, and they never arrive first as a private message with a link.
Unlock and verify have no fixed technical meaning. They are interface words, and in a fraudulent flow they label the screen where the approval signature is requested.
The useful habit is to read the signature request rather than the page around it. The page is designed copy. The request is the thing that will actually execute.
Delegation is the newest word in this family. The first documented case of a delegated batch transaction cost the holder roughly 147,000 dollars in a single confirmation during May 2025.
What the numbers say about the trend
Losses fell sharply and that is not the reassurance it looks like. The 2025 total of 83.85 million dollars is 83 percent below the 494 million recorded in 2024, while the number of people affected fell by 68 percent.
Losses falling faster than victims means the average loss per person went up. Fewer people are being caught and each one loses more, which usually indicates better targeting rather than a retreating problem.
Activity tracks the market. The worst quarter of 2025 was the third, at 31 million dollars, during the strongest rally of the year, because attention and optimism are the raw materials the wording works on.
Losses fell faster than the number of people affected, so the average loss rose.
The word on the screen, what it means technically and what it lets somebody do
The word
What it means
What it authorises
Connect wallet
The site sees your public address
Nothing can be moved by this alone
Sign message
Your wallet executes an instruction
Depends entirely on the instruction
Approve
A spending allowance for one asset
Moving that asset without asking again
setApprovalForAll
An allowance over a whole collection
Moving every item in it until revoked
Permit and Permit2
An allowance granted by signature
The same power with no separate transaction
Gas or network fee
Payment to the network for processing
Nothing, and it is never paid to a person
Activation or unlock fee
No such thing in the protocol
A payment to the operation running the page
Delegation
Your address acts through another contract
A batch of actions in one confirmation
Three harmless steps and one that matters, presented as a single process.
Questions and answers
Is connecting a wallet to a site dangerous?
By itself, no. Connecting shows the site your public address. What matters is the signature requested afterwards, and treating the connection as the risky moment distracts from the one that is.
They did not ask for my recovery phrase. Am I safe?
No. This category works entirely through signatures. Approve, setApprovalForAll, Permit and Permit2 move assets without any password, exchange login or recovery phrase.
Why would a free token distribution ask me to pay?
It would not. A genuine claim costs only gas, paid by your wallet to the network. An activation fee, an unlock payment or a verification deposit sent to an address is the scheme itself.
Are airdrops always fraudulent?
No, and that is why the bait works. Real distributions are announced by the project through its own published channels, and they do not arrive first as a private message with a link attached.
Losses dropped a lot in 2025. Is the problem going away?
Not really. Losses fell 83 percent while the number of people affected fell 68 percent, so the average loss per person rose. Fewer targets, each worth more, is a change in method rather than a retreat.
Written by Ilia Zavialov, digital security consultant. All glossary terms
