“You Have a 45% Airdrop Reward Waiting” — Twitter DM Scam
How This DM Scam Works and How to Protect Yourself
A real conversation, a real attempt, and exactly how to spot it before it costs you everything.
Someone reached out to me on X within hours of my first post about a crypto token I hold. The message looked helpful. It sounded like a community mod. It almost worked — except I recognized the playbook.
I contacted the real project developers to confirm it was fake, then saved the conversation as a teaching moment.
Below is the actual exchange, with my wallet addresses blacked out. Read it carefully, because this exact script is being run on thousands of accounts every day.
Thi is actual DM conversation. Note the fake urgency, the invented technical problem, and the link to a free Netlify subdomain. About an hour after this message i received another one asking if i went on with the process, or if i need “help”.
What Just Happened — Step by Step
Step 1: The Hook — A Reward You Didn’t Know You Had
“All eligible holders have gotten their 45% airdrop rewards. Have you received your 45% reward bonus?”
This is the opener. It does a few things at once: it sounds official, it implies everyone else already got something, and it creates mild FOMO. If you’re new to crypto, you might genuinely wonder if you missed a legitimate distribution. So you answer.
That reply — that single “Not yet, where do I claim?” — is all they needed to confirm you’re worth pursuing.
Step 2: Harvesting Your Wallet Address
“Kindly send your wallet address.”
This sounds reasonable. In legitimate airdrop situations, projects do sometimes ask for wallet addresses. So if you’re not yet experienced, you share yours.
Here’s the nuance: a wallet address alone is not dangerous. Addresses are public by design on the blockchain. What they’re doing with it is pre-qualifying you and confirming you have assets worth targeting. They now know your holdings.
Step 3: Inventing a Fake Technical Problem
“There’s an issue with your in-node string which you’ve got to get fixed through the validation process.”
Stop right here. “In-node string” is not a real thing. It’s fabricated jargon designed to sound technical enough that a newcomer won’t question it. The invented problem serves one purpose: to give you a reason to take action — specifically, to connect your wallet to their site.
Legitimate blockchain protocols do not have “in-node string” errors. Legitimate airdrops do not require you to “fix” anything in your wallet to receive them. If tokens are owed to you, they are sent to your address. Full stop.
Step 4: The Kill Shot — The Fake DApp Link
“To begin the recalibration, please connect manually to the DApp mainnet below: dappmainnetfixed.netlify.app”
This is the wallet drainer. Let’s break down why this URL is an instant red flag:
netlify.app is a free hosting subdomain. Anyone can create a site there in minutes. No legitimate blockchain protocol — no mainnet, no DApp, no project of any kind — runs its official infrastructure on a free Netlify subdomain.
The name is engineered to sound authoritative. “DApp mainnet fixed” sounds like something official. It’s theater.
“Connect your wallet” + “look for Missing Assets” is the standard wallet drainer interface. When you connect your wallet and sign the transaction prompt that appears, you are authorizing the contract to transfer your tokens. By the time you realize what happened, your wallet is empty.
Why You Were Targeted
If you just created a new crypto-focused account and posted about a specific token, you are on their radar within minutes. Scam bots and human operators monitor token hashtags in real time. A new account posting about a token signals:
You hold that token (or are interested in it)
You may be newer to the space
You have not built up the skepticism that comes with experience
This is not a personal attack — it’s volume farming. They send this script to hundreds of accounts per day hoping a small percentage will follow the link.
The 5 Red Flags in This Conversation
Every crypto scam DM shares some version of these signals. Memorize them.
- Unsolicited outreach about rewards you didn’t claim
Legitimate airdrops are announced publicly. If a “moderator” DMs you personally about unclaimed rewards, it’s a scam. - A fake technical barrier between you and your money
“In-node string,” “recalibration,” “validation process” — none of these are real. Invented jargon creates urgency and the illusion that you need to fix something. - A link to a free or unofficial domain
Real DApps live on their own registered domains (e.g., app.uniswap.org, app.aave.com). A netlify.app, vercel.app, github.io, or any similar free subdomain is a red flag without exception. - Any instruction to “connect your wallet” outside of a verified official site
If you didn’t navigate to the official site yourself by typing it directly or using a bookmarked URL — do not connect. - Pressure and urgency
“Prompt action,” “immediately,” “ensure it’s accurately reflected” — scammers want you to act before you think. Real protocols don’t expire your tokens because you took an extra day to verify.
What To Do If This Happens to You
If you haven’t clicked the link yet:
You’re fine. Block and report the account on X. No further action needed.
If you visited the site but didn’t connect your wallet:
Still fine. Browsing a site without connecting causes no harm. Block, report, move on.
If you connected your wallet and signed a transaction:
Act immediately:
Go to revoke.cash (for EVM wallets) and revoke all token approvals granted to unknown addresses
Transfer any remaining assets to a fresh wallet address immediately
Consider that compromised wallet address burned — do not continue using it as your primary wallet
Report the site to Netlify abuse reporting and to the real project team
The Broader Lesson
In crypto, your wallet connection is your signature. It is the equivalent of handing someone a signed blank check. Once you sign a transaction on a malicious site, there is no customer service to call, no chargeback, no reversal. The blockchain doesn’t care who tricked you.
The good news: these scams are entirely avoidable once you know the pattern. And now you know it.
The best protection against wallet drainers is keeping your main holdings in a hardware wallet. A Ledger or Trezor keeps your private keys completely offline — even if you accidentally connect to a malicious site, your cold storage funds are safe.”
Encountered a similar scam? Share it in the comments — the more real examples circulate, the harder these scripts are to run.
📬 Want to be notified when new airdrops go live? Join our free Airdrop Alerts list — no spam, unsubscribe anytime.
Stay Safe Guide · Real Scam Dissected · Evaluate Projects . Airdrops Guide · Active Airdrops List