The token that wasn't free

September 2024. A holder in Chicago notices a new token in his MetaMask sidebar: "USDT Airdrop Reward — claim 5,000." Etherscan shows the contract has been distributing this token to thousands of wallets that hold USDT. The claim site looks polished, and the projected reward is $5,000 in real USDT after "verification."

The verification page asks for a signature to "prove wallet ownership." The signature is a Permit2 batch message, an EIP-712 typed-data request. He had swapped on Uniswap before, so his USDT and USDC were already approved to Permit2, the shared approval contract Uniswap uses — a perfectly normal step at the time. The one signature handed the attacker's address spending rights over both tokens through Permit2. Both balances vanish.

The dust-and-bait pattern

Step 1: the attacker sends a worthless token to thousands of wallets, named to mimic a real airdrop. The token shows up in wallet UIs automatically. Step 2: the token's name or symbol carries the address of a "claim" website. Step 3: the claim page asks for a signature that turns approvals the visitor already gave (to Permit2, for example) into spending rights for the attacker — the dropped token itself is never the target.

Three rules

  • Unsolicited tokens are bait, not gifts. If a token appears in your wallet that you did not buy, swap for, or receive from a known source, treat it as a phishing lure. Do not click its contract address.
  • Real airdrops do not require a signature with token-spending scope. A real claim is either a transaction calling claim(amount, proof) or — for retroactive airdrops — a direct transfer that already arrived. No signature needed to "verify ownership."
  • Hide, don't interact. In MetaMask, open the spam token's menu and choose Hide. Do not click its name, do not visit its website, do not let curiosity drive the next move.

The proactive defense

Audit approvals every month at revoke.cash. Anyone who has used DeFi for a while tends to carry dozens of stale approvals from past experiments — each one is an open door. Revoke everything you are not actively using. The gas cost is one-time; the security improvement is permanent.

What dust-tokens look like in 2026

Names have evolved: "BlackRock Bitcoin ETF Claim," "USDC Compensation Pool," "Coinbase Layer-2 Bonus." The pattern is the same — exploit a real news event to make the fake token feel plausible.