The QR code that arrived by mail

October 2024. A holder in Portland receives an unsolicited postcard featuring a polished crypto logo and the message "You qualify for the NexDrop airdrop — scan QR to claim your 500 NXDR tokens." The QR code resolves to a wallet-connect page that looks legitimate. He connects his MetaMask and approves what the page calls a "verification." It is actually a series of setApprovalForAll transactions, one for each of his most valuable NFT collections, handing the attacker control over all of them. Drained in 90 seconds.

Why physical-mail airdrops feel real

Email phishing has trained most holders to be skeptical. A physical card in the mailbox triggers a different mental category — "official document," "actual mail," "someone paid for postage." That extra credibility is what makes the postage worth paying for the scammer.

The four hard rules

  • No legitimate airdrop is delivered by physical mail. Real airdrops are claimed via on-chain transactions, signaled through the project's own X/Discord, and require holding a specific token or completing a specific on-chain action. Nothing in that workflow requires the project to know your physical address.
  • QR codes on unsolicited mail are phishing. Same threat model as email links — the QR resolves to a URL the attacker controls. Treat physical QR codes with the same skepticism as suspicious links.
  • Wallet-connect from an unknown URL is the trap. Once a malicious site has your wallet's session, every signature prompt is the attacker's choice. The defense is to never connect to a URL you did not type yourself.
  • A "verification" that is really an approval is the universal scam payload. Airdrop eligibility is decided by what your address already holds or did on-chain; claiming never requires handing over control of other assets. If a prompt labeled "verify" turns out to be setApprovalForAll, approve, or a permit signature, it is the drainer.

If you signed

Go to revoke.cash immediately and revoke every approval to non-mainstream contracts. Move every remaining NFT and high-value token to a fresh wallet you control. Do not assume you escaped because nothing has moved yet: an approval stays usable until you revoke it, and some drainers wait before collecting.

What I do with these cards

Shred them. The card does tell me one thing: someone has linked my home address to crypto, so I expect more attempts, possibly more convincing ones, and stay alert. The QR code itself is trash.