The "you missed it but we can fix it" trap

January 2025. A holder in Denver missed the LayerZero airdrop snapshot — he saw it announced after the cutoff. A week later, an X account named "LayerZero Foundation Late Claim Portal" replies to his complaint tweet with a link. The link goes to a clean-looking claim page that lets him "submit retroactive eligibility" by signing a verification message. The signature is a Permit2 batch on his entire ERC-20 holdings. Drained.

The retroactive-claim hook

Airdrop FOMO is one of the most reliable hooks in crypto phishing. Holders who feel they missed a chance are emotionally primed to act on any offer that suggests the chance is still open. The "late claim portal" is fake by design — no real airdrop has a late claim process, because retroactive claims would undermine the original snapshot's signal.

The four standing rules for airdrops

  • Snapshots are final. If you missed a snapshot, you missed it. Real projects do not run "second chance" portals.
  • Claims happen on the project's own URL, linked from the project's verified X account. LayerZero's airdrop was claimed on a specific URL announced from the official handle. Any other URL claiming to be a LayerZero claim is fake.
  • "Eligibility verification" via signature is the scam payload. Real eligibility is checked on-chain — the contract reads your address and your historical activity. No signature is needed for the protocol to know what you held when.
  • Replying to your complaint tweet is the bot signal. Real project teams reply to complaints occasionally; bots reply within seconds, every time, with a polished landing page.

What I missed: my own real airdrop history

I have missed eight airdrops by my count. Each one I missed because I did not check the announcement window, or did not hold the required token, or did not perform the required action on chain. Every one is gone. I have never recovered any of them — and no real project has ever offered to recover them for me. The fact that someone is offering means the offer is the scam.

If you signed

The Permit2 batch is on-chain risk. Move every approved token from the wallet immediately. Revoke every Permit2 approval on revoke.cash. Generate a new wallet for future use; this one is now permanently in the drainer's queue.