The "you missed it but we can fix it" trap

January 2025. A holder in Denver missed the LayerZero airdrop snapshot — he saw it announced after the cutoff. A week later, an X account named "LayerZero Foundation Late Claim Portal" replies to his complaint tweet with a link. The link goes to a clean-looking claim page that lets him "submit retroactive eligibility" by signing a verification message. The "message" is a Permit2 batch permit covering every token he had previously approved to Permit2 — which, after a few years of swapping on Uniswap, is most of his ERC-20 holdings. Drained.

The retroactive-claim hook

Airdrop FOMO is one of the most reliable hooks in crypto phishing. Holders who feel they missed a chance are emotionally primed to act on any offer that suggests the chance is still open. The "late claim portal" is fake by design. A claim window can stay open for a while, but no real airdrop reopens eligibility for addresses that missed the snapshot, because that would undermine the snapshot itself.

The four standing rules for airdrops

  • Snapshots are final. If you missed a snapshot, you missed it. Real projects do not run "second chance" portals.
  • Claims happen on the project's own URL, linked from the project's verified X account. LayerZero's airdrop was claimed on a specific URL announced from the official handle. Any other URL claiming to be a LayerZero claim is fake.
  • "Eligibility verification" via signature is the scam payload. Real eligibility is fixed when the snapshot list is published — the claim contract simply checks whether your address is on it. You never have to sign a permit for the project to know what you held or did before the snapshot.
  • Replying to your complaint tweet is the bot signal. Real project teams reply to complaints occasionally; bots reply within seconds, every time, with a polished landing page.

If you signed

A signed Permit2 permit can be used until its deadline, and the tokens you approved to Permit2 stay exposed until you revoke. Move every remaining token out of the wallet immediately, then revoke every Permit2 approval on revoke.cash. Generate a new wallet for future use; this one is now permanently in the drainer's queue.