Copy-paste token airdrop posts

The research was done by AI agents that open web pages. Some sites refuse them; where that happened we say so. The small numbers point to the source list at the end. Where a figure is our own sum or guess, it is marked “our estimate” and the basis is given.

The claim

Our collection holds 37 tweets on this scheme¹. We quote none of them. Every account in the collection has fewer than 4,000 followers, and our rule is to name an account only if it has about 10,000 followers or more, or sells something tied to the claim¹. So this page describes the template in our own words and rests on how the method is promoted generally. The page judges the scheme, not the people who posted.

35 of the 37 tweets follow one pattern¹:

• an emoji;
• a token’s name and ticker (its short trading symbol), said to be “on Solana”;
• one sentence that invites the reader to look at the token’s “crypto airdrop”, with small changes of wording from post to post;
• “CA=” followed by a contract address (the long string of letters and numbers that identifies a token on a blockchain);
• one shortened link.

The other two tweets are of a different kind: a list of tools for airdrop farming (using many crypto projects early in the hope of a later free hand-out of tokens) and a post of invite codes for a points programme (a scheme in which a project scores what its users do, often ahead of such a hand-out)¹. They are covered by our airdrop-farming page and are left out of the counts below.

In the tweet text we collected, none of the 35 gives an airdrop amount, a token price, who is eligible, a deadline, a fee, or who is running the airdrop¹. We did not view any images, videos or threads attached to the tweets.

The 35 posts came from 9 accounts with 1,174 to 2,971 followers¹. Together they had 617 views and 7 likes when collected; the middle post had 12 views and the most-viewed had 70¹. Going by the tweets’ ID numbers, 28 of the 35 were posted within one hour on 6 October 2026 (our estimate)¹. They name 33 different contract addresses, and two token names are cut off mid-word¹. That fits posts written by a script from a feed of token names, not by a person recommending something. How the accounts are run was not checked.

What the scheme is

An airdrop is a free hand-out of a crypto token, usually by a project to people who used its product before a certain date. Solana is a blockchain on which many small tokens are launched. A wallet is the app that holds a person’s crypto and approves (“signs”) transactions.

The posts suggest that a named token has an airdrop and that the link leads to it. The reader’s question is whether clicking through, or buying the named token, pays.

We checked where the links go. This is what we saw.

All 35 links go to three free-hosted sites with similar names, and none goes to a token’s own site. Following the redirects, 33 links led to one sub-site on Netlify, a web host with a free plan, and one each to two others². The three site names contain “claims”, “drop” or “airdrop”². The token’s ticker and contract address are passed along in the link². None of the 35 led to a token project’s site, an exchange or a launchpad (a site where new tokens are created and first traded)². We read the content of one site only, the one that 33 of the links point to, in an archived copy and a public scan³⁴. We did not read the content of the other two, which had one link each. What follows describes the site we read.

The page is one template that shows an “airdrop” for any token. An archived copy from 6 October 2026 carries the title “Solana Token — $TOKEN Airdrop”, where “$TOKEN” is an unfilled placeholder³. The page fills in a token’s name, logo and price from the address in the link³. One researcher fetched a copy on another Netlify address that was still up on 10 October, with the same title and the same outside script. Given the address of a well-known Solana token it produced the title “Bonk — $Bonk Airdrop”; four addresses tested gave four “airdrop” pages⁵. We chose that address ourselves as a test; Bonk has no connection to the page or the posts. So the page is not evidence that any named token has an airdrop.

The only action offered is to connect a wallet. The archived page has one button: “Connect Wallet”, with the smaller words “Access the airdrop”³. A public scan of the same site on 6 October shows the headline “Claim the $TOKEN airdrop now.”, a badge “AIRDROP IS LIVE” and a counter reading “AIRDROP CLAIMS 61,000” for the placeholder token⁴.

The “live” list of people claiming is made up by the page. The archived page shows a feed headed “Recent airdrop activity” marked “LIVE”. Its code builds the wallet names and amounts with a number-generating function³. The invented claims are 0.522 to 3.261 SOL each (SOL is Solana’s own coin). The code builds them from $40 to $250 at a fixed $76.67 per SOL; at the 10 October price of $110.40 they read as about $58 to $360 (our estimate)³⁵. A new row is added every four seconds³. The claims counter is a fixed 61% of an activity figure the page works out for the token³. The copy on another address that was still up on 10 October has the same amounts and the same timer⁵. None of this is read from the blockchain³⁵.

The page loads a large outside script. It pulls a script of 988,003 bytes from an unrelated domain, obfuscated, meaning written so that it is hard to read⁶. A text search finds the wallet function name “signAllTransactions” in it once⁶. That function is part of the standard Solana wallet interface and also appears in ordinary apps, and many ordinary sites ship their scripts in unreadable form. Neither fact shows what this script does. We downloaded it as text and did not run it.

The pages last days. Public scans show the three sites live between 4 and 7 October 2026⁴. All three returned “Not Found” on 10 October². A scan archive lists the same page title on at least 40 different Netlify addresses between 11 September and 10 October 2026⁴.

What we did not see. Nobody on our side connected a wallet or ran the script. So we did not observe what happens after “Connect Wallet”. The scan service gave the page “No classification”; the person who submitted it had tagged it “@phish_report”⁴. We found no regulator, court or security-firm report that names these sites. The next sections describe a documented pattern that these pages resemble, not proof that these pages did the same.

The tokens are borrowed names, not one promoted coin. Of the 33 addresses, 20 had a trading pool on DexScreener, a price-tracking site, on 10 October, and 13 had none⁷. A trading pool is the pot of funds that lets a token be bought and sold without waiting for a matching seller or buyer. Some of the 20 are established, actively traded tokens; several have small pools⁷. Some posts use the names of well-known assets from other blockchains or of companies¹⁷. We did not check whether those Solana addresses are official versions, and we do not suggest that any named project is behind the posts.

The arithmetic

The posts state no income, so there is no claimed figure to multiply out. The sums below are built from what the link and the tokens are.

Step 1: what the reader is offered

Nothing with a number on it. No amount, no eligibility rule, no date¹. The page the link opens shows invented claims of roughly $58 to $360 each at the 10 October price (our estimate)³⁵. If a reader takes that as the offer, the question is whether any source shows a page of this kind paying a visitor. We found none.

Step 2: the reader’s sum if they click and connect

Documented payout: none. We found no report, verified or self-stated, of anyone receiving tokens or money by following a post of this kind.

Documented outcome of the same pattern elsewhere: loss of what the wallet holds. Mandiant, Google’s security unit, described this lure on Solana in January 2024. Pages posing as token airdrops were spread on X and Discord, and visitors “are lured into connecting their wallet in order to claim a token airdrop. After connecting their wallet, the victim is then prompted to sign a transaction to the drainer service, which allows it to siphon funds from the victim.”⁹ A “drainer” is a tool that empties a wallet once its owner approves a transaction.

The figures that exist are these.

Notes on the table:

• Our researchers read the Solana study’s period differently, and a news report of it gives 3,967 wallets, not 3,947¹⁰. Its lures were unrequested NFTs (one-off digital tokens) carrying a link, and a link posted from a taken-over X account, not copy-paste posts¹⁰. The two tools’ separate figures are about $2.14 million from 2,189 people and about $2.02 million from 1,759¹⁰.
• Scam Sniffer calls its yearly figures a “Lower bound estimate”¹¹. They do not cover Solana¹¹¹².
• Averages are pulled up by a few very large cases. In 2025, 11 cases over $1 million made up 27% of the total¹¹. In an earlier Scam Sniffer study of one tool, about $58.98 million was taken from about 63,210 people, and one of them accounted for about $24 million; leaving that one out drops the average from about $933 to about $552 (our estimate)¹³. No source we read gives a median, so the typical loss is lower than the averages and its size is unknown.
• Chainalysis counted about 26,500 Solana victims of personal-wallet theft in 2025, the most of any chain, though at a lower rate per 100,000 wallets than Ethereum or Tron¹⁸. That covers every kind of wallet compromise.

The step that matters. In Mandiant’s account the loss happens when the visitor approves the transaction: “If they reject the transaction, the attempted theft will fail.”⁹ Scam Sniffer adds that on Solana “the majority of phishing signatures on Solana involve initiating direct transfers”, meaning one approval moves the funds¹⁰.

So the reader’s sum on this route is: nothing documented coming in. Going out, where a signature was given in other campaigns, the averages were about $1,056 per person on Solana in early 2024 and $790 on Ethereum and similar blockchains in 2025¹⁰¹¹. These are averages among wallets that were emptied, from other lures. A few very large losses pull them up, so the typical loss is lower, and nobody has published a median or a recent Solana figure. Chainalysis says of 2025 that attackers were “stealing smaller amounts per victim”¹⁸. The real ceiling is whatever the connected wallet holds.

Step 3: the reader’s sum if they skip the link and buy the token

This is a different activity: buying a small Solana token, often called a memecoin, because a post named it.

For 13 of the 33 addresses, one price site showed no trading pool. That is about four in ten (our division)⁷. A second price site listed tiny pools, under $500, for five of them⁸. For the other eight we found no market, and we did not check whether the address is a token at all. Of the 20 with a pool on the first site, the median pool held about $96,000 and 6 held under $50,000 (our calculation from DexScreener data)⁷.

What the named tokens did over four days. One researcher compared each token’s price at the time of the post with its price on 10 October, about four days later. This is our estimate from two public price feeds, before fees⁷⁸.

The best gained 113.8% and the worst lost 75.0%⁷⁸. The 13 tokens with no pool are left out, which flatters the result. Of the 7 larger tokens, 5 rose and 2 fell (our subtraction), so the overall count is held up by larger, established tokens. Twenty tokens over four days is too small a sample to generalise from. With 617 views across all 35 posts, the posts are unlikely to have moved any price¹.

Fees. 9 of the 33 addresses end in “pump”, the mark of tokens created on the launchpad Pump.fun; two more end in “BAGS” and one in “bonk”, the marks of other launchpads (our count and reading)¹. Pump.fun’s fee page lists 1.25% per trade in a token’s first trading stage: 0.95% to the platform and 0.30% to the token’s creator⁴². Tokens that leave that stage trade on Pump.fun’s own exchange, PumpSwap. There the fee slides with the token’s market value, from 1.25% for the smallest tokens down to 0.30% for the largest⁴². Seven of the nine Pump.fun tokens had a PumpSwap pool on 10 October, so they are past the first stage; the other two had no pool⁷. A buy and a sell on a Pump.fun token therefore cost between 0.6% and 2.5% before any price change, depending on the token’s stage and size (our sum)⁴². We did not check the fees for tokens from other launchpads.

Base rates for tokens of this kind.

• Solidus Labs, which sells market-monitoring software, studied Pump.fun tokens from January 2024 to March 2025: “Over 7 million tokens deployed with at least five trades, but only 97,000 tokens maintain liquidity above $1,000.”⁴⁴ That is about 1.4% (our division). Its headline is that 98.6% of the tokens collapsed soon after launch; the report’s introduction says 98.7%⁴⁴. Its test is loss of trading money, which is looser than proof of wrongdoing. Solidus calls these tokens “pump-and-dump schemes”; that is its label, not a regulator’s finding. We did not look for Pump.fun’s response to this report.
• Chainalysis used a stricter test on the blockchains it studied. It names Ethereum, BNB and Base; Solana is not mentioned²⁰. It classed 3.59% of the 2,063,519 tokens launched in 2024 as suspected pump-and-dumps (the price is pushed up, then the pushers sell)²⁰. In about 94% of those the pool was emptied by the address that created it²⁰. The time before such a token was abandoned averaged 6.23 days, with a median of 0 days²⁰. The gap between 3.59% and 98.6% reflects different blockchains as well as different definitions, and we show both.

How traders on that launchpad did.

The first two rows cover the platform’s whole life; the CoinGecko rows each cover one month and count Pump.fun and PumpSwap together⁴⁵⁴⁶.

The platform’s reply to the first figure belongs beside it. Decrypt notes that the data leaves out purchases made after a token moves to its later trading stage⁴⁵. Pump.fun’s co-founder replied that most gains are made after that point and that the true number of profitable wallets is likely “an order of magnitude LARGER than exhibited”⁴⁵. He also wrote that around 30% of wallets had placed only a single sell order and were unlikely to be run by people⁴⁵. These are the company’s statements, read in Decrypt. We read Decrypt’s article, not the dashboard. CoinGecko’s figures count only profit on tokens that were sold, so losing tokens still held are left out⁴⁶.

None of these sources measures tokens picked from copy-paste posts.

Step 4: the sender’s sum

The documented version of this pattern pays the people who run it. We do not know who runs the posts or pages in our collection, or whether they earn anything. The sums below use other campaigns’ figures.

The split. Mandiant found the Solana tool it studied was rented out as a service with at least 35 affiliate IDs. An affiliate here is someone who spreads the links. “80% of stolen funds generally go to the affiliate whereas 20% of stolen funds go to the operator(s)”; the operator’s cut ranged from 5% to 25%⁹. Group-IB reports the same split for a larger service: “20% is transferred to Inferno Drainer developers and 80% to customers.”¹⁴

The sender’s share per person who signs. 80% of the $790 average is $632, and 80% of the $1,056 average is $845 (our sums)⁹¹⁰¹¹. Both averages come from other campaigns and are pulled up by a few large cases.

How often a post lands. The only measurement we found is for a neighbouring lure. A peer-reviewed study of “send coins and get double back” giveaway tweets in the first half of 2022 counted 457,248 such tweets and 528 paying victims on Twitter, about 1 in 1,000 tweets¹⁷. The study says its data “lacks any information on the number of views per tweet”¹⁷. Whether the same rate holds for wallet-connect pages, or for posts with 12 views in 2026, is not known.

What the sender pays. X’s price list for its API (the paid route for software to post) charges $0.20 to create a post that contains a link³³. Netlify’s free plan is “$0 forever”³⁴. Whether these accounts post through the paid route is unknown. The cost of the accounts, and of losing them to suspension under the X rules quoted below, is also unknown; Blockaid says the accounts in the set-up it tracked were bought¹⁵.

The volume needed at different rates. All figures in this table are our estimate. Only the first rate has been measured, and for a different lure.

The table reads two ways. At the only measured rate, the 35 posts we collected would be expected to land about 0.04 people, so this batch most likely brought its sender nothing. The method can only add up over tens of thousands of posts, and only if the rate holds: at 1 in 1,000 the posts for one person list at about $200 against a share of $632 to $845, and at 1 in 10,000 they cost more than the share. Account and suspension costs are left out because no source gives them.

These sums mix averages from two other campaigns with a 2022 rate for a different lure. They also describe taking money from people who did not agree to give it, which Mandiant calls stolen funds and the FBI attributes to “criminals”⁹²¹.

What people who tried it report

From people who followed posts like these: nothing on the paying side. We found no income report, case study or forum write-up from anyone paid by following a copy-paste airdrop post, and no course or tool seller promoting it as a method for the person who clicks. The only “people who got paid” in view are the rows that the landing page’s own code invents³⁵. We did not collect individual accounts of losses; our rules leave out the losses of private people.

From firms that read blockchain records: losses. Besides the totals in Step 2:

• Mandiant put the amount taken through one Solana tool at “at least $900,000 USD”⁹.
• Group-IB describes “Exclusive airdrop” pages spread on X and Discord, with over 16,000 web addresses imitating more than 100 crypto brands between 2022 and early 2024. It cites Scam Sniffer for a total of at least $80 million, so that number is second-hand¹⁴.
• A university study of the same business on Ethereum counted $135 million from 76,582 people between March 2023 and April 2025. We read a security firm’s summary, not the paper¹⁶.
• Chainalysis notes that many losses go unreported, so totals are low¹⁹.

From a firm that watched the posting side. Blockaid, which sells wallet-security software, described a related set-up in March 2026: older X accounts bought to look credible, posting from a fixed template. “Accounts are programmed to share new posts every few minutes”¹⁵. It shares three features with our collection: automated posting from several accounts, a fixed template, and an airdrop lure with a link¹¹⁵. It differs in others: Blockaid’s posts open with urgent wording, claim sums that others supposedly won, and link to web addresses made to look like real projects’ own¹⁵. We did not check whether the accounts in our collection were bought. One group it tracked used 20 X accounts and 75 wallet-connect pages between September 2025 and January 2026¹⁵. It gives no loss totals, and it has a commercial interest in the threat being large¹⁵. A trade news site reported a wallet-emptying prompt on a Solana launchpad’s taken-over web address in March 2026, so the mechanism is current⁵³.

From US authorities. The FBI’s notice of 3 June 2025 describes criminals who “advertise malicious phishing URLs for fraudulent NFT airdrop rewards tokens on social media”, ending in “draining the user’s wallet of cryptocurrency”²². It calls this a “cryptocurrency scam” and concerns a different network, Hedera²². Its notice of 4 August 2023, about criminals posing as NFT developers through taken-over or imitation social accounts, says: “The victims unknowingly connect their cryptocurrency wallets to a drainer smart contract, resulting in the transfer of cryptocurrency and NFTs to wallets operated by criminals.”²¹ California’s financial regulator keeps a complaints tracker whose glossary has entries headed “Crypto Giveaway/Airdrop Scam” and “Crypto Wallet Drainer Attack”; it says it has not verified the losses reported²⁷. None of these names the posts, pages or tokens in our collection.

The FBI’s report on 2025 counts 181,565 complaints involving cryptocurrency and $11.366 billion in losses, of which phishing and spoofing account for 7,164 complaints and $111,025,191²³. It has no separate line for airdrop pages or drainers, so neither figure measures this scheme²³.

What the rules allow now

X does not allow this way of posting. X’s help pages refused our tools, so we read archived copies.

• X’s authenticity policy, dated April 2025, bans “Operating multiple accounts that post substantially similar or identical content to one another” and near-identical repeat posts, which it calls “Copypasta”³⁰.
• The same policy says: “You may not post malicious, harmful, or deceptive links on X that may cause harm”, including “deceptive links that redirect people to unexpected destinations or mislead people about the website’s content.”³⁰
• “For severe violations, accounts will be permanently suspended at first detection.”³⁰
• X’s automation rules, updated April 2026, add: “You may not post duplicative or substantially similar posts on one account or over multiple accounts you operate”³¹. Automated posts “for entertainment, informational, or novelty purposes” are allowed if they are not duplicative³¹.

The first and last of those rules are about accounts run by one operator. If one operator runs the nine accounts, posting one template with rotating token names would fall under them; near-identical repeat posts on a single account fall under the “Copypasta” line whoever runs it¹³⁰³¹. We do not know who runs the accounts. Whether X has acted against them we did not check. X’s paid-partnerships policy lists financial products including crypto as “not eligible for Paid Partnership promotion” in Australia, the European Union and the United Kingdom; its general list does not include them³². Whether anyone is paid to post these is not known.

What X says it is doing. Two news sites quote X’s head of product in April 2026: that X was adding an automatic lock and a verification step the first time an account ever posts about cryptocurrency³⁵. One site reports him as saying X was suspending as many as 208 bots a minute³⁶. Both are the company’s own statements read second-hand.

The web host. Netlify’s policy says its services “may only be used for lawful purposes” and may not be used to impersonate others³⁴. The three sites are gone; we do not know who removed them².

Law for the reader, United States. Staff of the Securities and Exchange Commission said in February 2025 that typical memecoins are not securities: “Accordingly, neither meme coin purchasers nor holders are protected by the federal securities laws.”³⁷ The statement adds that “fraudulent conduct related to the offer and sale of meme coins” can still be pursued by other agencies, and it is a staff view without legal force³⁷. A law firm’s summary of a joint SEC and CFTC interpretation of 17 March 2026 says free airdrops of tokens that are not securities fall outside securities law³⁸. In short, buying is legal and comes with little protection, and a real free airdrop is legal.

Advice from regulators. The Commodity Futures Trading Commission: “Customers should not purchase virtual currencies, digital coins, or tokens based on social media tips or sudden price spikes.”²⁸ The Federal Trade Commission’s consumer page, last updated in May 2022: “They’ll promise free cash or cryptocurrency, but free money promises are always fake.”²⁴ The FTC is writing about offers that arrive unasked. Projects’ own airdrops to their past users (see “The upside”) are a real exception, and they are not reached through links like these. The FTC also reported that “One in four people who reported losing money to fraud since 2021 said it started on social media”²⁶, and that 49% of crypto loss reports from January 2021 to March 2022 began on social media²⁵.

Law for a promoter. In the United States the FTC expects anyone paid to promote something to disclose it⁴⁰. In the United Kingdom, promoting a cryptoasset in the course of business without authorisation or approval is a criminal offence carrying up to two years in prison, and the Financial Conduct Authority says social-media influencers can commit it³⁹. Pump.fun’s terms list the United Kingdom as a “Prohibited Jurisdiction”⁴³.

Two more points for anyone who receives or buys a token. A Solana token can be built with a “permanent delegate” who can move or destroy the tokens in any holder’s account, and holders “cannot revoke” it⁴⁷; we did not check the 33 tokens for this. US tax guidance, written about airdrops that follow a split in a blockchain, treats airdropped tokens as ordinary income at market value when received⁴¹.

Courts. We found no court or regulator action against operators of airdrop-claim pages or drainer tools; three searches is not proof that none exists. The nearest case is about something else: in October 2024 the US Justice Department announced charges against 18 individuals and entities over bot trading that made tokens look active. Four had pleaded guilty at the announcement and the remaining charges were allegations; we did not check later outcomes⁵⁴. That case concerns only the people and companies named in it, and we do not suggest any link to the posts, sites or tokens described here.

Who makes money from it

In our 37 tweets, nobody sells a course, a community, a signal group or a trading bot¹. One tweet’s link led to a referral address on a points programme, and the tool-list tweet’s links led to plain home pages¹. The 35 template posts lead only to the three free-hosted sites described above².

Who is paid by these particular posts: not established. We found no source showing who runs the nine accounts, the pages or the outside script, or whether the accounts are the operator’s own, bought or taken over.

Who is paid in the documented pattern.

As Step 4 shows, the affiliate who spreads links keeps about 80% of what is taken and the tool’s operator about 20%⁹¹⁴. Nothing is documented for the visitor.

In Mandiant’s Solana case, the firm inferred at least $900,000 taken, from about $180,000 seen at the operator’s address⁹. At an 80% share that is about $720,000 for at least 35 affiliate IDs, a simple average of about $20,600 each (our estimate; both inputs are minimums and the report gives no spread)⁹. In the Ethereum study, 6,087 affiliate accounts received $111.9 million and 56 operator accounts $23.1 million¹⁶.

Who is paid if the reader buys the token instead.

Whoever sells to the reader is also paid, at whatever price the reader accepts. Among the 3.59% of 2024 tokens that Chainalysis classed as suspected pump-and-dumps, about 94% of pools were emptied by the address that created them²⁰. We did not test any of the 33 named tokens for this.

The named tokens were not launched by the posters as far as we can see: 20 of the 33 are existing traded tokens with pools created between May 2025 and 4 October 2026⁷. We saw no sign that buying a named token benefits whoever runs the page: the page asks only for a wallet connection³. Whether the operators hold any of the named tokens was not checked.

The upside

For a reader who clicks one of these links and connects a wallet, we found no upside to report. The outcomes below are the nearest real things: what happened to the named tokens, what real airdrops have paid, and what memecoin traders make.

The best case from these posts

Take a reader who ignores the link and buys the named token. Of the 33 named tokens, 13 had no trading pool on the price site we used⁷. Of the 20 that did, 8 rose over about four days, the best by 113.8%, and 12 fell (our estimate, before fees; see Step 3)⁷⁸. That is ordinary exposure to small tokens, not an airdrop.

What real airdrops have paid

These are projects’ own distributions. In each case the receivers were people who had already used the product, and the claim was made on the project’s own site.

Jupiter’s first round shows how the amounts were spread. Every receiver got the 200 JUP base, and four volume tiers got more on top⁴⁸. Dollar values are at the first day’s closing price on one large exchange, $0.6617, and are our estimate⁴⁸.

So about 78% of receivers got only the base, roughly $130 on the first day. About 22% got roughly $800 or more, starting from an estimated $1,000 of past trading. The top 2,000 got five figures (our estimates)⁴⁸. Uniswap’s amount was flat: one past use of the product was enough⁵⁰.

Prices move afterwards. At the price on 10 October 2026 ($0.37), 200 JUP is about $74 and 1,200 JUP about $444 (our estimate)⁴⁸. Jito’s token closed its first day at $2.39 and stood at $0.54 on 10 October 2026⁴⁹.

Most receivers eventually sell. Otomato’s study of July 2026 followed the Hyperliquid airdrop for 19 months and found “86% of recipient wallets have sold every single token they received”, of 94,019 wallets⁵². “The median seller got $6.25, which is exactly the day-one close.”⁵² It puts what the sellers received in total at $2.81 billion⁵².

What memecoin traders make

The table in Step 3 has the figures: in April 2026, 5.4% of wallets on Pump.fun and PumpSwap realised over $1,000. That was the month with the highest share of wallets in profit in CoinGecko’s series, which runs from April 2024 to April 2026. Over Pump.fun’s life to January 2025, 294 wallets had realised over $1 million⁴⁵⁴⁶. These are blockchain records, not people’s own statements, but they include bots and describe traders who chose their own tokens⁴⁵⁴⁶.

A realistic good result in the first year or two (our estimate)

• From the “airdrop” in these posts: nothing. No documented payout exists.
• From buying the named tokens: no result we can generalise. Of 33 named tokens, 13 had no trading pool we could find. Of the 13 small ones that did, 10 fell over four days, with a median of minus 20%. Of the 7 larger ones, 5 rose. Fees on Pump.fun tokens take 0.6% to 2.5% for a buy and a sell⁷⁸⁴².
• From real airdrops: nothing in most cases, because most products never hand out a token. In the large distributions documented here, an ordinary earlier user got a one-off of about $130 (Jupiter’s base) to about $800 to $1,400 (Jupiter’s $1,000 tier, Uniswap)⁴⁸⁵⁰. Heavy users got thousands (Jupiter’s upper tiers, Hyperliquid’s average)⁴⁸⁵². None of this is reached through the link in these posts. Our airdrop-farming page covers that activity.

What it takes to compete

There is nothing to compete at on the page these posts link to. The two real activities nearby do have a line between those who are paid and those who are not.

What separates the people who are paid

1. For real airdrops: having used the product before the cut-off. Jito’s announcement says “The airdrop is backwards-looking and the snapshot for eligible activity was taken on November 25th, 2023”, two days before it was announced⁴⁹. By the time a real airdrop is public, the list of receivers is usually closed. A post that invites strangers to come and look at an airdrop for a token they never used does not fit that pattern.
2. For large airdrop amounts: often, money and volume. In Jupiter’s first round the size scaled with past trading: an estimated $1,000 traded moved a wallet from about $130 to about $800, and the top tier went to wallets with an estimated $1 million or more⁴⁸. Uniswap’s amount was flat and needed neither⁵⁰.
3. For memecoin trading: choosing tokens yourself, and accepting that most months most traders make little. Even in April 2026, the month with the highest share of wallets in profit in CoinGecko’s series, about one wallet in twenty made over $1,000⁴⁶. A token drawn at random from a batch post comes from the wider pool in which, by one firm’s count, about 1.4% kept more than $1,000 of trading money⁴⁴.
4. For all of it: knowing what a signature does. Mandiant’s account turns on one step, approving the transaction⁹.

How to tell a real airdrop from bait

These checks come from a wallet maker and from US authorities, plus what the real airdrops above have in common.

• Where the link is. Phantom, a widely used Solana wallet, says: “Never click on links to airdrops or giveaways in any social media post.” and “Always verify links through official sources, like the project’s website, Discord, or Twitter.”²⁹ All 35 posts fail this: the link is in a social post from an account unrelated to the token¹.
• Whose site it is. Uniswap’s airdrop was claimed in its own app, Monad’s on its own portal, and Jito told receivers to check on its own website⁴⁹⁵⁰⁵¹. All 35 links here went to free hosting sub-sites². The FBI advises checking that the account promoting an offer is the project’s real account and that the web address is genuine²¹. Its 2025 notice says to confirm a free-token offer with the token’s provider first²².
• One page for many tokens. A page that announces an airdrop for whatever token is put in its address is not run by any of them³⁵.
• Who is eligible. Real airdrops state a past cut-off date and a rule⁴⁹⁵⁰. The posts state none¹.
• Urgency. Monad gave three weeks to claim; Jupiter’s 2025 round gave three months⁵¹⁵². The scanned page shows “AIRDROP IS LIVE” and a counter⁴.
• Proof on the page. A “live” list of claims is not evidence; here the page generates it³⁵.
• What you are asked to approve. Phantom says that connecting a wallet to such a site and then signing a transaction is what empties the wallet²⁹. Chainalysis’s general advice is that users “should be wary of random links on social media and consider using a temporary, empty wallet when connecting to unfamiliar Web3 sites”¹⁹. That is advice for unfamiliar sites in general, not a tested way to try these pages, and from these pages there is nothing documented to gain.
• Never type a recovery phrase into a website²⁹. (A recovery phrase is the list of words that restores a wallet; whoever has it controls the wallet.)

What it costs

We did not test whether opening the page is harmless; Phantom’s advice is not to click airdrop links in social posts at all²⁹. Approving a transaction cost an average of about $800 to $1,000 per person in other campaigns: $1,056 on Solana in early 2024 and $790 on Ethereum and similar blockchains in 2025¹⁰¹¹. A few very large losses pull these averages up, so the typical loss is lower and nobody has published it. The real ceiling is whatever the connected wallet holds. Buying a named Pump.fun token costs between 0.6% and 2.5% for a buy and a sell, depending on its stage and size, plus whatever the price does⁴².

What we did not verify

• What the landing pages do after “Connect Wallet”. Nobody connected a wallet or ran the outside script. That the pages take funds is not something we observed, and the scan service gave “No classification”. The resemblance to the pattern Mandiant and Group-IB describe is our reading of the page’s structure.
• Whether anyone lost or gained money through these links. We found no click count, victim count or receiving wallet, and no published outcome from anyone who followed these posts.
• Who runs the posts, the pages or the script, whether the accounts are bought, taken over or the operator’s own, whether anyone is paid per post, and why the three sites are gone. We did not open the accounts.
• Two of the three landing sites. We read the content of the site that 33 links point to. The other two, with one link each, were gone before we could read them.
• Disagreement between our researchers. Two of five could not read the pages’ content; three read an archived copy, a scan screenshot or a live copy on another address, and we used what was read. The copy on the other address was linked to the three sites by its title and outside script, not shown to be identical.
• The tokens. We did not check whether the 13 addresses with no pool exist as tokens, whether tokens carrying well-known names are official versions, whether any has a permanent delegate, or whether any named token has a real airdrop of its own. Pool sizes are a one-day reading from one site and several look unreliable. “No pool” means none listed on that site that day, not that a token cannot be traded. Whether whoever runs the pages holds any named token was not checked.
• The four-day price check is our own calculation from two price feeds. It ignores fees and whether the pool money could really be traded.
• Conversion. The 1-in-1,000 rate is from 2022 giveaway tweets, a different lure, and the study did not know how many people saw each tweet. The other two rates in the Step 4 table are our assumptions. The sender’s share uses averages from other campaigns.
• Real airdrop values. Dollar values for Jupiter, Uniswap and Hyperliquid use first-day prices and our own sums. Per-wallet figures for Hyperliquid and Monad are simple averages; neither source gives a median. Hyperliquid’s figures come from one vendor’s study. We did not look for Pump.fun’s response to the Solidus Labs report.
• Solana totals. No Solana-only total for drainer losses in 2025 or 2026 was found, and no median loss anywhere.
• X’s live rules. help.x.com refused direct reading and a reader service (error 403). Quotes come from Internet Archive copies. X’s enforcement statements were read on news sites; we did not confirm the lock on first crypto posts was introduced.
• How the posts were sent. The $0.20 per post is X’s listed price, not an observed cost.
• Pages read indirectly. The SEC statement, the Solidus Labs report, the CoinGecko study, Jito’s blog, the FTC pages, one FBI notice and the Justice Department release were read through a reader service. Quotes from Mandiant, Scam Sniffer, Chainalysis, Phantom and the California tracker first came through a tool that summarises pages; a reviewer re-checked them word for word on 10 October 2026, the tracker through a reader service and an Internet Archive copy.
• Second-hand items. The Dune dashboard behind the 0.4% figure, the university paper on drainer services, the full SEC and CFTC interpretation and Jupiter’s original announcement were not opened. Whether Jupiter’s approved 2026 round took place was not confirmed.
• Regulators and courts. No action naming these sites, accounts or tokens was found, and none was searched for by name. Law outside the US and UK was not researched.
• Tweet dates and views. Dates are worked out from ID numbers. View counts are as collected. Images, videos and threads were not viewed.
• Whether anyone named has seen this page. The companies named here were not contacted before publication.

Sources

“Read at source” means we opened the page itself on 10 October 2026. “Secondary” means we read an article or summary about the source, not the source itself. “Estimate” means our own sum. “Through a reader service” means a service fetched the page for us because the site refused our tools directly. Addresses of the landing pages and their script are written out but not linked, on purpose.

1. Does It Pay collection of 37 tweets on this scheme, collected 2026-10-06. Read from our collected copy on 2026-10-10, not from the live tweets. Counts, the median and the posting hour are our calculations.
2. Our check of the 35 shortened links in the collection, following redirects only. Targets: memecoins-drop-live.netlify.app (33), memecoin-claims-now.netlify.app (1), airdrop-onsolana.netlify.app (1); all returned “Not Found” on 2026-10-10. Read at source on 2026-10-10.
3. Internet Archive capture of the landing page, web.archive.org/web/20261006205819/https://memecoins-drop-live.netlify.app/ . Capture dated 2026-10-06. Page source read at source on 2026-10-10.
4. urlscan.io, scan of one landing site, https://urlscan.io/result/01a112bb-6a67-7463-a5c7-545ef8e5e1a1/ , 2026-10-06; and public search results for the page title and the script domain, scans dated 2026-09-11 to 2026-10-10. Read at source on 2026-10-10. Stored page copies need a login and were not opened.
5. Live copy of the same template on another address, drops-solana.netlify.app, fetched as text and not run. 2026-10-10. Read at source on 2026-10-10. SOL price of $110.40 from CoinGecko the same day; dollar ranges are an estimate.
6. The outside script loaded by the landing page, sprinkler-fondling.data-repo.cc/_nuxt/assets/index.js. Downloaded as text and not run, 2026-10-10. Read at source on 2026-10-10.
7. DexScreener public API, all 33 contract addresses, in the form https://api.dexscreener.com/tokens/v1/solana/<address> . 2026-10-10. Read at source on 2026-10-10. Medians and counts are an estimate.
8. GeckoTerminal public API, token and hourly price data, in the form https://api.geckoterminal.com/api/v2/networks/solana/tokens/<address> . 2026-10-10. Read at source on 2026-10-10. The four-day price comparison is an estimate.
9. Mandiant (Google Cloud), “Solana cryptocurrency stolen: CLINKSINK drainer campaigns”. https://cloud.google.com/blog/topics/threat-intelligence/solana-cryptocurrency-stolen-clinksink-drainer-campaigns . 2024-01-10. Read at source on 2026-10-10.
10. Scam Sniffer, “Over $4 million stolen by multiple Solana wallet drainers”. https://drops.scamsniffer.io/over-4-million-stolen-by-multiple-solana-wallet-drainers/ . 2024-01-13. Read at source on 2026-10-10. The 3,967 figure is from Decrypt, https://decrypt.co/212875/hackers-steal-over-4-million-fake-airdrops-other-scams-solana , 2024-01-15, secondary, through a reader service.
11. Scam Sniffer, 2025 report on crypto phishing losses. https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/ . 2026-01-03. Read at source on 2026-10-10.
12. Scam Sniffer, 2024 report on wallet drainers. https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/ . 2025-01-03. Read at source on 2026-10-10.
13. Scam Sniffer, “From Google to X ads”. https://drops.scamsniffer.io/post/from-google-to-x-ads-tracing-the-crypto-wallet-drainers-58-million-trail/ . 2023-12-21. Read at source on 2026-10-10. Averages are an estimate.
14. Group-IB, “Inferno Drainer”. https://www.group-ib.com/blog/inferno-drainer/ . 2024-01-16, modified 2025-09-11. Read at source on 2026-10-10. Its $80 million total is secondary (Group-IB citing Scam Sniffer).
15. Blockaid, “How crypto drainers are using X (Twitter) to target web3 users”. https://blockaid.io/blog/how-crypto-drainers-are-using-x-twitter-to-target-web3-users . 2026-03-12. Read at source on 2026-10-10.
16. BlockSec, summary of a university study of drainer services on Ethereum. https://blocksec.com/blog/inside-ethereum-s-shadow-economy-new-research-unmasks-the-135-m-drainer-as-a-service-industry . 2025-10-21. Secondary.
17. Study of cryptocurrency giveaway lures on Twitter and YouTube, ACM Internet Measurement Conference 2024. https://arxiv.org/html/2405.09757v2 . 2024; data from 1 January to 29 June 2022. Read at source on 2026-10-10.
18. Chainalysis, crypto hacking and stolen funds, 2026 report preview. https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/ . 2025-12-18. Read at source on 2026-10-10.
19. Chainalysis, “Crypto drainers”. https://www.chainalysis.com/blog/crypto-drainers/ . 2024-05-16. Read at source on 2026-10-10.
20. Chainalysis, market manipulation, wash trading and pump-and-dump. https://www.chainalysis.com/blog/crypto-market-manipulation-wash-trading-pump-and-dump-2025/ . 2025-01-29, figures corrected 2025-02-13. Read at source on 2026-10-10.
21. FBI, Public Service Announcement I-080423. https://www.ic3.gov/PSA/2023/PSA230804 . 2023-08-04. Read at source on 2026-10-10, through a reader service.
22. FBI, Public Service Announcement on airdrop lures on the Hedera network. https://www.ic3.gov/PSA/2025/PSA250603 . 2025-06-03. Read at source on 2026-10-10.
23. FBI Internet Crime Complaint Center, 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf . 2026 (file created 2026-04-16). Read at source on 2026-10-10, searched by keyword.
24. Federal Trade Commission, “What to know about cryptocurrency and scams”. https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams . May 2022. Read at source on 2026-10-10, through a reader service.
25. Federal Trade Commission, data spotlight on crypto losses. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/06/reports-show-scammers-cashing-crypto-craze . 2022-06-03. Read at source on 2026-10-10.
26. Federal Trade Commission, data spotlight on social media. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2023/10/social-media-golden-goose-scammers . 2023-10-06. Read at source on 2026-10-10.
27. California Department of Financial Protection and Innovation, crypto scam tracker and glossary. https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/ . Undated. Read at source on 2026-10-10, in part.
28. Commodity Futures Trading Commission, customer advisory on pump-and-dump schemes. https://www.cftc.gov/sites/default/files/idc/groups/public/@customerprotection/documents/file/customeradvisory_pumpdump0218.pdf . February 2018. Read at source on 2026-10-10.
29. Phantom, “Common crypto scams”. https://phantom.com/learn/crypto-101/common-crypto-scams . Undated (footer 2026). Read at source on 2026-10-10.
30. X Help, authenticity policy, Internet Archive copy. https://web.archive.org/web/20261007195718/https://help.x.com/en/rules-and-policies/platform-manipulation . Policy dated April 2025; capture 2026-10-07. Read at source on 2026-10-10 in the archived copy.
31. X Help, automation rules, Internet Archive copy. https://web.archive.org/web/20261001071835/https://help.x.com/en/rules-and-policies/x-automation . Updated April 2026; capture 2026-10-01. Read at source on 2026-10-10 in the archived copy.
32. X Help, paid partnerships policy, Internet Archive copy. https://web.archive.org/web/20260825224421/https://help.x.com/en/rules-and-policies/paid-partnerships-policy . Capture 2026-08-25. Read at source on 2026-10-10 in the archived copy.
33. X developer documentation, API pricing. https://docs.x.com/x-api/getting-started/pricing . Undated. Read at source on 2026-10-10. Posting costs are an estimate.
34. Netlify, pricing, https://www.netlify.com/pricing/ , undated; and acceptable use policy, https://www.netlify.com/legal/acceptable-use-policy/ , last updated 2023-03-08. Read at source on 2026-10-10.
35. MoneyCheck, report of X’s planned lock on first-time crypto posts. https://moneycheck.com/x-platform-introduces-automatic-account-lockdown-for-first-time-crypto-posts/ . 2026-04-03. Secondary.
36. Roboin, report of X’s bot suspensions. https://roboin.io/article/en/2026/04/09/x-continues-massive-ban-wave-removing-208-bots-per-minute/ . 2026-04-09. Secondary.
37. US Securities and Exchange Commission, staff statement on meme coins. https://www.sec.gov/newsroom/speeches-statements/staff-statement-meme-coins . 2025-02-27. Read at source on 2026-10-10, through a reader service.
38. Paul, Weiss, client memo on the SEC and CFTC interpretation of 17 March 2026. https://www.paulweiss.com/insights/client-memos/sec-and-cftc-release-interpretation-on-application-of-federal-securities-laws-to-crypto-assets . March 2026. Secondary.
39. UK Financial Services and Markets Act 2000, section 25, https://www.legislation.gov.uk/ukpga/2000/8/section/25 , and section 21, https://www.legislation.gov.uk/ukpga/2000/8/section/21 , as amended; Financial Conduct Authority, FG24/1, https://www.fca.org.uk/publications/finalised-guidance/fg24-1-finalised-guidance-financial-promotions-social-media , 2024-03-26. Read at source on 2026-10-10.
40. Federal Trade Commission, “FTC’s Endorsement Guides: what people are asking”. https://www.ftc.gov/business-guidance/resources/ftcs-endorsement-guides-what-people-are-asking . First published 2017-09-07. Read at source on 2026-10-10, through a reader service.
41. Internal Revenue Service, frequently asked questions on virtual currency transactions. https://www.irs.gov/individuals/international-taxpayers/frequently-asked-questions-on-virtual-currency-transactions . Last reviewed 2026-06-30. Read at source on 2026-10-10.
42. Pump.fun, fees. https://pump.fun/docs/fees . Last updated 2026-10-08. Read at source on 2026-10-10, directly and through a reader service. The round-trip range is an estimate.
43. Pump.fun, terms and conditions. https://pump.fun/docs/terms-and-conditions . Last updated 2026-10-08. Read at source on 2026-10-10.
44. Solidus Labs, report on Solana rug pulls and pump-and-dumps. https://www.soliduslabs.com/reports/solana-rug-pulls-pump-dumps-crypto-compliance . About May 2025; data January 2024 to March 2025. Read at source on 2026-10-10, by one researcher through a reader service.
45. Decrypt, report of a Dune dashboard on Pump.fun wallets. https://decrypt.co/300403/pump-fun-traders-millionaires . 2025-01-10. Secondary.
46. CoinGecko, “Pump.fun traders are making a comeback”. https://www.coingecko.com/research/publications/pump-fun-traders-are-making-a-comeback . 2026-05-07. Read at source on 2026-10-10, through a reader service.
47. Solana documentation, permanent delegate. https://solana.com/docs/tokens/extensions/permanent-delegate . Undated. Read at source on 2026-10-10.
48. Jupiter community forum, analysis of the airdrop rounds. https://discuss.jup.ag/t/jupiter-airdrop-round-2-2025-analysis-discussion-proposal-for-distribution/26133 . 2024-10-27. Read at source on 2026-10-10; a summary of Jupiter’s own announcement, so secondary for the allocation rules. Prices from Binance’s public data and CoinGecko, read 2026-10-10; dollar values are an estimate.
49. Jito Foundation, “Announcing JTO”. https://www.jito.network/blog/announcing-jto-the-jito-governance-token/ . 2023-11-27. Read at source on 2026-10-10, through a reader service. Prices from Binance’s public data and CoinGecko, read 2026-10-10.
50. Uniswap, “Introducing UNI”. https://blog.uniswap.org/uni . 2020-09-16. Read at source on 2026-10-10. Price of $3.4617 is the 17 September 2020 daily close from Binance’s public data, read 2026-10-10; the dollar value is an estimate.
51. Monad, “The MON airdrop results”. https://monad.xyz/blog/the-mon-airdrop-results . 2025-11-10. Read at source on 2026-10-10.
52. Otomato, Hyperliquid airdrop retention. https://otomato.xyz/blog/hype-airdrop-retention . 2026-07-09. Read at source on 2026-10-10. A vendor’s own study; per-wallet averages are an estimate. Jupiter’s 2025 round: Decrypt, https://decrypt.co/302054/jupiter-drop-630-million-solana-airdrop-claim , 2025-01-21, secondary, through a reader service.
53. Cointelegraph, report of a launchpad’s web address being taken over. https://cointelegraph.com/news/bonk-fun-domain-hijack-wallet-drainer-solana . 2026-03-12. Secondary.
54. US Attorney’s Office, District of Massachusetts, announcement of charges against eighteen individuals and entities. https://www.justice.gov/usao-ma/pr/eighteen-individuals-and-entities-charged-international-operation-targeting-widespread . 2024-10-09. Read at source on 2026-10-10, through a reader service.

Corrections

If you are quoted or named on this page and think something is wrong, want your reply shown beside it, or want to be removed, write to [email protected]. We aim to reply within 14 days, and always within one month. Factual errors are corrected with a dated note here. A sentence that is seriously disputed comes down while we check it.

Change log: (empty)