Wallet drained after signing approval on cloned airdrop site

Narrative

A link circulated in a project chat led to a claim page requesting a wallet connection. After signing a token approval, the reporter's balances were transferred out within the same block window.

Submitted by a member of the public in Canada. Reporter identity and contact details are not published.

Reported indicators

• address0x3e91b4d0…8cbb42d7Ethereum
• urlhttps://claim.airdrop-portal.example/connect

Evidence references

Each item carries a confidence label describing how independently checkable it is.

• urlSupporting — Independently checkable material, such as an archived page or an on-chain transaction.Claim page URL
• transactionSupporting — Independently checkable material, such as an archived page or an on-chain transaction.0x41cb…9d02Ethereum

Uploaded files are never linked publicly. Material containing personal data is listed as withheld.

Related reports