airdrop-checker-l2.io added to Scam Sniffer drainer blocklist
Scam Sniffer added airdrop-checker-l2.io to its blocklist as a wallet drainer on October 13, 2026. Airdrop "eligibility checkers" hide malicious approvals inside a normal-looking claim flow.
- First reported
- Reports
- 1
Source: davefinances.com · published
What happened
Dave Finances reported that Scam Sniffer identified airdrop-checker-l2.io as a wallet drainer, about an hour before its scan of October 13, 2026 additions. It was one of five indicators added within roughly an hour.
How the scam works
Airdrop pages are useful to attackers because the normal process already involves connecting a wallet, checking eligibility and possibly signing something. The malicious step can hide inside behaviour that looks routine for a token distribution.
Dave Finances says the transaction matters more than the marketing language: a "check eligibility" button tells you nothing about what the wallet prompt actually authorises, whether that is a simple connection, an approval, a permit or a direct transfer.
For context, Scam Sniffer's 2025 report tracked about $83.85 million stolen from 106,106 victims through wallet-drainer phishing on EVM-compatible chains, down 83% from 2024, showing the threat persists even as totals fall.
No independently verified losses have yet been publicly tied to this specific domain.
Source
Dave Finances, "Scam Sniffer adds 5 fresh crypto drainer and seed-phishing indicators after midnight" (October 13, 2026). The article notes there is no public evidence the five indicators belong to the same operator, and no verified losses have yet been tied to them.
Red flags
- Airdrop "checker" sites you reached from replies, ads or direct messages rather than the project's official channels.
- Being asked to sign or approve something just to see whether you are eligible.
- Generic domain names ("airdrop-checker", "l2") not tied to any project you know.
If you were targeted
- 1Do not connect a wallet to, or sign anything on, the listed site.
- 2If you already approved a transaction there, revoke token approvals using a reputable approval-checker for your wallet's network, and move remaining funds to a new wallet if you are unsure what you signed.
- 3If you entered a recovery phrase anywhere, treat that wallet as compromised: create a new wallet with a new phrase and move any remaining assets.
- 4Report the site to your wallet provider and to the FBI at ic3.gov (or your national cybercrime agency).