tokendisbursement.xyz flagged as Red Kitten Crew airdrop drain
MalwareTips warns that a "Red Kitten Crew" (RKC) airdrop page at tokendisbursement.xyz is a wallet-draining lure, not a real token distribution.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reported on October 14, 2026 on a Red Kitten Crew (RKC) airdrop scam promoting a supposed token distribution associated with the Solana ecosystem. A reported claim page used tokendisbursement.xyz.
MalwareTips describes the campaign as a wallet-draining lure that pairs a free-token promise with wallet-selection controls, rather than an authenticated distribution. It notes that recognising a token name or ticker does not show that a claim portal is authorised.
How the scam works
The page offers free RKC tokens and asks visitors to "check eligibility". Checking sounds harmless, but it is the reason to open the wallet, and the site then chooses what to request next: a transaction approval, delegated permission, signature, or even a recovery phrase.
Familiar wallet logos make the page look supported, but they only show compatibility, not endorsement. Deadlines and community language (holders, eligibility, distributions) push people to act before checking who runs the offer. MalwareTips warns against asking people in the page's own chat to vouch for it, since they may be part of the same operation.
MalwareTips stresses that disconnecting an app and revoking spending permission are different actions.
Source
MalwareTips, "Red Kitten Crew (RKC) Airdrop Scam" (October 14, 2026).
Red flags
- An unexpected airdrop you never signed up for.
- A generic domain (tokendisbursement.xyz) that is not the project's own site.
- Wallet prompts for transfers or approvals that have nothing to do with receiving tokens.
- Any request to enter a recovery phrase.
If you were targeted
- 1Do not connect a wallet to, or sign anything on, the listed site.
- 2If you already approved a transaction there, revoke token approvals using a reputable approval-checker for your wallet's network, and move remaining funds to a new wallet if you are unsure what you signed.
- 3If you entered a recovery phrase anywhere, treat that wallet as compromised: create a new wallet with a new phrase and move any remaining assets.
- 4Report the site to your wallet provider and to the FBI at ic3.gov (or your national cybercrime agency).