Fake Arbitrum Airdrop Phishing: Clone Sites Induce Wallet Connection to Steal Private Keys

Who Gets Targeted

The primary victims are Web3 users who hold or have interacted with Arbitrum ecosystem assets, especially retail traders chasing airdrop yields and frequently connecting their wallets to participate in so-called "official events." These users are often driven by a sense of urgency and greed triggered by phrases like "Claim free tokens," "Limited-time airdrop," and "Official subsidies," while lacking a sufficient understanding of security mechanisms such as wallet authorizations and private key signatures. Some victims habitually click links directly on social platforms without verifying the domain, and are prone to lowering their guard upon seeing forged official accounts or fake "received successfully" screenshots left by bots in the comment section, ultimately connecting their wallets or entering seed phrases on phishing pages, leading to asset transfer.

骗局怎么运作

• Attackers first compromise or impersonate an official Arbitrum social media account—such as the previously reported incident where the official Arbitrum X account was hacked—and then use that account to publish "airdrop announcements" or "token claim" tweets containing phishing links, disguising them as official events to attract user clicks.
• When users click the link in the tweet, they are directed to a clone site visually nearly identical to the official Arbitrum website, typically using spelling-variant or free hosting domains such as arbitrumfoundationdex.vercel.app, arbitrum-airdrop.github.io, or app.arbtirum.info. The page displays fake airdrop amounts and claim progress to create a sense of authenticity.
• The page prompts users to click the "Connect Wallet" button, which actually requests signature authorization via MetaMask or WalletConnect. Some phishing sites demand that users directly input their seed phrase or private key, claiming it is for "eligibility verification" or "airdrop synchronization"; this step directly steals wallet control.
• Once a user completes the authorization or inputs their seed phrase, attackers immediately transfer assets from the wallet—including ETH, ARB, and other transferable tokens—via malicious smart contracts or scripts. Some phishing contracts also continuously monitor the wallet in the background, waiting for subsequent deposits before automatically sweeping them away.
• After the assets are drained, attackers rapidly launder the funds through cross-chain bridges or mixers and switch to new phishing domains to launch attacks on other users, greatly increasing the difficulty of tracking and freezing.

红旗信号（看到这些快跑）

• 🚩 The link domain does not match the official arbitrum.io; common counterfeit domains include spelling errors or third-party hosting domains such as arbitrumfoundationdex.vercel.app, arbitrum-airdrop.github.io, and app.arbtirum.info.
• 🚩 Users are asked to input seed phrases, private keys, or grant unlimited approvals. Official airdrops do not request seed phrases or private keys, and formal token claims typically only involve on-chain contract calls or signatures.
• 🚩 Event information appears exclusively on compromised or newly registered social media accounts without official synchronization or clarification, and the tweet's comment section is closed or flooded with "successfully received" bait comments.
• 🚩 The airdrop amount is excessively high or the rules are overly simplistic, claiming that all users can receive large amounts of ARB tokens without any on-chain activity history or eligibility verification.
• 🚩 Abnormal website certificates or overly simplistic page functionality: aside from connecting the wallet, there is no real project data or governance portal, and clicking other menus yields no response or redirects to irrelevant pages.

真实案例

• The official Arbitrum X account was previously hacked and used to publish impersonation airdrop phishing tweets with fake claim links, inducing users to connect their wallets and causing asset losses. CoinRound and Baiyi Finance reported on this background, noting network phishing losses exceeding 4.5 trillion KRW.
• Security scanning platform PhishDestroy recorded multiple domains—such as arbitrumfoundationdex.vercel.app, arbitrum-airdrop.github.io, and app.arbtirum.info—identified as phishing pages targeting Arbitrum users, involving risks of wallet connection and private key theft.
• TokenPost reported that after the Arbitrum official X account hack, hacker impersonation airdrop phishing scams resurfaced, sparking community-wide focus on official social media account security and fake airdrop links.
• In March 2026, a programmer in Hangzhou received unsolicited ARB airdrop tokens and transferred them to an exchange to trade; shortly after, multiple assets in their wallet were wiped out, totaling over 120,000 RMB in losses. SlowMist Technology's security report listed this as a typical case of fake airdrop phishing signatures, and official Arbitrum alerts warned users to be vigilant against counterfeit airdrop links. (Source: [https://kj17.com/web3/270652.html](https://kj17.com/web3/270652.html))
• In January 2026, security firm CertiK confirmed cryptocurrency hacker attack losses of approximately $370.3 million, with phishing attacks accounting for $311.3 million of that total. Baiyi Finance cited this data when reporting on the breach of the official Arbitrum community account, pointing out that phishing links following compromised social media accounts have become a primary entry point for attacks. (Source: [https://www.baiyi.com/news/6e4facc68a9d42ce9189601a33e16b0f.html](https://www.baiyi.com/news/6e4facc68a9d42ce9189601a33e16b0f.html))

Official Stance

• Arbitrum officials and the security community have repeatedly reminded users to participate in events exclusively via the official arbitrum.io domain and to avoid clicking unverified airdrop links, with specific dates subject to official X announcements.
• Security inspection platforms like PhishDestroy continue to flag domains such as arbitrumfoundationdex.vercel.app and arbitrum-airdrop.github.io as phishing sites, advising users to refrain from connecting wallets or entering any sensitive information.
• Members of the Arbitrum Safety Committee disclosed in an Odaily interview that authorization freezing had been deployed to lock funds belonging to North Korean hackers, demonstrating the ecosystem's governance stance against phishing and asset theft. Related initiatives and warnings continue to be communicated within the ecosystem.

How to Protect Yourself

• ✅ Participate in events exclusively through the official Arbitrum website arbitrum.io or links published in official documentation; do not click unfamiliar links found in social media direct messages, tweets, or comment sections.
• ✅ Verify whether the URL uses https and the domain matches perfectly before connecting your wallet; universally refuse connections to free hosting domains such as vercel.app, github.io, and pages.dev.
• ✅ Never input seed phrases or private keys on any webpage, and immediately close any page that asks you to import a wallet, verify verification phrases, or grant unlimited approvals.
• ✅ Use a hardware wallet or isolated wallet to participate in airdrop interactions, separating long-term assets from wallets used for airdrop activities to minimize single-authorization risks.
• ✅ Regularly check and revoke unfamiliar contract authorizations in your wallet using tools like revoke.cash to clean up unneeded token allowances.