Crypto airdrops: how they work, how to avoid drainers and how they are taxed in Poland

How an airdrop works[1]

An airdrop is tokens a project sends to wallet addresses. According to MetaMask it is most often a reward for using a dapp or a network, sometimes simply a promotion for a new project. The value of such tokens is never guaranteed and is often negligible.

For a memecoin trader there are two kinds of airdrop. The first is a distribution the project announces officially, usually with a claim on its own site. The second is tokens that simply turn up in your wallet with no announcement. In practice that second case is most often bait, as described below.

An unknown token in your wallet: leave it alone[6][4][1]

Blockchains are open, so anyone can send a token or NFT to your address without your permission. Phantom stresses that receiving such an asset does not mean your wallet is compromised. Unknown assets are usually spam, and you should not open their links or follow their instructions.

The scam starts with the token looking valuable. According to ethereum.org, scammers send large balances of a fake token to addresses likely to hold the real one, and the balance and transfer history prove nothing because the contract's creator sets them. MetaMask also describes a variant where an error message on a transaction page in the explorer points to a fake site.

In Phantom you can report such a token as spam: reporting hides it and helps improve spam detection. Do not try to sell or swap it through a site named in its description.

• Do not open links from the token's name, description or metadata
• Do not connect your wallet to a site the token points to
• Hide or report the token as spam in your wallet
• The ticker and name prove nothing; the contract address does

Fake claim sites[3][4][1]

The typical scheme: a token lands in your wallet and its description points to a site where you must claim it. According to ethereum.org, such a site asks you to connect your wallet and approve a transaction that in fact hands the scammer access to your account or sends them your funds.

Fake sites can be near-identical copies of real ones. Ethereum.org warns that a link preview on X can show a familiar name and lead somewhere else. Check the domain after every click and open known services from bookmarks.

The simplest rule: no genuine service, support agent or website will ever ask for your seed phrase or private key. Whoever has them can drain every account.

Approval drainers: permission to spend your tokens[3][5]

On EVM networks such as Ethereum, Base or BNB Chain, a contract can move your tokens only after you give it an approve, a spending limit. A drainer is a site that asks for such an approve under the pretext of a claim and then pulls the tokens out.

Ethereum.org advises against giving contracts an unlimited limit, because an unlimited approve could let the contract drain your wallet. Set the limit to just the amount the transaction needs.

Old approvals can be revoked. A tool named by ethereum.org, such as Revoke.cash or Etherscan's token approval checker, shows active approvals and lets you cancel them. A revoke is an ordinary transaction, so you pay gas for it. Revoking does not close a staking or pool position.

• Read what a transaction asks for before you sign it
• Approve only the amount needed, never unlimited
• Review active approvals now and then and revoke the ones you no longer need
• Your wallet and the revoke tool must be on the same network

Signature phishing and Permit2[2]

Not every theft needs a transaction. MetaMask describes signature phishing: a fake dapp asks you to sign an off-chain message and the scammer uses the signature later. Such a signature is never broadcast to the network, so the site can use it whenever it chooses, and what you are signing is hard to read.

One example is Permit2, Uniswap's approval contract that combines approval and the action in one step based on an off-chain signature. According to MetaMask, the risk is that the signature is not recorded on-chain, which makes it harder to trace, and it can stay valid for a set period. Theft can therefore happen weeks later.

If you signed something risky, MetaMask advises revoking the approval quickly, for example through revoke.cash, or moving the tokens at risk to another account, since Permit2 approvals apply only to the account that signed.

How to check whether an airdrop is real[4][1]

Start from the project's announcement in its official channel, not from a token that appeared in your wallet. Compare the claim site's address and the token's contract address with what the issuer's official site gives. According to ethereum.org, a fake token can copy the name and symbol but cannot use the same contract address.

MetaMask suggests three questions: does the token show up with token detection on, does an explorer such as Etherscan or BscScan flag it as a scam, and does the project have a website, an active community and consistent channels. Ethereum.org adds that an Etherscan flag helps but is not an authoritative source. If in doubt, do not take the risk.

• An announcement in the project's official channel
• A claim site domain that matches the official one
• A contract address that matches the one the issuer gives
• No request for the seed phrase or an unlimited approve
• A separate wallet with a small balance for claims

Airdrops and tax: what the rules and rulings say[7][8][9][10]

On podatki.gov.pl the Polish Ministry of Finance describes the tax on the paid disposal of crypto: exchanging it for money, goods, services or property rights other than virtual currency, and settling obligations with it. A crypto-to-crypto exchange is not taxed, the rate is 19%, and PIT-38 is filed between 15 February and 30 April of the year after the tax year. The page does not mention airdrops at all.

The authorities' position comes from individual tax rulings. In a ruling of 10 June 2025 (0113-KDIPT2-3.4011.186.2025.4.JŚ), the Director of National Tax Information held that revenue from property rights arises as soon as virtual currency is received in an airdrop, under art. 18 read with art. 11(1) of the PIT Act, at its value set by market prices. A ruling of 13 June 2025 (0112-KDIL2-2.4011.234.2025.3.AA) took the same line.

In a ruling of 10 October 2025 (0115-KDIT1.4011.558.2025.2.MK), the authority added that the value of the airdrop revenue is at the same time the acquisition cost of that virtual currency under art. 22(1d). On a later sale for zloty, the same amount is therefore not taxed twice. The value there was converted into zloty at the NBP average rate from the last business day before the day the revenue arose.

Applicants cite rulings of the voivodeship administrative courts under which revenue arises only on a paid disposal. On that view there is no tax on receipt, but the airdrop has no acquisition cost either, so the whole amount from a sale for money is revenue in PIT-38. Our PIT-38 guide covers the Poznań court ruling on this point.

• The authorities' 2025 position: revenue on receipt, at market value
• That value is then the acquisition cost on a sale (ruling of 10 October 2025)
• The position in administrative court rulings: revenue only on disposal, with a zero acquisition cost
• Swapping an airdrop for other crypto is, per the ministry, not a paid disposal
• A ruling protects only the taxpayer who applied for it

What to record for every airdrop[10][7]

Whichever position you take, you need data from the day of receipt and the day of sale. The October 2025 ruling shows how the authority sets the value: the token's price on the day it reached the wallet, converted into zloty at the NBP average rate. Record it straight away, because a fresh token's price is hard to reconstruct later.

• Date and time the tokens arrived, and the transaction hash
• The token's contract address and network
• The number of tokens and their price on the day of receipt, with the price source
• The NBP average rate from the last business day before that day
• Date, amount and hash of the sale or swap