Airdrop Scams in Practice: An Industry-Oriented Taxonomy, Benchmark, and Tool Audit

Abstract

Decentralized finance (DeFi) scams related to airdrops have become a practical security problem for wallet providers, exchanges, and Web3 security teams. Evidence of these scams spans promotional posts, websites, wallet prompts, transactions, token contracts, and incident reports, which makes them difficult to organize systematically and evaluate with automated defenses. In this paper, we review 43 academic sources and 31 industry/grey sources and propose a three-layer framework to characterize the airdrop process. Based on our systematic review, we construct a hierarchical taxonomy of 34 distinct airdrop scam types, including six newly identified categories. We also identify nine academic datasets and seven reliable industry data resources, normalize an integrated corpus with 7,518 malicious addresses, 479,205 website links, and 18,432 real-world scam incidents, and derive a benchmark of 116 airdrop scam cases for automated tool evaluation. We then conduct a behavioral audit of the 12 academic and industry tools identified as accessible by January 2025. Our results show that 16 of 17 academic tools could not be executed through their documented workflows. Among the accessible industry tools, the audit revealed gaps between documented capabilities and observed behavior. The evaluated tools performed better on supported contract and transaction artifacts than on supported promotion- and interaction-layer inputs. These findings lead to practical lessons for preserving workflow evidence, maintaining source provenance during dataset integration, and auditing tools as executable systems rather than feature lists.