I claimed a 'free airdrop' and lost everything — how do these work?

Fake airdrop scams typically run this pipeline:

1. Compromised or impersonator Twitter/X account posts an 'airdrop' link.
2. Site is a near-perfect clone of a real protocol's UI — usually on a typo-squatted or punycode domain.
3. 'Claim' button triggers a signature request that's actually a setApprovalForAll, Permit2, or Seaport listing for 0 ETH.
4. Backend bot sweeps assets the moment the signature lands on-chain.

Your current priority is the same as any wallet-drain incident: revoke approvals on the compromised address, move anything left to a brand-new wallet generated on a clean device, and pull the drain transaction hash for tracing. Practical prevention guides are published by Safewire and the wallet vendors themselves — bookmark them, not the random sites that pretend to be airdrop checkers.