New-Network Airdrop Claims: Fake RPC, Fake Bridge, and “Gas Refuel” Scam Checklist for 2026
More airdrops now land on a network you have never used: a new Ethereum layer 2, an app-specific chain, or a fresh testnet-turned-mainnet. Claiming them usually means three extra steps before the claim button even works. You add the network to your wallet, you find a bridge, and you move a little ETH over for gas. Each of those steps is a place where a fake website, a fake RPC endpoint, or a fake “gas refuel” service can slip in. This 2026 checklist explains what “Add network” actually hands to a website, how to verify chain details, how to get gas onto a new network without using a phishing bridge, and what to do if you already added something suspicious. It pairs with our claim-site phishing checklist and the fake gas token and approval drain checklist. Educational safety information only. It is not financial, legal, or investment advice, and there is no recovery guarantee.
What “Add network” actually does
When a website asks your wallet to add a network, it is using a standard request called wallet_addEthereumChain, defined in EIP-3085. The site suggests a handful of values and your wallet asks you to approve them:
- Chain ID. The number that decides which network your signatures are valid on. Arbitrum One, for example, is chain ID 42161, as listed in Arbitrum’s bridge quickstart.
- RPC URL. The server your wallet will ask for balances, gas prices, and transaction status, and the server that receives the transactions you send.
- Network name, currency symbol, icon, and block explorer URL. Mostly labels. They are easy to fake, and EIP-3085 itself warns that icons “could misrepresent the actual chain added.”
Two points matter for safety. First, adding a network does not move your funds or give anyone permission to spend them. The danger comes from what you trust and sign afterwards. Second, the RPC endpoint is not neutral. The EIP’s security section says endpoints “cannot be assumed to be honest, correct, or even pointing to the same chain,” and that your on-chain activity and IP address are exposed to whoever runs them. A malicious RPC can show you a fake balance, report a transaction as failed when it succeeded, or quietly log which addresses you use.
MetaMask is direct about the limits of its checks. Its guide to verifying custom network information says the wallet performs basic validation but “does not verify custom networks,” and that you should trust the details only as much as you trust the website that suggested them.
Verify the network before you approve it
Airdrop season is exactly when a cloned claim page can push an “Add network” prompt that looks routine. Before approving, check the values against sources that don’t come from the page asking:
- Start from the project’s own documentation. Reach the docs by typing the domain or using a bookmark you saved earlier, not a link from a reply, DM, or ad. Official docs list the chain ID, public RPC URLs, and the explorer.
- Cross-check the chain ID. MetaMask recommends searching Chainlist for the chain ID or name. Chainlist draws on the community ethereum-lists/chains registry. A network that is missing entirely is either very new or worth extra caution.
- Read the RPC domain. It should belong to the network team or a well-known infrastructure provider named in the docs. A random domain that resembles the project name is a reason to cancel.
- Watch for duplicates. EIP-3085 says a wallet must not allow the same chain ID to be added twice. If the network is already in your wallet and a site asks you to add it “again” with a different RPC, stop and edit the existing entry yourself instead.
- Check the explorer link. The block explorer URL is where your wallet sends you to “verify” transactions. A fake explorer can show fake confirmations.
If the details still don’t line up after those checks, reject the request. You can always add the network manually from your wallet’s settings later, using the values from the official docs.
Red flags during a new-network claim
- An add-network or bridge link arrives in a DM, a reply, or a sponsored search result. See our DM impersonation checklist and fake calendar and search phishing checklist.
- The chain ID doesn’t match the project’s docs or Chainlist.
- The RPC domain is unfamiliar or only loosely resembles the project name.
- A “gas refuel” or “gas faucet” site asks you to approve a token or sign a message before it sends you gas. Sending you gas never requires spending rights over your tokens.
- The bridge isn’t linked from the network’s official docs and isn’t a known service you have checked independently.
- Your balance suddenly looks far larger than expected on the new network, or a claim shows “success” that you can’t find on a trusted explorer. Fake RPC data is designed to make you act fast.
Getting gas onto a new network safely
You need a small amount of the network’s native token, usually ETH on Ethereum layer 2s, before you can claim. ethereum.org’s introduction to blockchain bridges explains why this step carries real risk. Every bridge carries smart contract risk. Trusted bridges add custodial and censorship risk, and many of the largest crypto hacks have involved bridges. Practical steps:
- Use the bridge the network itself links to. Arbitrum’s docs, for example, point to its own bridge at bridge.arbitrum.io and explain each step. If you use a third-party bridge, check it on L2BEAT, which ethereum.org lists as a bridge risk resource.
- Consider a direct exchange withdrawal. Arbitrum’s quickstart notes that most major centralized exchanges support withdrawals directly to the Arbitrum network. Double-check the selected network on the withdrawal screen, as covered in our guide to withdrawing crypto to your wallet safely.
- Send a small test amount first and confirm it arrived on a trusted explorer before sending more.
- Move only what the claim needs. Your claim wallet should hold gas, not savings. Keep a separate vault wallet that never connects to claim pages.
- Know the exit timing. Withdrawals back to Ethereum through an optimistic rollup’s official bridge are slow by design. Arbitrum’s docs describe at least seven days for Arbitrum One and Nova. Anyone offering to “speed up” a pending withdrawal for a fee or a signature is running a scam.
Wrong-network mistakes
EVM networks share the same address format, so your address looks identical on Ethereum, Arbitrum, Base, and dozens of other chains. That makes two mistakes common during claim season. The first is sending tokens to the right address on the wrong network. If the destination is a wallet whose seed phrase you control, you can often reach the funds by adding the correct network. If it is an exchange deposit address or a smart contract that doesn’t support that network, recovery may depend on the exchange or may not be possible at all. The second is signing on a network you didn’t mean to use, because a site switched it for you. Read the network name in every confirmation, not just the amount.
If you already added a bad network or used a suspicious bridge
- Remove the network from your wallet settings, or edit it back to the RPC listed in the official docs. Then recheck your real balances on a trusted explorer.
- Revoke approvals you signed on the suspicious site or bridge. Use ethereum.org’s guide on revoking smart contract access, and check each network separately.
- If you typed your seed phrase or private key anywhere, assume the wallet is lost. Move what you can to a brand-new wallet with a new seed phrase.
- Document and report. Save transaction hashes, addresses, and the site URL. Report to the FBI’s IC3 cryptocurrency page or ReportFraud.ftc.gov in the U.S., or your national cybercrime service elsewhere.
- Ignore recovery offers. The FTC’s cryptocurrency scams guidance warns that crypto payments usually can’t be reversed. Paid “recovery services” are a known follow-up scam.
Safety checklist (YMYL)
- Get chain ID, RPC, and explorer from the network’s official docs, reached from a bookmark.
- Cross-check the chain ID on Chainlist before approving an add-network prompt.
- Never approve tokens or sign messages to receive “free gas.”
- Bridge only through the network’s linked bridge or one you have checked on L2BEAT, and test with a small amount.
- Keep claim wallets funded with gas only, separate from your vault.
- Read the network name in every confirmation.
- After a mistake: remove the network, revoke approvals, move funds if a key was exposed, then report.
Key takeaways
- Adding a network doesn’t spend your funds, but it decides whose data your wallet trusts and where your signatures go.
- Wallets don’t verify custom networks for you, so the chain ID and RPC need a second source.
- Bridges are a real risk. Use the official route and move only what a claim needs.
- Fake “gas refuel” and “speed up withdrawal” offers are drainers wearing a helpful disguise.
Sources and further reading
- EIP-3085: wallet_addEthereumChain RPC Method
- MetaMask Help Center: How to verify custom network information
- ethereum.org: Introduction to blockchain bridges
- Arbitrum docs: Arbitrum bridge quickstart
- L2BEAT: bridges and interoperability summary
- FTC: What To Know About Cryptocurrency and Scams
Related CoinDrop guides: EIP-7702 “upgrade your wallet” scams, address poisoning after claims, and cryptocurrency airdrop safety considerations.
Not financial, legal, or investment advice. This article is general educational information about a common crypto risk. Network details, bridge routes, and withdrawal times change with upgrades; confirm current values in each network’s official documentation. CoinDrop does not endorse any network, bridge, exchange, or recovery service and cannot recover funds. Last verified 2026-10-08.