How sybil detection works in airdrops
A sybil attack is one person running many wallets to collect an allocation several times over. Every large airdrop now filters for it, and the filters have become considerably more capable. This page explains what they look for and what happened to the wallets that were caught.
It is written to explain the mechanism, not to help anyone evade it. Teams that detect farming exclude the wallets entirely, so understanding this is mostly useful for avoiding a false positive on a wallet you use legitimately.
Why teams filter at all
An airdrop is meant to distribute ownership to users. If one operator runs a thousand addresses, they capture a thousand allocations and the distribution concentrates rather than spreads. That defeats the purpose and it damages the token's launch, because farmed allocations sell immediately.
What the filters look for
Detection rests on the fact that a blockchain records every transaction permanently, so patterns across addresses are visible to anyone who looks.
- Funding trees. Hundreds of wallets funded from the same source address is the clearest signal there is.
- Identical behaviour. Wallets performing the same actions in the same order for the same amounts were scripted.
- Timing clusters. Real people act at irregular times. Batches transacting within seconds of one another do not.
- Consolidation afterwards. Many addresses sending proceeds to one destination links them retroactively, even if the activity itself looked clean.
- Minimum viable activity. Wallets that did precisely enough to qualify and nothing else stand out against genuine use.
What happened to wallets that were caught
ParaSwap layered behavioural filters on top of its volume threshold and cut tens of thousands of addresses that qualified on paper, leaving roughly 20,000. The appeals that followed became a reference point for later teams.
Arbitrum disqualified wallets flagged during the Hop Protocol bounty programme outright, and automatically docked points from single day wallets holding little ETH.
Optimism excluded addresses it identified as farming across its later rounds after its first distribution drew criticism for how much went to them.
Avoiding a false positive
The advice for legitimate users is short, and it is the same advice as using protocols normally.
- Use one wallet for the activity you actually care about rather than spreading thin across several.
- Fund it from an exchange withdrawal or a source unconnected to your other addresses.
- Do not run the same sequence of actions across multiple addresses you own.
- Use the protocol for something, rather than performing the minimum that satisfies a checklist.
The pattern across every archived distribution is the same: sustained, varied, genuine usage survives filtering, and it also scores higher. See how to qualify for airdrops.
