How Do Airdrops Detect Sybil Wallets: On-Chain Detection Methods

The Question Farmers Ask

How do airdrops detect sybil wallets? The question matters because the answer determines whether a multi-wallet farming operation nets 50x the allocation or gets fully disqualified with months of gas costs wiped.

Projects including LayerZero, Arbitrum, and Hop Protocol have disqualified hundreds of thousands of addresses. LayerZero alone flagged 803,093 wallets in June 2024, representing 38% of the initial snapshot. Arbitrum filtered 625,000 addresses from a 2.3 million wallet pool. Hop Protocol identified 10,253 sybil addresses out of 43,058 eligible wallets.

The detection methods are not speculative. They are reverse-engineered from publicly released disqualification data, GitHub repositories, and analytics vendor case studies.

What Projects Actually Detect

Sybil detection operates on four primary signals visible in on-chain transaction data.

First: funding graphs. On-chain analytics tools trace the origin of gas funds for every wallet. If 50 wallets were all funded from a single centralized exchange withdrawal or a single seed wallet within 30 days, they form a detectable cluster in the transaction graph. Projects filter entire clusters regardless of individual wallet behavior downstream.

Second: transaction sequence matching. Wallets that interact with the same protocols in the same order, especially within tight time windows, trigger algorithmic flags. If 100 wallets bridge $500 USDC to Arbitrum, swap for ETH on Uniswap, deposit into GMX, and mint an NFT on the same day, the sequence similarity score exceeds thresholds used by clustering algorithms.

Third: temporal clustering. Sybil clusters show transaction timing patterns inconsistent with organic behavior. Wallets transacting within seconds of each other, batch claim transactions, or identical daily activity windows get flagged. Arbitrum deducted points if all transactions occurred within a 48-hour window.

Fourth: cross-chain behavioral fingerprints. A sophisticated operator might separate wallets on Ethereum mainnet but reuse the same interaction patterns on Avalanche or Polygon. Analytics vendors trace these patterns across chains. One Hop Protocol cluster was identified because the operator overlapped a few transactions both on Ethereum mainnet and Avalanche, connecting otherwise isolated address sets.

How LayerZero Filtered 803,000 Addresses

LayerZero’s June 2024 ZRO airdrop provides the most detailed public case study of sybil detection methodology.

The initial eligible snapshot included approximately 2.1 million wallets. The final count of flagged addresses reached 2.05 million when including self-reported sybils, with 803,093 ultimately excluded as confirmed sybil clusters.

Detection combined internal analysis with a public bounty program. Bounty hunters built a graph of all addresses that had used LayerZero, identified all gas funding sources, then walked up the funding tree to find hub addresses that had funded many downstream wallets. Wallets that shared a funding hub within two hops and had interaction sequence similarity above a threshold were submitted as clusters.

CEO Bryan Pellegrino posted publicly that LayerZero was working with Nansen on clustering analysis. Nansen’s MEDIA algorithm combines machine learning clustering with on-chain identity signals aggregated into a TrustScore metric.

LayerZero also opened a self-reporting window. Wallets could declare themselves as sybil and receive 15% of their eligible allocation instead of 0%. Approximately 1.3 million wallets self-reported and received the reduced allocation. The mechanism reduced enforcement costs while recovering allocation that would otherwise go to disqualified addresses.

The interesting variable is that timing mattered more than transaction value. Operators who funded wallets from the same source within 30 days, even if those wallets later transacted through different bridges with varying amounts, were clustered and flagged.

Arbitrum’s Louvain Clustering and IP Correlation

Arbitrum’s March 2023 ARB airdrop used community detection algorithms to partition the transaction graph into densely connected subgraphs.

Out of approximately 2.3 million wallets that had bridged to Arbitrum One before February 6, 2023, only 625,143 wallets scored more than 3 cumulative points and qualified for the airdrop. The filtering rate approached 28% of the initial set.

Arbitrum applied the Louvain method, a modularity optimization algorithm that partitions graphs into communities with high internal edge density and low external edge cuts. Large and medium-sized sybil groups were identified and removed from the airdrop list using this method.

The Arbitrum Foundation also applied specific heuristics. If all transactions of an address occurred within 48 hours, 1 point was deducted. If the wallet balance was less than 0.005 ETH and the wallet had not interacted with more than one smart contract, 1 point was deducted. If the wallet address was identified as a sybil during the Hop Protocol bounty program, the address was fully disqualified.

Projects also correlate wallet addresses with IP addresses logged by dApp frontends, centralized bridges, and RPC providers. If 200 wallets connected from the same IP or the same /24 subnet, they cluster as one operator. Arbitrum used this method to filter addresses despite those addresses having no direct on-chain linkage.

Data scientists excluded hot addresses such as centralized exchange wallets and cross-chain bridges to reduce false positives. They also avoided flagging small groups of addresses with fewer than 20 externally owned accounts when running the detection algorithm.

Hop Protocol: Sequential Transfer Chains and Radial Funding

Hop Protocol distributed 8% of its supply to early users, each required to have at least $1,000 in transfers and two on-chain interactions. Of 43,058 initially eligible wallets, the team identified 10,253 as sybil addresses, a 24% disqualification rate.

Within each cluster, sequential transfer chains and radial, star-shaped funding patterns were extracted to peel away bot networks from genuine users. Sequential transfer chains, also called daisy chains, occur when tokens hop from one sybil account to the next in a chain, leaving a clear domino effect of funds traceable back to a single source.

Radial funding patterns show a hub address distributing gas or tokens to many spoke addresses in a star topology. Both patterns are detectable through graph traversal algorithms applied to the transaction history.

Hop Protocol reports were generated primarily using scripts that scraped Ethereum and Avalanche mainnet across all eligible addresses. Scripts searched for multiple eligible addresses clustered around each other by tracing shared on-chain transfer history. The detection code is available in the Hop Protocol GitHub repository, providing a rare public view of detection logic.

Detection Algorithm Types Projects Use

Projects deploy several categories of clustering algorithms depending on data structure and cluster density.

The Louvain method, used by Arbitrum, optimizes for modularity in large graphs. It iteratively groups nodes into communities that maximize internal connections relative to external ones. The method is fast enough to run on multi-million node graphs.

DBSCAN and OPTICS are density-based clustering methods used by Hop Protocol and other projects. These algorithms identify clusters as regions of high point density separated by regions of low density. They do not require predefining the number of clusters and can identify noise points that do not belong to any cluster.

TrustLabs and Nansen use hybrid approaches combining graph partitioning with temporal feature extraction. The method constructs a two-layer deep transaction subgraph for each address, then extracts key event operation features according to the lifecycle of sybil addresses, including the time of first transaction, first gas acquisition, participation in airdrop activities, and last transaction. These temporal features capture the consistency of sybil address behavior operations.

One thing worth noting: these algorithms are not binary classifiers. They assign cluster membership probabilities or anomaly scores. Projects set thresholds based on acceptable false positive rates, and those thresholds vary.

What Gets Missed and What Gets Caught

Detection coverage is uneven. Projects have publicly acknowledged gaps in their filtering logic.

Rules failed to stop sybils with fewer than 20 addresses. Small-scale farming operations often pass undetected because detection algorithms avoid flagging small clusters to reduce false positives. A farmer running 10 wallets with good operational security has a materially different risk profile than one running 500.

Sybils that make deposits and withdrawals using cross-chain bridges, exchanges, and smart contracts as intermediaries can break direct funding graph linkages. If an operator funds Wallet A from a centralized exchange, transfers tokens from Wallet A to a DeFi protocol, then withdraws from that protocol to Wallet B, the on-chain funding graph shows the protocol as the intermediate source, not Wallet A.

Operators with NFT holdings or fund collection activities after the snapshot introduce behavioral noise that reduces sequence similarity scores. Projects typically snapshot eligibility at a point in time but analyze behavioral patterns over a longer historical window. Post-snapshot diversification does not erase pre-snapshot clustering.

What consistently gets caught: wallets with detectable batch operation behavior on different chains. Even if wallets are not directly linked on-chain, addresses that exhibit the same behaviors across multiple chains trigger cross-chain fingerprinting. This pattern held across LayerZero, Arbitrum, and Hop disqualifications.

The False Positive Problem

Aggressive filtering creates collateral damage. Projects balance enforcement against user trust.

Arbitrum’s data scientists excluded hot addresses such as centralized exchange wallets and cross-chain bridges and avoided flagging small groups with fewer than 20 addresses. These steps reduced false positives but also reduced detection coverage.

Shared funding sources are common in legitimate use cases. A user might fund multiple wallets from the same centralized exchange account for security compartmentalization, testing, or privacy. A family might share a single exchange account. A trader might operate separate wallets for different strategies, all funded from the same source.

Projects mitigate this risk by requiring multiple correlated signals, not just shared funding. Arbitrum required a combination of funding linkage, community detection cluster membership, and behavioral heuristics before disqualifying an address. Hop Protocol required both funding graph proximity and interaction sequence similarity.

The cost of false positives is reputational. The cost of false negatives is diluted allocation to legitimate users. Projects optimize for precision over recall, meaning they prefer to miss some sybils rather than incorrectly flag legitimate users.

Quantitative Comparison Across Projects

Four major airdrops from 2023-2024 provide comparable disqualification data.

LayerZero started with approximately 2.1 million wallets, disqualified 803,000, and filtered 38% of addresses. Primary methods included funding graph analysis, sequence matching, and a self-report mechanism at 15% allocation.

Arbitrum started with approximately 2.3 million wallets, qualified 625,000, and filtered roughly 28% of the initial set. Primary methods included Louvain clustering and IP correlation alongside behavioral heuristics.

Hop Protocol started with 43,000 wallets, disqualified 10,300, and filtered 24% of addresses. Primary methods included DBSCAN clustering and transfer pattern analysis via graph traversal scripts.

zkSync Era disqualified 60% of eligible addresses, the highest filtering rate among major airdrops. Methodology details were not publicly disclosed, but the rate suggests aggressive detection thresholds or a higher baseline sybil density in the initial set.

The data shows that disqualification rates range from 24% to 60% depending on protocol, detection methodology, and baseline sybil prevalence. Multi-wallet strategies face material disqualification risk when funding and behavior are not properly compartmentalized.

Projects rarely build detection infrastructure internally. They contract with on-chain analytics vendors.

Nansen served LayerZero, zkSync Era, Starknet, Blast, and dozens more. Their MEDIA algorithm combines machine learning clustering with on-chain identity signals aggregated into a TrustScore. The TrustScore incorporates wallet age, transaction diversity, protocol interactions, and token holdings into a composite metric.

According to Nansen’s published research, their distribution model for Arbitrum used community detection algorithms to partition the address graph and identify sybil clusters. The model was calibrated to balance allocation fairness against enforcement cost.

TrustLabs provides sybil detection services with a focus on asset transfer graph analysis. Their method partitions graphs into connected components, then applies community detection algorithms to break down large components into densely connected subcommunities with few edge cuts.

These vendors charge per-address analysis fees or fixed engagement costs. For a 2 million wallet airdrop, detection costs can exceed $100,000 depending on analysis depth and iteration rounds.

What To Watch If You Are Farming

The detection landscape is not static. Vendor algorithms improve with each airdrop cycle as they ingest more labeled training data from past disqualifications.

Funding graph linkage within 30 days remains the highest-signal indicator. If you fund multiple wallets from the same centralized exchange account, withdrawal address, or on-chain source within a month, those wallets are clusterable regardless of downstream behavior.

Transaction timing consistency is the second-highest signal. If you interact with protocols at the same time each day, in the same sequence, across multiple wallets, temporal clustering algorithms will flag the pattern.

Cross-chain behavioral fingerprints are increasingly detectable. Vendors now trace interaction patterns across Ethereum, Arbitrum, Optimism, Polygon, Avalanche, and other chains. A wallet that looks isolated on one chain but replicates behavior from another chain gets flagged.

IP correlation is table stakes. If you connect multiple wallets to the same dApp frontend, RPC endpoint, or bridge interface from the same IP or subnet, projects log and cluster those addresses. The correlation happens off-chain but informs on-chain disqualification.

The income mechanism here is direct. Airdrop farming costs gas, time, and often protocol fees. A single-wallet farmer might net $500 to $3,000 per airdrop depending on allocation tiers. A 10-wallet operation could theoretically 10x that, but only if those wallets pass detection. If the cluster gets flagged, all wallets are disqualified and months of gas costs are wiped. The difference between passing and failing detection is often the difference between profit and total loss.

When Detection Does Not Matter

Not all airdrops deploy sophisticated detection. Smaller projects with limited budgets or technical resources often use simpler snapshot-and-distribute models with minimal filtering.

Projects that gate eligibility by NFT ownership, token holdings, or on-chain attestations reduce the sybil incentive. If eligibility requires holding a $5,000 NFT, the capital requirement exceeds the expected airdrop value for most farmers.

Airdrops with points-based systems that reward long-term, diverse activity over raw transaction count also reduce sybil prevalence. If allocation scales with unique protocol interactions, transaction diversity, and wallet age rather than volume alone, the farming ROI drops and detection becomes less critical.

The pattern historically is that high-value airdrops (allocations exceeding $1,000 per wallet) deploy vendor-grade detection. Low-value airdrops (allocations under $200 per wallet) often do not. The detection investment scales with the value at stake.

The Takeaway

Sybil detection in airdrops operates on four primary signals: funding graph linkage, transaction sequence similarity, temporal clustering, and cross-chain behavioral fingerprints. Projects including LayerZero, Arbitrum, and Hop Protocol have disqualified between 24% and 60% of initial eligible addresses using these methods. Detection algorithms are not speculative. They are reverse-engineered from publicly released disqualification data and vendor case studies. Funding graph linkage within 30 days remains the highest-signal indicator. Transaction timing consistency is the second. Multi-wallet farming operations face material disqualification risk when funding and behavior are not properly compartmentalized, and the difference between passing and failing detection is often the difference between profit and total loss.

Frequently Asked Questions

What percentage of airdrop wallets typically get disqualified for sybil behavior?

Disqualification rates range from 24% to 60% depending on the project and detection methodology. LayerZero disqualified 38% of wallets (803,000 out of 2.1 million), Arbitrum filtered approximately 28% of addresses, Hop Protocol flagged 24% of eligible wallets, and zkSync Era disqualified 60% of addresses. The rate depends on baseline sybil prevalence, detection algorithm sensitivity, and enforcement thresholds set by each project.

Can airdrops detect sybil wallets if they are funded from different exchanges?

Funding from different exchanges reduces but does not eliminate detection risk. Projects analyze multiple signals beyond funding sources, including transaction sequence similarity, temporal clustering, and cross-chain behavioral fingerprints. If wallets interact with the same protocols in the same order within similar time windows, clustering algorithms flag the pattern regardless of funding diversity. The most sophisticated operators are caught via behavioral consistency, not just funding graph analysis.

Do small-scale multi-wallet farmers get detected less often than large operations?

Yes. Detection algorithms often exclude clusters with fewer than 20 addresses to reduce false positives. Arbitrum’s data scientists avoided flagging small groups during their 2023 airdrop. Projects optimize for precision over recall, meaning they prefer to miss some sybils rather than incorrectly disqualify legitimate users. A 10-wallet operation has materially lower detection risk than a 500-wallet operation, especially if wallets maintain distinct funding sources and interaction patterns.

What is the self-reporting mechanism some airdrops offer for sybil wallets?

LayerZero pioneered a self-reporting window where sybil wallets could declare themselves and receive 15% of their eligible allocation instead of 0%. Approximately 1.3 million wallets self-reported during the June 2024 ZRO airdrop. The mechanism reduces project enforcement costs while recovering allocation that would otherwise go to disqualified addresses. It creates an incentive structure where farmers facing likely detection can salvage partial value rather than risk total disqualification.

How do projects detect sybil wallets across multiple blockchains?

Analytics vendors trace interaction patterns across chains using cross-chain behavioral fingerprinting. If a wallet appears isolated on Ethereum but replicates transaction sequences from a linked wallet on Avalanche or Polygon, the pattern triggers detection algorithms. One Hop Protocol sybil cluster was identified because the operator overlapped transactions on both Ethereum mainnet and Avalanche, connecting otherwise separate address sets. Vendors including Nansen and TrustLabs now analyze behavior across 10+ chains simultaneously.