What Is a Sybil Attack? The Logic Behind Airdrop Eligibility Filters

In March 2023, the Arbitrum airdrop scrubbed roughly 270,000 sybil wallets at launch. One team alone surfaced with 1,496 linked wallets; their share of the token went to zero on announcement day. That was the largest public anti-sybil sweep in crypto history and it shoved one question in front of every project and every farmer: what does a “real user” wallet actually look like? This piece isn’t a guide to evading detection. It walks through the definition, the detection methods, the on-chain fingerprints, and where farmers should draw the line — so that you can see what an airdrop is genuinely trying to reward.

What a sybil attack is

The term “sybil attack” comes from a 1973 novel about a woman with dissociative identity disorder. In a blockchain context, a sybil attack is one real actor creating and controlling many addresses to impersonate many independent users and capture an outsized share of a reward.

In airdrops, the logic is direct: the project wants to distribute tokens to “early real users,” one share per user. If one person impersonates 1,000 users, they grab 1,000 shares. Short term it looks like a win for the farmer; long term it wrecks the project’s token distribution — the more concentrated supply ends up in a few teams’ hands, the harder the open-market dump on launch day.

(/uploads/20260529/1780061274570-19758.png)

Anti-sybil isn’t projects “punishing farmers” out of spite. It’s the only way to protect the long-term health of the float. With that framing in mind, the difference between “filtered out fairly” and “filtered out unfairly” gets much clearer.

How projects detect sybils

Detection falls into three rough categories, usually applied in combination.

On-chain graph analysis. The cheapest and most common. Each claimant wallet becomes a node, each transfer an edge, and a “funding graph” emerges. If one seed wallet sends the same amount of ETH to 200 fresh wallets in a short window, those 200 are flagged as one controller. The bulk of the Arbitrum sweep came from these funding graphs.

Social graph and external signals. Some projects require linking Twitter, Discord, Galxe and cross-checking against external data such as ENS, Gitcoin Passport, or ZK identity primitives. A wallet with a long-active ENS and a real Twitter following almost never gets filtered.

KYC. The extreme version: identity verification before claiming. It enforces “one share per person” at the root, increasingly common in compliance-heavy jurisdictions. The cost is real users walking away rather than handing over passports.

Anti-sybil is a permanent arms race. Funding-graph heuristics were enough a few years ago; now industrial farms use CEX withdrawals, distributed time zones and humanized pacing to dodge them, and projects respond with ML models. No end state — but each cycle squeezes low-effort sybils out of the pool.

What real users vs farmed wallets look like

If you want to know whether your wallet would survive a filter, look at it the other way: what does a real user’s on-chain footprint look like?

In short: real users leave human traces — mistakes, exploration, pauses; farmed wallets leave machine traces — precise, neat, minimum cost. Anti-sybil hunts the second pattern, not the first.

If you only run one wallet, spend your own money, and do real things on chain, getting filtered by mistake is extremely rare. The risk arrives the moment “I want one more share” enters the picture. For practical follow-ups, see improving airdrop eligibility, which extends this thread into actionable habits.

(/uploads/20260529/1780061308951-67699.png)

Where the farming line actually sits

“Farming” in crypto is a slightly loaded word — it means racking up low-cost interactions to chase airdrops. But farming is not the same thing as a sybil attack — the two get muddled all the time.

The clean dividing line is this: are you running multiple disguised identities at once?

• Single-wallet farming: one wallet, real tasks, real gas. Whatever your motive, you are a real user and anti-sybil shouldn’t filter you.
• Multiple wallets, independent origins: you, partner, friends with separate wallets, each spending their own money. Linked but behaviorally independent, mostly safe; strict projects can still filter by IP or device fingerprint.
• Bulk wallets, single controller: one person running scripts across dozens or hundreds of wallets. Textbook sybil. Filtering is the rule, not an injustice.

The frustration most farmers feel is rarely “I didn’t do enough” — it’s “I treated the rules as a KPI checklist.” Scripted low-quality interactions are noise to projects, not signal. The farmer who survives multiple airdrop cycles thinks “I am a real user who happens to use several products,” not “I have 100 wallets to grind metrics.”

Projects aren’t fighting multiple accounts — they’re fighting industrial behavior

That’s the single line worth keeping. Multiple accounts aren’t sin in themselves — a household with several members each holding wallets, a dev who tests across multiple wallets, all of that is fine. What projects push back on is one person running an industrial assembly line that pretends to be 100 people and breaks the token distribution.

Frame anti-sybil as “anti-industrialization” and every detection method clicks: funding graphs target assembly-line money flows, social verification targets empty-shell identities, KYC targets identities with no real person behind them. From here the next step is the testnet airdrop guide, which translates “quality interaction” into actual operational habits. Not investment advice.