How To Sybil Farm Airdrops Like A Professional (And Not Get Caught)

We play the game we need to play to stay competitive

Note: This post is very comprehensive its recommended you set aside some time to digest everything or bookmark this page so you can come back to it to reference for later

An Introduction to Sybil Clusters 

In the context of airdrops, a “Sybil” is a person or entity that controls multiple wallets (often 20+, sometimes hundreds or thousands) to maximize their airdrop allocation.

The main objective, beyond financial gain, is to avoid detection, as projects don't want a single individual exploiting airdrops through a large multiple of wallets.

To farm at scale successfully, it's crucial to ensure your wallets aren't connected in a way that forms a large cluster, which could get blacklisted. Understanding how wallets connect through on-chain interactions is key to avoiding detection.

Common interactions include:

• Funding clusters of wallet from the same wallet

• Sending assets between separate clusters, thus creating a connection between these clusters

• Depositing funds from various wallet to a single source (wallet address or CEX deposit address)

A cluster is a network of wallets that interact through transactions. Sybil whales are professional Sybils with significant capital to deploy and utilize for farming operations.

Historical data has shown that cluster sizes of up to seven wallets have not been flagged as Sybil entities.

Projects don't inherently support Sybils. While more wallets receiving airdrops can boost a product's KPIs, projects don't want a large portion of tokens going to a single entity.

The majority of projects will allow clusters with fewer than eight wallets to fly under the radar, most only care about clusters of 20 or more wallets.

The reason we have seen the 20+ wallet threshold consistently used is the goal for projects is to identify the largest/ most egregious sybils so they can filter out and removed the majority of “offenders”.

Paraswap and Moonbirds, historically the most strict airdrop filters, filtered out clusters with more than eight wallets.

If a project becomes too strict with their cluster threshold amount it increases the change of false positives harming real users and often results in very negative user and community backlash (Paraswap was a perfect example of this).

Majority of projects (especially “larger” ones with more funding and users) set the filter higher

Arbitrum, Aptos, LayerZero, and Optimism filtered out wallet clusters larger than 20 wallets. 

A detected Sybil provided by Arbitrum. Source: Arbitrum

To ensure better management and error on the side of caution, a maximum of 5 wallets per cluster is a recommended amount. This reduced cluster size guarantees that your wallets will not be blacklisted.

In the three following articles, you can find Arbitrums Sybil detection Methods and how they filter wallets:

• GitHub - Arbitrums Sybil Detection Method

• Closer Look at the Anti-Sybil Mechanism by Boesin Security 

• Nansen, who aided in the development of the filter criteria, also gives a breakdown of their process

Sybil Clusters Visualized

The following three images show how large on-chain Sybil clusters look like:

Recycling and reusing funds properly

To properly recycle or reuse funds from one wallet to another after farming, it is essential to create multiple smaller individual clusters instead of connecting all wallets into one large cluster. 

The rule 'CEX is best' when funding airdrop wallets is essential to remember: always withdraw from a centralized exchange (CEX) as their hot wallets are publicly labeled and process several withdrawals per minute. 

This will make your wallets well-known to on-chain analysis tools and naturally whitelisted. 

To avoid flagging your wallets as Sybils connected CEX hot wallets, it is essential that you create multiple unique deposit addresses on your CEX account. 

Some CEXs, like Bitget and OKX (which ideally do not require KYC), allow you to create multiple sub-accounts on the same CEX account, enabling you to create over 100 different deposit addresses. 

Using unique deposit addresses on a CEX for each deposit will help you avoid linking your wallets, giving you maximum security and privacy for your transitions. 

In theory each cluster of 5 wallets could have the same CEX deposit address and you should not run into any issues but its often “cleaner” to have a unique CEX deposit address for each wallet if possible.

Using the rerouting feature in cross-chain bridges or bridge aggregators with dApps like Bungee, LIFI/Jumper, and deBridge (all of which are also tokenless) can be an alternative method to the CEX method.

This is because the on-chain block explorer only shows that the deposit was made from the bridge contract address and not directly from a specific wallet.

The “bridge contract” is the smart contract address used for processing funds and sending them to users moving assets between blockchains. 

However, while this method can still be effective it is much less reliable as a single savy on-chain sleuth or sybil hunter can use various methods to mass scrap bridge interactions. Or if the respective dApp/bridge has an associated block explorer like Socketscan for Bungee, they can find connections of transferred funds between wallets and clusters.

Projects or the 3rd party sybil detection providers they work with are unlikely to go into this level of depth, but in certain cases when the incentives are strong enough (like we saw with the LayerZero sybil hunter incentive program) you are potentially putting yourself at unnecessary risk for all the hard work you’ve put in.

A compromise for this that I like to do is use cross chain bridges to transfer funds between (your 5) wallets within the SAME cluster. Then when you need to recycle funds for a new cluster use the “CEX is best” method to have a “clean” funding source.

Historically,  anti-sybil algorithms will analyze block explorers like Etherscan and Arbiscan trying to identify clusters with the following properties:

• Addresses transferring funds in a cluster of more than X addresses

• Addresses that are funded from the same source (wallet)

• Addresses that deposit to the same source after doing their interactions

• Addresses with similar on-chain  activity (similar volume, interaction time frames, assets type, asset amount, smart contract your interacting with, the order or sequence of these interactions).

Remember, CEXs like Bitget and OKX are currently the most effective way to recycle funds and scale multiple wallets for airdrops.

Additional Pro Tips

1. To ensure eligibility for future airdrops and avoid exclusion from specific networks, always maintain a minimum balance of 0.005 ETH or 0.01 ETH in your wallet. 

This figure is based on historical Sybil filter criteria, where a small balance of less than ~$20 has been used to either reduce your allocation or disqualify you completely (Arbitrum, Starknet). 

2. To maintain anonymity and prevent clustering, it is recommended that you refrain from sending or receiving funds from friends using your farming wallets. 

To ensure the security of your farming wallets, it is recommended that you keep them private and avoid sharing them with others.

3. Transition your long-term on-chain trading or NFT minting wallets into wallets designed explicitly for airdrop farming while creating new on-chain trading or long-term wallets. 

The reasoning behind this is that older wallets with a deep and long on-chain history footprint, such as those with many transactions on ETH mainnet, are considered “higher quality” than freshly made wallets with no on-chain history on any chain.

4. Categorize and organize your wallets for easier management.

   Many prefer to use Excel spreadsheets for this purpose, which will help you aggregate all the interactions you’ve completed on each wallet within a single location.

Keeping track of your progress will save you a large amount of time in the long run, you are not going to remember which wallet you’ve done certain interactions on across multiple wallets over the course of weeks and months . 

An effective interaction spreadsheet requires breaking down the core interaction types for a particular ecosystem and organizing them into different categories.

Focus on completing each category in sections.

Here are some examples of spreadsheet interaction tracker I’ve made in the past for premium newsletter subscribers

For Layer Zero

For Polyhedra

For Mantle

Wallet extensions

Wallet extensions should be leveraged to farm airdrops efficiently and securely.

Rabby Wallet (Twitter) has powerful features, such as the ability to view all assets across multiple chains in a single UI, automatic network switching, transaction pre-screening, and human-readable transaction details, making it a superior alternative to MetaMask. Its features allow you to save significant time when farming and moving assets across multiple chains.

MetaMask is the web3 standard and a good backup option for Rabby if a website or DApp does not support it. However, it is worth noting that this is a rare occurrence.

In most cases, you can easily use Rabby by selecting the MetaMask or injected/browser wallet option on most DApps.

The DeFi Saver Gas tracker is the ultimate tool for keeping track of current ETH gas prices. It is beneficial when farming on an ETH L2, as the gas fees paid on the L2 are affected by ETH mainnet gas prices.

PocketUniverse is an extension that confidently screens all transactions before you sign them. It displays the access you are granting in human-readable form, effectively preventing any potential drain on your valuable crypto assets.

XVerse — BTC wallet – related farms and interactions for BTC ecosystem projects

PetraWallet or MartianWallet —  Aptos farming

Phantom Wallet —  Solana farming

Kepler Wallet —   Cosmos ecosystem farming

Onchain Measures: Looking the Part