Sybil Attack

Sybil attack — one person pretending to be many via multiple wallets to claim a bigger airdrop.

Origin of name

From the novel "Sybil" (1973) about a woman with multiple personalities. In crypto — a wallet with multiple personalities.

How projects detect

1. Transaction patterns: identical sequence with identical intervals → ban.

2. Funding source: 100 wallets funded from one CEX → ban.

3. Graph analytics: wallets transferring between each other → cluster → ban.

4. Behavior fingerprinting: same active hours, same protocols → ban.

Famous bans

• Optimism (2022): filtered ~17,000 sybil accounts.
• Arbitrum (2023): removed ~150,000 wallets.
• Hyperliquid (2024): zeroed out large farms.

How NOT to get caught

• 1 wallet = 1 person.
• Real transactions, not bot-like.
• Varied amounts, varied timing.
• Different IPs.
• Use different DEXs/dapps.