Sybil detection is how projects find and disqualify wallets that look like they belong to the same person. Running many wallets to multiply one allocation is called Sybil farming, named after a book about a woman with sixteen personalities.
It is no longer a token gesture. Projects now spend real money on analytics firms before they pay. The filters run after the eligibility list is published, which is the part that catches people out.
The numbers from real airdrops
LayerZero flagged 803,093 addresses in its 2024 ZRO distribution, working with Nansen and Chaos Labs. It ran an unusual two-stage program: wallets that self-reported as Sybil by 17 May 2024 kept 15% of their expected allocation. Community bounty hunters who submitted evidence on at least 20 addresses earned 10% of what those addresses would have received. Farmers who did neither got nothing.
Linea worked with Nansen and flagged 516,960 of 1,297,203 eligible addresses, cutting the list to 780,243. That is 40% of an already-published eligibility list removed before payment.
Optimism excluded a further 17,000 addresses after its first airdrop was announced, recovering 14 million OP. Small by comparison. It makes the same point: the announcement is not the final list.
How detection actually works
Five methods do most of the work and they compound. A wallet that trips one might survive. A wallet that trips three does not.
Wallet clustering. Addresses funded from the same exchange withdrawal, or that have sent funds to each other, get grouped and treated as one entity. This is the single most common way farms are found, because the money has to come from somewhere.
Transaction timing. Wallets executing the same action within seconds or minutes of each other look scripted. Humans are irregular. Scripts are not.
Behavioural fingerprinting. Identical amounts, the same sequence of protocols, the same gas settings across dozens of addresses. Each is weak alone and damning together.
IP correlation. Multiple wallets signing from one address or range. This is why proxy setups exist and why projects treat a clean IP as necessary but not sufficient.
Graph analysis. Network analysis of how addresses relate on chain, which catches farms that avoided the obvious mistakes but still move funds among themselves eventually.
Being flagged is not always final
Both LayerZero and Linea published a checker and an appeal route. LayerZero said outright that its first list was preliminary and that addresses could be reassessed as the methodology changed. If you farm honestly with one wallet and get caught in a cluster because of a shared exchange withdrawal, the appeal is worth filing.
It also cuts the other way. LayerZero’s bounty program drew complaints from users who said they were flagged without justification. Some Sybil hunters offered to compensate people they had wrongly reported. A community-sourced filter produces community-sourced errors.
What this means if you run multiple wallets
Assume they will be analysed, by firms whose only job is finding them, with the full transaction history available forever. The detection side has improved every year since 2024 and the farming side has not gained an equivalent edge.
The arithmetic is worse than it looks. Ten wallets multiply your gas costs and your time by ten. If the cluster is caught they multiply your payout by zero. One wallet with genuine depth over months is the boring answer that keeps working.
If you already run several, the LayerZero precedent is the useful one: when a project offers a self-report window at a reduced allocation, taking it beat getting caught, by the whole allocation.
Sybil filters are one stage of a longer process. How airdrops work end to end covers the rest.
Last checked 19 September 2026.
