Sybil detection is how projects identify and disqualify wallets that appear to belong to the same person. Running multiple wallets to multiply your airdrop allocation is called Sybil farming, named after the book about a woman with 16 personalities.
Projects have gotten serious about this. LayerZero partnered with Nansen and ran a bounty program where community members could report Sybil clusters. In the Linea airdrop, around 40% of eligible wallets — 517,000 addresses — were filtered as Sybil. Berachain used multi-layer checks combining on-chain data with off-chain behavioral signals.
The main detection methods:
- Wallet clustering — wallets funded from the same CEX withdrawal, or that sent funds to each other, get grouped. If the whole cluster looks like one person, it gets treated as one.
- Transaction timing — wallets that execute identical actions within seconds or minutes of each other look automated
- IP correlation — multiple wallets operating from the same IP address
- Behavioral fingerprinting — identical patterns of interaction, same transaction amounts, same dApp sequence
- Graph analysis — network analysis of how wallets relate to each other on-chain
By 2025–2026, projects are using AI-powered detection that goes far beyond basic clustering. If you’re running multiple wallets, assume they will be analyzed.
