Three traits almost every sybil cluster shares. These are the patterns investigators look for when tracing wallets across a chain.
A single person (or a small team) controls dozens to thousands of addresses, each dressed up to look like an independent, ordinary user.
Wallets are drip-fed identical amounts, run the same swaps, and bridge on the same days — just enough on-chain history to pass an eligibility filter.
The goal isn't to use the product. It's to multiply one person's share of an airdrop, a grants pool, or an incentive program.
When Arbitrum launched the ARB token, analysts at X-explore and WuBlockchain ran the entire recipient list through a community-detection model. The result is the clearest public picture of sybil farming to date.
Addresses withdrew tiny, near-identical amounts from Binance (0.00114–0.00116 ETH, ~$2) over a 5-day window — then behaved in lockstep.
Addresses crossed to Arbitrum through the HOP bridge with fixed ~0.0025 ETH (~$4) deposits, and together collected 1.08M ARB.
Donor addresses funded thousands of wallets through the Disperse contract — one seed paid 1,274 airdrop wallets — netting 10.98M ARB.
Wallets run by one attacker earned 174,375 and 204,250 ARB by staying active after the snapshot and mirroring behaviour across Optimism.