Sybil attacks: how farming accounts are detected and analyzed
A sybil attack is the creation of many fake identities to game a system — airdrops, governance votes, reviews, reputation. On-chain, the evidence is in the shared structure: one controller, many masks.
The cluster signatures
- Shared funding source — dozens of wallets all receiving first money from the same address or exchange withdrawal, often in the same block.
- Coordinated timing — near-simultaneous activation, identical activity windows.
- Mechanical behavior — identical transaction patterns, same protocols, same amounts.
- Circular transactions — funds rotating through the cluster to simulate independent activity.
- Uniform holdings — every wallet holding the same small amounts of the same tokens.
Detection approach
Detection is statistical, not accusatory:
- Cluster by funding — group wallets by shared funding sources.
- Measure independence — compare activity patterns within vs across clusters.
- Score coordination — timing and amount overlap above a threshold is a strong signal.
- Report confidence — a cluster with identical 0.5 SOL withdrawals from one address at the same second is high-confidence; loose correlation is not.
Why it matters to the ecosystem
Farming distorts airdrops, governance and analytics. Every metric a sybil inflates (volume, holders, engagement) is noise for everyone else. SIGBOT's cluster screen cleans the signal for genuine participants.
Your role
If you are evaluating an airdrop list, a trading community, or a partner's engagement, the same wallet-level screen applies: check funding clustering and coordination before trusting the numbers.