How do sybil filters detect airdrop farmers?

They build a graph of every eligible wallet, draw edges from shared funding, transfers, and contract interactions, then run community detection algorithms like Louvain to find dense clusters. Wallets that share a funding source, act in synchronized timing, repeat identical interaction paths, or sweep tokens to one collector score high sybil probability and get removed as a group.

What signals get a wallet flagged as sybil?

The loudest signals are a shared funding source with identical amounts, synchronized transaction timing, the exact same sequence of protocol calls across many wallets, fresh wallets with no independent history, and tokens consolidated back to one wallet after the snapshot. No single flag proves fraud; the filter stacks weak signals until a probability score crosses a line.

How many addresses do airdrops actually filter out?

A lot. Linea, working with Nansen, flagged roughly 516,960 of 1,297,203 eligible addresses as sybil and reduced the eligible set to 780,243, about 40 percent removed from one distribution. Projects with real token value invest the most in filtering.

What tools do projects use for sybil detection?

Arbitrum used Nansen data plus Hop and Offchain Labs, partitioning the transaction graph and applying the Louvain community detection algorithm. Trusta Labs supplies AI detection to multiple projects using a two-phase approach: graph mining first, then individual behavior profiling to cut false positives.

Can you beat a sybil filter with proxies and anti-detect browsers?

Beating filters as a farmer is a permanent arms race. Mobile proxies, anti-detect browsers, and unique funding paths per wallet try to manufacture fake independence, but detection tools improve every cycle and one shared funding trail can drop an entire cluster. The effort required is the proof the model is fragile.

Why do builders pass sybil filters?

Filters detect sameness pretending to be difference. Attributable building is genuinely different work tied to a real identity: verified contracts, real commit history, deployments people use, judged hackathon submissions. It cannot be batched across wallets, so when a filter clusters a builder's address it finds a real record rather than sibling wallets that give a farmer away.

How sybil filters actually work, and why builders pass

The mechanics of getting filtered, and the one property that survives every filter.

Sybil filters work by looking for sameness. Every serious airdrop team now runs the same core play: build a graph of wallets, find clusters that fund each other, act at the same time, and repeat the same moves, then delete the whole cluster. The one property that survives every version of this filter is attributable building, real work tied to a real identity that a hundred farmed wallets cannot fake. This piece explains the mechanics, names the tools, and shows why builders keep passing while farmers keep getting cut.

What a sybil actually is

A sybil attack is one person pretending to be many. In airdrop terms, that means one operator running dozens, hundreds, or thousands of wallets to multiply a single allocation. The name comes from a 1973 case study of multiple identity disorder, and it stuck because the shape is exactly that: many faces, one actor.

Filters do not care that you used a fresh wallet. They care whether that wallet is secretly the same person as fifty others. That distinction is the whole game.

The core mechanic: graph clustering

Modern sybil detection is graph analysis. Teams take every eligible address and draw edges between them based on onchain relationships, who funded whom, who sent tokens to whom, who touched the same contracts in the same window. Then they run community detection algorithms to find dense clusters.

The Arbitrum Foundation airdrop is the reference implementation. Working with Nansen and using data from Hop and Offchain Labs, they partitioned the transaction graph into connected subgraphs and broke the large ones apart with the Louvain community detection algorithm. Bridges, exchanges, and smart contracts were stripped out first so real infrastructure did not get flagged as a cluster. What remained were tight webs of wallets that only made sense as one operator.

Trusta Labs, which now supplies detection to multiple major projects, runs a two-phase version. Phase one mines the asset transfer graph with community algorithms like Louvain and K-Core to surface suspicious groups. Phase two profiles each address individually to cut false positives. Graph first, behavior second.

The signals that get you cut

Underneath the graph math, the flags are boringly consistent. A wallet scores high sybil probability when it triggers several of these at once:

Shared funding source. Ten wallets all funded from the same address, often with identical amounts, is the single loudest signal.
Synchronized timing. Wallets that transact in lockstep, same blocks, same daily rhythm, betray a script.
Identical interaction paths. The exact same sequence of protocol calls across many wallets reads as a template, not a user.
Fresh wallets with no independent history. No prior life, one burst of activity, then silence.
Immediate consolidation. Tokens claimed and swept straight back to one collector wallet after the snapshot.

None of these individually proves fraud. The filter is probabilistic. It stacks weak signals until the combined score crosses a line, then it removes the cluster.

The scale is not a rounding error

This is not a token gesture aimed at a few bad actors. Linea, working with Nansen, flagged roughly 516,960 of 1,297,203 eligible addresses as sybil and cut the eligible set down to 780,243. That is about 40 percent of addresses deleted from a single distribution. The Block reported the same figures. Whatever your read on any one project, the direction is unambiguous: the projects with real token value and real ecosystems are precisely the ones investing hardest in filtering, because they have the most to lose from diluting the drop.

An entire counter-industry exists to beat this, mobile proxies, anti-detect browsers, unique funding paths per wallet. Read the farming guides for 2026 and they are all about manufacturing fake independence. That effort is the proof: passing a sybil filter as a farmer is a full-time arms race you have to win at scale, forever. Miss one shared funding trail and the whole cluster falls.

Why attributable building survives every filter

Here is the property no filter can strip: work that is provably yours and provably real.

Sybil filters are built to detect sameness pretending to be difference. Attributable building is the opposite. It is difference that is actually different. A shipped smart contract with a verified source. A repo with real commit history under your name. A deployment other people actually used. A hackathon submission judged by humans. A GitHub graph that took months, not a script that ran overnight.

You cannot batch that across a hundred wallets. There is no proxy for having written the code. When a filter clusters your address, it finds a funding trail that leads to you, an identity, and a body of work that no sybil cluster can reproduce, rather than forty siblings that give you away. Farmers optimize to look like many independent users. Builders simply are one real user with a real record, so the filter has nothing to catch.

That is also why sybil filters and airdrop eligibility keep converging on the same thing. When Trusta's phase two profiles individual behavior, genuine, varied, self-directed activity is exactly what clears you. The filter is not your enemy if you are the real thing. It is your enemy only if you are pretending to be.

What this means for how you spend your time

The lesson is not "farm more carefully." It is that the entire farming model is a losing arms race against tools that get better every cycle, while the building model passes by default. If you spent the last year rotating wallets, you were doing the hard version of the wrong thing. If you spent it shipping, you were doing the easy version of the right thing.

Build in the open. Attach your name. Deploy contracts people use. Show up to hackathons where humans judge the work. That record is the one asset that reads as real to every sybil filter ever written, and it happens to be the same record that makes you employable when the airdrop meta fades.

DEPLOYR exists to help you become that real onchain developer, the one filters are built to pass, not catch. Start a storefront of real deployed work at the DEPLOYR store, sharpen your build at /build, find judged events at /hackathons, and go deeper in /insights.

Airdrops are never guaranteed. No filter, no strategy, and no article can promise a payout. But attributable building is the one move that pays whether the drop lands or not, and it is the only property that survives every sybil filter.