Airdrop Sybil filters: why wallets get excluded, and how to stay eligible
In 2024 the big distributions cut hundreds of thousands of addresses, many of them after months of activity. If you farm airdrops today, knowing what the filters measure will pay you more than opening extra wallets.
How many wallets the big drops removed
| Distribution | Date | Addresses excluded | Main reason |
|---|---|---|---|
| LayerZero (ZRO) | June 2024 | 803,093 addresses excluded of ≈ 2.1M (≈ 38%) | Published criteria: shared funding source within 30 days, same bridges, similar amounts and overlapping timing. |
| zkSync Era (ZK) | June 2024 | ≈ 695,000 addresses kept | Activity-duration thresholds (30+ days) and low-effort usage filtering. |
| Starknet (STRK) | 2024 | 27,000 addresses cut before distribution | Cluster review ahead of the final eligibility list. |
| Optimism (OP) | May 2022 | ≈ 17,000 coordinated addresses out of 250,000 | The first large wake-up call; criteria tightened in the following round. |
Filtering now removes a large share of every snapshot. On zkSync Era, only about 695,000 addresses received tokens. Teams hire outside firms for the job: Trusta Labs for machine-learning clustering, Nansen for address labelling, Bubblemaps for cluster visualisation and Chaos Labs for behavioural simulation.
How detection works
The model is a graph: every address is a node, every transfer or contract interaction is an edge. Clustering algorithms then look for sets of addresses that share a funding entry point (often the same centralised exchange account), repeat the same contract sequences in the same order, or transact inside the same time windows.
Academic work points the same way. A detection framework published in 2026 combined a graph isomorphism network for topology with DBSCAN clustering for accounts and labelled 76 percent of the analysed zkSync addresses as Sybil, including 342 that had received tokens. So the filters protocols use in production are probably looser than what research can already do.
Six habits that keep a legitimate wallet eligible
- One funding source, never shared. Funding several addresses from the same exchange account inside a short window is the easiest signal to catch. One wallet, one origin of funds.
- Spread activity over time. Observed duration thresholds sit around 30 days minimum, and higher on recent campaigns. If you cram everything into the week before a snapshot, you look like a farmer.
- Vary the type of activity as well as the volume. Swaps, liquidity, lending, NFTs, governance: a real user touches several primitives in an irregular order. Repeating one sequence is a cluster marker.
- Keep a residual balance and a life after the snapshot. Emptying an address right after an interaction is a farm signature. A balance that stays and activity that continues both weigh in behavioural scoring.
- Avoid identical amounts and identical hours. Overlapping timing windows across addresses is one of the criteria LayerZero published explicitly.
- Keep wallet hygiene. Revoke contract approvals regularly (revoke.cash), keep a dedicated address for risky interactions, and never sign an unlimited approval from your main address. This protects your funds first and your eligibility second. More in our guide to securing your crypto.
One real wallet against ten clones
Ten manufactured addresses share, by construction, a funding source, a rhythm and amount sizes. Clustering tools are built to find exactly that pattern, and a Sybil label can also shut you out of later campaigns and governance. One address you use for real, over months and across several protocols, triggers none of those signals.
Some protocols add a proof-of-uniqueness layer such as Gitcoin Passport, which aggregates identity stamps without a government document. The common threshold of about 20 points is still gameable. Teams therefore stack signals, and a high score will not make up for a thin usage history.
Finding the airdrops worth the effort
What is left is picking which campaigns to farm. Our airdrop radar lists live campaigns with an estimate of potential value, effort required and whether they are farmable, refreshed daily. Check it before you put thirty hours into a distribution that may never happen.
Frequently asked questions
What is an anti-Sybil filter on an airdrop?
It is the set of rules a protocol applies before distribution to remove addresses manufactured purely to capture tokens. Teams build a transaction graph, cluster addresses by behavioural similarity, then exclude or reduce the allocation of flagged clusters. LayerZero excluded 803,093 addresses out of roughly 2.1 million in its ZRO airdrop in June 2024, close to 38 percent.
Which signals get a wallet excluded?
LayerZero published the clearest list: wallets funded from the same source within 30 days, wallets bridging through the same routes for similar amounts, and wallets whose transaction timing windows overlap. Other red flags: the same contract sequence repeated across wallets, very young wallets, and activity shorter than the protocol's minimum, often 30 days or more.
Is using multiple wallets forbidden?
It is not illegal, but multi-wallet setups are what the filters are built to find, and large-scale farming gets hit hard: zkSync Era kept only about 695,000 recipients in June 2024, and Starknet cut 27,000 addresses before distribution. In practice, one wallet you have used for a long time does better than ten cloned ones.
Can a legitimate wallet be flagged by mistake?
Yes, and protocols admit it. A real user with unusual habits can look like a cluster and get caught. Proof-of-uniqueness scores such as Gitcoin Passport add an identity layer without government KYC, but scores above the usual threshold of 20 can be gamed, which is why teams combine several signals instead of relying on one. The same logic applies to you: no single trick makes a wallet safe.
Go further
This article is informational and is not investment advice. Eligibility criteria are set unilaterally by each protocol and can change without notice: no method guarantees an allocation. Interacting with unaudited contracts can cost you your assets.
Sources: LayerZero published eligibility criteria (June 2024), zkSync Era, Starknet and Optimism distribution reports, Trusta Labs documentation, and "Airdrop Sybil Attack detection framework supported by machine learning", International Journal of Electronics and Telecommunications, 2026. Read on 26 September 2026.