Sybil Filtering: Why Airdrops Disqualify Farmers

If you have spent any time around token distributions, you will have seen the complaint: someone did everything asked of them, and got nothing, while the rules seemed to shift after the fact. Often the explanation is sybil filtering, and it is worth understanding properly, because it shapes how these distributions work and because a whole industry of bad advice has grown up around it.

This is an explanation of what the filtering is trying to do, why it catches people it did not mean to catch, and how to think about it without being sold something.

The problem the filtering exists to solve

The term comes from a well-established idea in computer science: a sybil attack, where a single actor creates many separate identities to gain influence in a system that assumes one identity means one person.

Blockchains are exceptionally vulnerable to this. Creating a new wallet address costs nothing and requires no permission. That is a genuine strength, protecting people who need to transact without asking anyone’s approval. It is also an obvious weakness the moment somebody tries to distribute something evenly across a crowd.

Consider what a project is attempting. It wants to put tokens in the hands of many real users, to spread ownership and reward people who actually used the thing. But it cannot see people. It can only see addresses. If it distributes to every address that meets its conditions, someone running hundreds or thousands of addresses collects a large share of a distribution meant for a community.

The activity itself is often called farming: methodically performing whatever behaviour appears to qualify, at scale, across many wallets, with no interest in the product beyond the payout. Filtering is the attempt to remove it.

How filtering actually works

The methods vary and the details are usually kept quiet, for the obvious reason that publishing them tells farmers exactly what to avoid. But the general shape is consistent, and it is all pattern analysis on public data.

• Funding trails. A blockchain records where money came from. If many wallets were funded by a single source, or funnel back into one afterwards, they are visibly connected.
• Timing. Real people act at irregular hours in irregular bursts. Scripts do not. Clusters of wallets acting within seconds of one another, in the same sequence, stand out.
• Behavioural sameness. Identical amounts, identical action sequences, identical intervals across many addresses suggest one operator, not many users.
• Minimum-effort activity. Wallets that did precisely the qualifying actions, in the smallest possible amounts, and nothing else, look like people optimising for a checklist rather than using a product.
• Graph clustering. Combining these signals produces networks of related addresses, which can be removed as a group.

Note what none of that measures: intent. The filter cannot know why you did anything. It observes what your address did and how that compares with everyone else’s.

Why ordinary users get caught

This is the part that causes the most anger, and it is entirely predictable once you see filtering as pattern-matching rather than judgement.

A cautious beginner does small test transactions first. That resembles the minimum-effort pattern. Someone who follows a step-by-step guide performs the same actions in the same order as everyone else who read that guide. Someone who keeps separate wallets for good security reasons has created exactly the cluster of related addresses a filter is built to notice. Someone who funded several wallets from one exchange withdrawal has left the trail that flags a funnel.

None of these people did anything wrong. They simply produced data that looks like farming data. Because filtering is applied at scale, thresholds get set where they exclude the most farmers at an acceptable cost in false positives. If you are that cost, the fact that you were sincere does not appear anywhere in the analysis.

Appeals processes sometimes exist and sometimes do not. Where they exist they are frequently overwhelmed. That is unsatisfying, and it is the honest position.

The advice industry built on top of this

Wherever eligibility is uncertain and valuable, people appear selling certainty. Treat every one of them as a threat.

You will see services promising sybil-resistant wallet setups, guides claiming to reveal the exact criteria, tools offering to score your wallet’s eligibility, and consultants offering to structure your activity so it passes. The problems with all of these are the same.

First, nobody outside the project knows the criteria, and the criteria are commonly finalised after the qualifying period, partly to defeat exactly this kind of gaming. Anyone stating them with confidence is guessing or lying.

Second, the services themselves are frequently the attack. A tool that checks your eligibility is a tool that has collected your address, which is a fine start for targeted phishing. A tool that asks you to connect a wallet to check is asking for far more than it needs. Our wallet security basics covers what these requests can do, and the current crop of eligibility-checker scams is tracked in scam alerts.

Third, following farming advice makes you look like a farmer. Guides teaching thousands of readers to perform an identical sequence are manufacturing exactly the behavioural cluster that filtering is designed to catch. The advice can be the thing that disqualifies you.

A saner approach

The realistic conclusion is not a technique. It is a change of expectation.

• Use things you would use anyway. Genuine engagement is the only pattern that is genuinely hard to fake, and it costs you nothing if no distribution ever happens.
• Do not multiply wallets to chase a payout. It increases your exposure, multiplies your fees, and is precisely what the filtering targets.
• Keep security separations for security reasons. If a filter misreads that, it is an acceptable price for not keeping everything in one place.
• Never pay for eligibility. No legitimate distribution requires a payment to qualify, and no third party can grant you eligibility for one.
• Expect nothing specific. Plans change, criteria change, and filtering is imprecise. Treat any distribution as a possibility rather than an entitlement.

To be explicit about where we stand: TokenSpin is an independent informational publication. We do not run distributions, we cannot influence anyone’s eligibility, and we will never ask you to connect a wallet, sign a transaction, approve a token or enter a seed phrase on this site. What we do check before anything appears on the radar is written out in our vetting process, including the limits of what any outside party can verify. Common questions are answered in our FAQ.

Sybil filtering is a genuine attempt to solve a genuine problem, executed with imperfect tools on incomplete information. Understanding that will not get you through a filter. It will stop you paying someone who claims they can, which is worth considerably more. None of this is financial advice, and no reward, filtered or otherwise, should be treated as money you can count on.