← Articles

Sybil Detection: Half Your Crypto Growth Chart Doesn't Exist

Sybil detection is the audit most crypto teams skip. LayerZero checked its own users and threw out four in five wallets. How sybil attacks and airdrop farming inflate your metrics, and how to find the humans.

By AnkhLabs Research, Growth research team··7 min read

Key takeaways

  • Sybil detection matters because fake users are paid in crypto, and when LayerZero audited its roughly six million wallets before its 2024 airdrop, only 1.28 million qualified.

  • Bots are now the majority of the internet itself, with Imperva measuring automated traffic at 53% of all web traffic in 2025, and crypto adds a direct cash reward for pretending to be many people.

  • Teams that clean their data, by auditing wallets, paying the crowd to expose cheaters and gating payouts behind proof of personhood, make every marketing decision on real human numbers.

Sybil detection starts with an uncomfortable fact about the internet as a whole. Imperva runs a yearly study of web traffic, and its latest report found automated traffic made up 53% of all web traffic in 2025, up from 51% the year before, which means humans are now the minority online. That's the regular internet, where being fake earns you almost nothing, and crypto adds a twist that we at AnkhLabs think marketers underrate, because here the fake users get paid.

Every wallet might qualify for an airdrop and every transaction might farm a reward, so people run thousands of wallets pretending to be thousands of users. The industry calls them sybils, after a famous case study of a woman with multiple personalities, and they show up at exactly the rate the money justifies. The best measure of the damage comes from the one team that checked. When LayerZero, the protocol that passes messages between blockchains, prepared its 2024 airdrop, about six million wallets had used its product, and after filtering only 1.28 million qualified, with roughly a million wallets turning out to be pure farming operations.

When a metric is worth money, the fakes arrive at exactly the rate the money justifies.

What is a sybil attack in crypto?

A sybil attack in crypto is one person or group controlling many wallets or accounts to look like many independent users, usually to collect rewards meant for real people. The most common targets are airdrops, points programs, grants and governance votes, where every extra wallet can mean an extra payout or an extra vote.

Airdrop farming is the everyday version. A farmer funds hundreds of wallets from one source, runs scripts that make each wallet perform the actions a project is likely to reward, and consolidates the tokens after the airdrop to sell. Researchers studying the Arbitrum airdrop found about 150,000 sybil addresses, organized into 4,000 coordinated groups, that captured roughly 253 million ARB, or about a quarter of the entire airdrop. Every one of those wallets appeared as a user on someone's growth chart until the day it sold.

The machines aren't only in airdrops either. Helius, Solana's biggest infrastructure company, measured bots doing about half of all swaps on the network, and the analyst Stacy Muur, founder of the agency Green Dots, estimated in April 2026 that the bot share of trading on Solana's decentralized exchanges had risen from roughly 60% in January 2025 to 95% by March 2026. That 95% is one analyst's estimate, posted on X and reported by Incrypted, and we found no second independent measurement of it, so it is best read as a sign of direction and not as a settled number. We covered the social media side of this in how AI crypto influencers took over the feed.

How does sybil detection work?

Sybil detection works by looking for patterns that independent humans rarely produce, such as wallets funded from the same source, created in batches, acting at identical times or doing one transaction and going quiet. Teams combine those onchain signals with public reporting, bounties and sometimes proof-of-personhood checks before paying out any reward.

LayerZero's audit is the one worth studying, because it turned the cheaters against each other. First the team published a list of 803,093 suspicious addresses, and then it made an offer. Sybils who confessed could keep 15% of their reward, and bounty hunters who exposed others earned 10% of whatever the cheater would have received, which drew about 100,000 confessions. The same greed that built the sybil army was pointed at tearing it down.

Few teams publish an audit this thorough, and the market has started building the missing layer for the rest. World's proof-of-human project, which verifies people by scanning their iris at a device called an Orb, now counts nearly 18 million verified humans across 160 countries. Proving you're a person is becoming its own layer of internet infrastructure, and the demand for it comes from exactly the problem your dashboard is hiding.

Why bot users are a marketing problem

Think about what bots do to every number you use for decisions. Your cost per user looks great, because bots are cheap to "acquire," while your crypto user retention looks terrible, because farm wallets vanish on schedule. Your A/B tests end up measuring the preferences of scripts, and a team optimizing its spend against that dashboard is steering by broken instruments.

It also distorts the market for attention. Teams bid for users based on dashboards that may be inflated, so the going price of a user is partly set by people buying robots. That makes sybil detection a growth decision as much as a security one, because it tells you which channels bring actual people and what a person really costs. It also changes how you plan an airdrop marketing strategy, since every token sent to a farm is a token that never reaches a customer.

What we'd tell a founder about sybil detection

Audit the funnel before you scale the spend. Check your own users for the classic sybil signs, like wallets funded from the same source, created in batches, acting at identical times or doing one transaction and dying. The result changes every spending decision that follows, and if you scale before you audit, you're paying to attract more of whatever is already gaming you.

Make the crowd clean your data. LayerZero's confess-or-be-hunted structure works for any rewards program, by offering partial forgiveness for confession and a cut for proof of cheating. It costs less than a detection vendor, and it hires the best sybil hunters in the world, who happen to be other sybils.

Gate the rewards, not the product. Human verification adds friction, so put it only where money leaks out, meaning claims, rewards and votes. Let anyone use your product freely and make sure only verified humans can collect the payouts that sybils farm.

Keep two dashboards and spend against the human one. Show raw numbers publicly if you must, but make decisions on human-adjusted numbers. Your cost per real, retained human will be the ugliest figure your team has ever seen, and that's fine, because it was just as ugly before you measured it and now you can improve it. The gap between a headline count and a committed user exists even where nobody is cheating. On Zoop, a project AnkhLabs worked on, 2M+ user signups became 500K+ wallets connected, a 25% signup-to-wallet conversion rate as reported by client and platform data, and the second number is the one worth planning against.

The denominator is the advantage

Crypto growth has always been reported as a numerator, more wallets, more transactions, more volume, while almost nobody checks what share of it is human. The team that knows its real human count gets to make every decision the competition makes blind, from which channels bring actual people to what a person truly costs to who actually stays. In a market where half the chart may not exist, knowing which half is real is the edge that compounds. You can see the kind of user numbers we report in our case studies, and our strategic advisory page covers how we work with teams on growth planning. If you're about to scale a rewards campaign and want a second opinion on what sybil detection should mean for the plan, talk to AnkhLabs.

Frequently asked questions

What is sybil detection in crypto?

Sybil detection is the process of finding wallets or accounts controlled by the same person or group so they can be excluded from rewards, votes or metrics. Common signals include shared funding sources and identical timing. LayerZero's 2024 audit cut roughly six million wallets to 1.28 million eligible addresses.

How does airdrop farming work?

Airdrop farmers create many wallets, fund them, and use scripts to repeat the actions a project is likely to reward, then collect and sell the tokens when the airdrop lands. At scale it can capture a large share of the supply, with researchers finding sybils took about a quarter of Arbitrum's airdrop.

How many crypto users are bots?

Nobody has a single reliable figure, but the estimates are high. Helius found bots performed about half of all swaps on Solana in the first half of 2025, and across the wider web, Imperva measured 53% of traffic as automated in 2025.

What is proof of personhood?

Proof of personhood is a way to confirm that an account belongs to a unique human without necessarily revealing who that human is. World's version scans a person's iris at a device called an Orb and issues a digital credential, and it counts nearly 18 million verified humans across 160 countries.

How can projects prevent sybil attacks?

The most effective projects combine onchain analysis, public reporting and verification at the point of payout. LayerZero published suspect addresses and offered bounty hunters 10% of a cheater's reward, which drew about 100,000 confessions. Proof-of-personhood tools such as World ID can then gate claims without adding friction to the product itself.

← Articles

Sybil Detection: Half Your Crypto Growth Chart Doesn't Exist

Sybil detection is the audit most crypto teams skip. LayerZero checked its own users and threw out four in five wallets. How sybil attacks and airdrop farming inflate your metrics, and how to find the humans.

By AnkhLabs Research, Growth research team··7 min read

Key takeaways

  • Sybil detection matters because fake users are paid in crypto, and when LayerZero audited its roughly six million wallets before its 2024 airdrop, only 1.28 million qualified.

  • Bots are now the majority of the internet itself, with Imperva measuring automated traffic at 53% of all web traffic in 2025, and crypto adds a direct cash reward for pretending to be many people.

  • Teams that clean their data, by auditing wallets, paying the crowd to expose cheaters and gating payouts behind proof of personhood, make every marketing decision on real human numbers.

Sybil detection starts with an uncomfortable fact about the internet as a whole. Imperva runs a yearly study of web traffic, and its latest report found automated traffic made up 53% of all web traffic in 2025, up from 51% the year before, which means humans are now the minority online. That's the regular internet, where being fake earns you almost nothing, and crypto adds a twist that we at AnkhLabs think marketers underrate, because here the fake users get paid.

Every wallet might qualify for an airdrop and every transaction might farm a reward, so people run thousands of wallets pretending to be thousands of users. The industry calls them sybils, after a famous case study of a woman with multiple personalities, and they show up at exactly the rate the money justifies. The best measure of the damage comes from the one team that checked. When LayerZero, the protocol that passes messages between blockchains, prepared its 2024 airdrop, about six million wallets had used its product, and after filtering only 1.28 million qualified, with roughly a million wallets turning out to be pure farming operations.

When a metric is worth money, the fakes arrive at exactly the rate the money justifies.

What is a sybil attack in crypto?

A sybil attack in crypto is one person or group controlling many wallets or accounts to look like many independent users, usually to collect rewards meant for real people. The most common targets are airdrops, points programs, grants and governance votes, where every extra wallet can mean an extra payout or an extra vote.

Airdrop farming is the everyday version. A farmer funds hundreds of wallets from one source, runs scripts that make each wallet perform the actions a project is likely to reward, and consolidates the tokens after the airdrop to sell. Researchers studying the Arbitrum airdrop found about 150,000 sybil addresses, organized into 4,000 coordinated groups, that captured roughly 253 million ARB, or about a quarter of the entire airdrop. Every one of those wallets appeared as a user on someone's growth chart until the day it sold.

The machines aren't only in airdrops either. Helius, Solana's biggest infrastructure company, measured bots doing about half of all swaps on the network, and the analyst Stacy Muur, founder of the agency Green Dots, estimated in April 2026 that the bot share of trading on Solana's decentralized exchanges had risen from roughly 60% in January 2025 to 95% by March 2026. That 95% is one analyst's estimate, posted on X and reported by Incrypted, and we found no second independent measurement of it, so it is best read as a sign of direction and not as a settled number. We covered the social media side of this in how AI crypto influencers took over the feed.

How does sybil detection work?

Sybil detection works by looking for patterns that independent humans rarely produce, such as wallets funded from the same source, created in batches, acting at identical times or doing one transaction and going quiet. Teams combine those onchain signals with public reporting, bounties and sometimes proof-of-personhood checks before paying out any reward.

LayerZero's audit is the one worth studying, because it turned the cheaters against each other. First the team published a list of 803,093 suspicious addresses, and then it made an offer. Sybils who confessed could keep 15% of their reward, and bounty hunters who exposed others earned 10% of whatever the cheater would have received, which drew about 100,000 confessions. The same greed that built the sybil army was pointed at tearing it down.

Few teams publish an audit this thorough, and the market has started building the missing layer for the rest. World's proof-of-human project, which verifies people by scanning their iris at a device called an Orb, now counts nearly 18 million verified humans across 160 countries. Proving you're a person is becoming its own layer of internet infrastructure, and the demand for it comes from exactly the problem your dashboard is hiding.

Why bot users are a marketing problem

Think about what bots do to every number you use for decisions. Your cost per user looks great, because bots are cheap to "acquire," while your crypto user retention looks terrible, because farm wallets vanish on schedule. Your A/B tests end up measuring the preferences of scripts, and a team optimizing its spend against that dashboard is steering by broken instruments.

It also distorts the market for attention. Teams bid for users based on dashboards that may be inflated, so the going price of a user is partly set by people buying robots. That makes sybil detection a growth decision as much as a security one, because it tells you which channels bring actual people and what a person really costs. It also changes how you plan an airdrop marketing strategy, since every token sent to a farm is a token that never reaches a customer.

What we'd tell a founder about sybil detection

Audit the funnel before you scale the spend. Check your own users for the classic sybil signs, like wallets funded from the same source, created in batches, acting at identical times or doing one transaction and dying. The result changes every spending decision that follows, and if you scale before you audit, you're paying to attract more of whatever is already gaming you.

Make the crowd clean your data. LayerZero's confess-or-be-hunted structure works for any rewards program, by offering partial forgiveness for confession and a cut for proof of cheating. It costs less than a detection vendor, and it hires the best sybil hunters in the world, who happen to be other sybils.

Gate the rewards, not the product. Human verification adds friction, so put it only where money leaks out, meaning claims, rewards and votes. Let anyone use your product freely and make sure only verified humans can collect the payouts that sybils farm.

Keep two dashboards and spend against the human one. Show raw numbers publicly if you must, but make decisions on human-adjusted numbers. Your cost per real, retained human will be the ugliest figure your team has ever seen, and that's fine, because it was just as ugly before you measured it and now you can improve it. The gap between a headline count and a committed user exists even where nobody is cheating. On Zoop, a project AnkhLabs worked on, 2M+ user signups became 500K+ wallets connected, a 25% signup-to-wallet conversion rate as reported by client and platform data, and the second number is the one worth planning against.

The denominator is the advantage

Crypto growth has always been reported as a numerator, more wallets, more transactions, more volume, while almost nobody checks what share of it is human. The team that knows its real human count gets to make every decision the competition makes blind, from which channels bring actual people to what a person truly costs to who actually stays. In a market where half the chart may not exist, knowing which half is real is the edge that compounds. You can see the kind of user numbers we report in our case studies, and our strategic advisory page covers how we work with teams on growth planning. If you're about to scale a rewards campaign and want a second opinion on what sybil detection should mean for the plan, talk to AnkhLabs.

Frequently asked questions

What is sybil detection in crypto?

Sybil detection is the process of finding wallets or accounts controlled by the same person or group so they can be excluded from rewards, votes or metrics. Common signals include shared funding sources and identical timing. LayerZero's 2024 audit cut roughly six million wallets to 1.28 million eligible addresses.

How does airdrop farming work?

Airdrop farmers create many wallets, fund them, and use scripts to repeat the actions a project is likely to reward, then collect and sell the tokens when the airdrop lands. At scale it can capture a large share of the supply, with researchers finding sybils took about a quarter of Arbitrum's airdrop.

How many crypto users are bots?

Nobody has a single reliable figure, but the estimates are high. Helius found bots performed about half of all swaps on Solana in the first half of 2025, and across the wider web, Imperva measured 53% of traffic as automated in 2025.

What is proof of personhood?

Proof of personhood is a way to confirm that an account belongs to a unique human without necessarily revealing who that human is. World's version scans a person's iris at a device called an Orb and issues a digital credential, and it counts nearly 18 million verified humans across 160 countries.

How can projects prevent sybil attacks?

The most effective projects combine onchain analysis, public reporting and verification at the point of payout. LayerZero published suspect addresses and offered bounty hunters 10% of a cheater's reward, which drew about 100,000 confessions. Proof-of-personhood tools such as World ID can then gate claims without adding friction to the product itself.