← Articles

Vampire Attack in Crypto: What Works and What Doesn't

A vampire attack in crypto uses a rival's public onchain customer list to lure its users away with rewards. SushiSwap, Blur and LooksRare all tried it, and the data shows why the users rarely stayed.

By Latheef, Growth research team··7 min read

Key takeaways

  • A vampire attack in crypto is when a new protocol uses its rival's public onchain user list to lure those users away with token rewards, as SushiSwap did to Uniswap and LooksRare and Blur did to OpenSea.

  • Vampire attacks usually win the first month and lose the year, because SushiSwap drained more than $800 million from Uniswap in a day and then fell 46% while Uniswap grew 165% by the end of that month.

  • The lasting advantage of public blockchain data is targeting rather than bribery, so teams should build campaigns for specific competitor cohorts and spend retention budget on the users still active at day 90.

A vampire attack is crypto's name for raiding a competitor's customers, and it only works because in crypto the customer list is public. In every other industry that list is the crown jewel, so companies encrypt it, lawyers fight over it and employees get sued for walking out with it. In crypto, your competitor's complete customer history sits on a public blockchain where anyone can search it, including every user, every transaction, every whale and every wallet that went quiet last month.

The industry figured this out early, and the proof was an airdrop. When the NFT marketplace LooksRare launched against OpenSea in January 2022, its launch reward didn't go to its own users, because it didn't have any. It went to the 185,223 wallets that had traded at least 3 ETH on OpenSea in the previous six months, so a startup built its launch list out of its rival's customer database, in public, and nobody could do anything about it. Several years of these raids have now produced enough data to say what the tactic is actually worth.

In web2, poaching a rival's customers takes espionage. Onchain, it's a query.

What is a vampire attack in crypto?

A vampire attack in crypto is a growth tactic where a new protocol copies or rivals an established one and pays that protocol's users, usually in its own token, to move their money or activity over. Because every wallet's history is public onchain, the attacker can target the rival's exact users without ever touching its private data.

The original was SushiSwap in September 2020. It copied Uniswap's code and offered rewards to anyone who moved their liquidity, the pooled deposits that make trading possible, and in one day it drained more than $800 million from Uniswap, leaving it with just over $400 million. It looked like total victory for about a week. Then Uniswap answered with its own token airdrop, and by the end of the month Uniswap's deposits had grown 165% while SushiSwap's fell 46%, so the attack meant to kill the incumbent ended up advertising it.

Do vampire attacks work?

Vampire attacks work in the short term and usually fail in the long term. They can move billions in deposits or most of a market's volume within weeks, but the users they attract are loyal to rewards, not products, so they leave when the rewards shrink or a rival offers more. The attackers that kept share also had a better product.

Blur ran the smartest version against OpenSea. OpenSea held 89.7% of NFT trading in January 2022, and by February 2023, the month of Blur's airdrop, Blur held 56.8%. That was a real takeover, but rewards are a lease rather than a purchase, and by August 2024 Blur's monthly volume had fallen about 83% in eight months while a third marketplace, Magic Eden, took the top spot.

The cruder copies did worse. LooksRare paired its airdrop with rewards for trading volume, and about $18 billion, or 95% of its trading volume, turned out to be wash trading, meaning people trading with themselves to farm the rewards. Pay for behavior and you'll get behavior, but whether any humans come with it is a separate question.

Why the bribe doesn't hold

The retention data explains every one of those stories. A study of nine major airdrops found that for most recipients selling was the very first thing they did, with 65.75% of Lido's airdropped tokens going straight to exchanges. Delphi Digital tracked 3.7 million wallets over five years and found 78% to 94% of recipients sold most of their tokens within 90 days. A user you bought with a token bribe is loyal to token bribes, and when a competitor copies your list and offers a bigger one, they leave the way they came. We call that mercenary liquidity, and it behaves the same way whether the reward is yield or an airdrop.

The perpetual futures exchanges, which let traders bet on prices with leverage, have run the same experiment. In the third quarter of 2025, perp DEXs did $1.8 trillion in volume as Aster, backed by incentives, overtook Hyperliquid in daily trading. By August 2026 the lead had swung back, with Hyperliquid holding about 58% of 30-day volume across the top eight perp DEXs, because volume that arrives for rewards moves again when the rewards move.

How to find a competitor's users onchain

The public ledger's real gift to a growth team is targeting rather than the raid. Nansen advertises more than 500 million labeled addresses, and Addressable says it tracks more than 130 million wallets and 850 million devices. Those are the vendors' own numbers, so take them loosely, but the capability is real and we use versions of it every week.

Onchain user targeting means you can pull up a rival's most active users, their recently departed customers or the wallets that tried both of you and picked them, and build a specific campaign for each group. That isn't a scattershot airdrop, because it's a named list of provably qualified people built from behavior no survey could uncover.

What we'd tell a founder about a vampire attack

Build target lists from the blockchain before you spend on anything broad. Your ideal user already exists onchain, using a competitor, and their history proves their intent better than any ad platform's guessing. Start every acquisition plan with that list.

If you raid, raid with a better product, not just a bribe. Blur took OpenSea's lead because its rewards were attached to a genuinely better tool for professional traders, while LooksRare attached rewards to nothing and bought $18 billion of fiction. The reward gets the visit, but only a reason to stay turns the visit into a user, and without one your raid just funds your competitor's comeback story.

Assume you're being copied right now. Your list is exactly as public as theirs, so the defense can't be secrecy. It has to be making the bribe uneconomical through switching costs, built-up positions, identity and relationships captured through channels you own, like wallet messaging, all built before the rival's airdrop lands rather than the week after.

Grade any raided group at day 90. Mercenary money identifies itself on the blockchain with perfect honesty. Track the users your rewards brought in, watch what they do when the rewards end and spend your retention budget on the ones who stayed, because the rest were never yours.

The open blockchain is a strange bargain, because you get your competitor's customer list and the price is that they get yours. Years of vampire attacks show the bargain doesn't reward the biggest bribe, since every bribe gets outbid eventually, usually by someone copying the briber's own list. It rewards the team that reads the public record more carefully than anyone else and gives the users it finds there a reason to stop moving.

Frequently asked questions

Why is it called a vampire attack?

The name comes from the way the attacker feeds on an existing protocol's users and liquidity instead of building its own from scratch. The best-known case is SushiSwap in 2020, which copied Uniswap's code and used token rewards to drain more than $800 million of Uniswap's deposits in a single day.

What was the SushiSwap vampire attack?

In September 2020 SushiSwap forked Uniswap and paid SUSHI tokens to users who moved their liquidity over, pulling more than $800 million and leaving Uniswap with just over $400 million. Uniswap responded with its UNI airdrop, and by the end of the month its deposits had grown 165% while SushiSwap's fell 46%.

How did Blur beat OpenSea?

Blur combined token rewards with a faster trading tool built for professional NFT traders. OpenSea held 89.7% of NFT trading in January 2022, and by February 2023 Blur held 56.8%. The lead didn't last, since Blur's monthly volume fell about 83% in the first eight months of 2024 and Magic Eden took the top spot.

How do you defend against a vampire attack?

Build switching costs and direct relationships before the attack arrives. Users with positions, history, identity or rewards that vest over time are expensive to bribe, and users you can message directly are easier to win back. Delphi Digital found 78% to 94% of airdrop recipients sell within 90 days, so rewards alone won't keep anyone.

Is using onchain data to target a competitor's users legal?

Blockchain transaction data is public, and analytics firms such as Nansen, which advertises more than 500 million labeled addresses, sell tools built on it. Linking wallets to real identities or personal data can raise privacy rules in some countries, so teams should check how their vendor sources any off-chain matching before running campaigns.



← Articles

Vampire Attack in Crypto: What Works and What Doesn't

A vampire attack in crypto uses a rival's public onchain customer list to lure its users away with rewards. SushiSwap, Blur and LooksRare all tried it, and the data shows why the users rarely stayed.

By Latheef, Growth research team··7 min read

Key takeaways

  • A vampire attack in crypto is when a new protocol uses its rival's public onchain user list to lure those users away with token rewards, as SushiSwap did to Uniswap and LooksRare and Blur did to OpenSea.

  • Vampire attacks usually win the first month and lose the year, because SushiSwap drained more than $800 million from Uniswap in a day and then fell 46% while Uniswap grew 165% by the end of that month.

  • The lasting advantage of public blockchain data is targeting rather than bribery, so teams should build campaigns for specific competitor cohorts and spend retention budget on the users still active at day 90.

A vampire attack is crypto's name for raiding a competitor's customers, and it only works because in crypto the customer list is public. In every other industry that list is the crown jewel, so companies encrypt it, lawyers fight over it and employees get sued for walking out with it. In crypto, your competitor's complete customer history sits on a public blockchain where anyone can search it, including every user, every transaction, every whale and every wallet that went quiet last month.

The industry figured this out early, and the proof was an airdrop. When the NFT marketplace LooksRare launched against OpenSea in January 2022, its launch reward didn't go to its own users, because it didn't have any. It went to the 185,223 wallets that had traded at least 3 ETH on OpenSea in the previous six months, so a startup built its launch list out of its rival's customer database, in public, and nobody could do anything about it. Several years of these raids have now produced enough data to say what the tactic is actually worth.

In web2, poaching a rival's customers takes espionage. Onchain, it's a query.

What is a vampire attack in crypto?

A vampire attack in crypto is a growth tactic where a new protocol copies or rivals an established one and pays that protocol's users, usually in its own token, to move their money or activity over. Because every wallet's history is public onchain, the attacker can target the rival's exact users without ever touching its private data.

The original was SushiSwap in September 2020. It copied Uniswap's code and offered rewards to anyone who moved their liquidity, the pooled deposits that make trading possible, and in one day it drained more than $800 million from Uniswap, leaving it with just over $400 million. It looked like total victory for about a week. Then Uniswap answered with its own token airdrop, and by the end of the month Uniswap's deposits had grown 165% while SushiSwap's fell 46%, so the attack meant to kill the incumbent ended up advertising it.

Do vampire attacks work?

Vampire attacks work in the short term and usually fail in the long term. They can move billions in deposits or most of a market's volume within weeks, but the users they attract are loyal to rewards, not products, so they leave when the rewards shrink or a rival offers more. The attackers that kept share also had a better product.

Blur ran the smartest version against OpenSea. OpenSea held 89.7% of NFT trading in January 2022, and by February 2023, the month of Blur's airdrop, Blur held 56.8%. That was a real takeover, but rewards are a lease rather than a purchase, and by August 2024 Blur's monthly volume had fallen about 83% in eight months while a third marketplace, Magic Eden, took the top spot.

The cruder copies did worse. LooksRare paired its airdrop with rewards for trading volume, and about $18 billion, or 95% of its trading volume, turned out to be wash trading, meaning people trading with themselves to farm the rewards. Pay for behavior and you'll get behavior, but whether any humans come with it is a separate question.

Why the bribe doesn't hold

The retention data explains every one of those stories. A study of nine major airdrops found that for most recipients selling was the very first thing they did, with 65.75% of Lido's airdropped tokens going straight to exchanges. Delphi Digital tracked 3.7 million wallets over five years and found 78% to 94% of recipients sold most of their tokens within 90 days. A user you bought with a token bribe is loyal to token bribes, and when a competitor copies your list and offers a bigger one, they leave the way they came. We call that mercenary liquidity, and it behaves the same way whether the reward is yield or an airdrop.

The perpetual futures exchanges, which let traders bet on prices with leverage, have run the same experiment. In the third quarter of 2025, perp DEXs did $1.8 trillion in volume as Aster, backed by incentives, overtook Hyperliquid in daily trading. By August 2026 the lead had swung back, with Hyperliquid holding about 58% of 30-day volume across the top eight perp DEXs, because volume that arrives for rewards moves again when the rewards move.

How to find a competitor's users onchain

The public ledger's real gift to a growth team is targeting rather than the raid. Nansen advertises more than 500 million labeled addresses, and Addressable says it tracks more than 130 million wallets and 850 million devices. Those are the vendors' own numbers, so take them loosely, but the capability is real and we use versions of it every week.

Onchain user targeting means you can pull up a rival's most active users, their recently departed customers or the wallets that tried both of you and picked them, and build a specific campaign for each group. That isn't a scattershot airdrop, because it's a named list of provably qualified people built from behavior no survey could uncover.

What we'd tell a founder about a vampire attack

Build target lists from the blockchain before you spend on anything broad. Your ideal user already exists onchain, using a competitor, and their history proves their intent better than any ad platform's guessing. Start every acquisition plan with that list.

If you raid, raid with a better product, not just a bribe. Blur took OpenSea's lead because its rewards were attached to a genuinely better tool for professional traders, while LooksRare attached rewards to nothing and bought $18 billion of fiction. The reward gets the visit, but only a reason to stay turns the visit into a user, and without one your raid just funds your competitor's comeback story.

Assume you're being copied right now. Your list is exactly as public as theirs, so the defense can't be secrecy. It has to be making the bribe uneconomical through switching costs, built-up positions, identity and relationships captured through channels you own, like wallet messaging, all built before the rival's airdrop lands rather than the week after.

Grade any raided group at day 90. Mercenary money identifies itself on the blockchain with perfect honesty. Track the users your rewards brought in, watch what they do when the rewards end and spend your retention budget on the ones who stayed, because the rest were never yours.

The open blockchain is a strange bargain, because you get your competitor's customer list and the price is that they get yours. Years of vampire attacks show the bargain doesn't reward the biggest bribe, since every bribe gets outbid eventually, usually by someone copying the briber's own list. It rewards the team that reads the public record more carefully than anyone else and gives the users it finds there a reason to stop moving.

Frequently asked questions

Why is it called a vampire attack?

The name comes from the way the attacker feeds on an existing protocol's users and liquidity instead of building its own from scratch. The best-known case is SushiSwap in 2020, which copied Uniswap's code and used token rewards to drain more than $800 million of Uniswap's deposits in a single day.

What was the SushiSwap vampire attack?

In September 2020 SushiSwap forked Uniswap and paid SUSHI tokens to users who moved their liquidity over, pulling more than $800 million and leaving Uniswap with just over $400 million. Uniswap responded with its UNI airdrop, and by the end of the month its deposits had grown 165% while SushiSwap's fell 46%.

How did Blur beat OpenSea?

Blur combined token rewards with a faster trading tool built for professional NFT traders. OpenSea held 89.7% of NFT trading in January 2022, and by February 2023 Blur held 56.8%. The lead didn't last, since Blur's monthly volume fell about 83% in the first eight months of 2024 and Magic Eden took the top spot.

How do you defend against a vampire attack?

Build switching costs and direct relationships before the attack arrives. Users with positions, history, identity or rewards that vest over time are expensive to bribe, and users you can message directly are easier to win back. Delphi Digital found 78% to 94% of airdrop recipients sell within 90 days, so rewards alone won't keep anyone.

Is using onchain data to target a competitor's users legal?

Blockchain transaction data is public, and analytics firms such as Nansen, which advertises more than 500 million labeled addresses, sell tools built on it. Linking wallets to real identities or personal data can raise privacy rules in some countries, so teams should check how their vendor sources any off-chain matching before running campaigns.