How to Screen Wallets for Airdrop Sybil Farming

Running an airdrop, a giveaway or a community vote and worried one person is behind a chunk of your "participants"? Checking wallets one by one doesn't scale past a handful. This page covers what Sybil farming actually looks like on-chain, and how to check a whole list of addresses at once instead of guessing.

What Sybil farming looks like on-chain

A person running many wallets to look like many people usually leaves the same kinds of traces the pairwise linking signals already cover, just repeated across a whole batch:

A handful of "funder" wallets that each seeded a dozen or more of the addresses in your list.
Direct transfers between addresses that are supposed to be unrelated participants.
Genuinely shared, non-generic counterparties across several addresses in the list.

None of this is visible from looking at any single address alone — it only shows up once you compare the whole list against itself.

Checking one at a time doesn't scale

With 20, 50 or hundreds of entries, opening each wallet individually and cross-referencing by eye is impractical, and easy to get wrong. Hopchain's Bulk Sybil / Cluster Check does this automatically: paste or upload up to 50 addresses (CSV or plain text, one per line) and it groups them into likely-same-controller clusters instead of a wall of individual results.

How the clustering actually works

Three signals, in order of how strong the evidence is: a direct transfer between two addresses in your list, a shared funding source, and a shared counterparty — filtered so a common exchange, DEX or popular token contract (which almost any two active wallets would share) never gets counted as a meaningful signal on its own. Addresses that link on any of these end up grouped into one cluster, with the specific evidence shown for each.

Reading the "not evaluable" bucket correctly

Not every address that fails to link to another is "confirmed clean." An address with no transaction history and no funding trail Hopchain could trace is reported in a separate, explicit not evaluable bucket — never silently folded into "no cluster found." A wallet farmer who leaves an address completely empty specifically to look clean would otherwise slip straight past a checker that doesn't make this distinction.

Good habits

Treat a cluster as a lead worth a closer look, not an automatic verdict — false positives are still possible, especially for a small handful of shared touchpoints.
Don't publicly name or accuse someone from a cluster result alone; verify further first.
Re-run the check periodically for an ongoing program — funding patterns for a fresh batch of farmed wallets can differ from an earlier one.

Only need to compare a couple of specific addresses instead of a whole list? The pairwise Sybil check is faster for that.

This is general information, not financial, legal or security advice.

Frequently asked questions

How do I check many wallets for Sybil farming at once?
Paste or upload up to 50 addresses (CSV or plain text) into Hopchain's Bulk Sybil / Cluster Check. It groups them into likely same-controller clusters using direct transfers, shared funding sources and shared non-generic counterparties, and shows the evidence for each cluster.

What does Sybil farming look like on-chain?
A few funder wallets that each seeded many of the addresses in your list, direct transfers between participants who are supposed to be unrelated, and genuinely shared non-generic counterparties across several addresses.

Is a cluster proof that one person controls the wallets?
No. Treat a cluster as a lead worth a closer look. False positives are possible, especially with only a few shared touchpoints, so verify further before accusing anyone publicly.

Keep reading

Have a list of addresses to check? Run a Bulk Sybil / Cluster Check. It's free and needs no signup.

How to screen a list of wallets for Sybil or airdrop farming