Airdrop Sybil detection: how wallets get clustered and what a VPN does (2026)

An airdrop distributes tokens to addresses that used a protocol. A Sybil attack is one person posing as many independent users to collect a share for each of them. Projects look for this, and they look at a combination of signals rather than any single one. What follows is a breakdown of how the detection works: what ties wallets together, why the network address sits at the bottom of that list, and why the downside is not only a missed payout but also funds already sitting on an exchange.

First, what is actually at stake

Worth stating up front rather than in the fine print at the end. The stake here is not convenience or a missed distribution. It is access to your own money.

• Retroactive exclusion from the distribution. Filtering happens after the snapshot, the state of the network captured at a specific block, and it covers the full history of the address. The token issuer sets the rules and is under no obligation to give you anything.
• Frozen funds on an exchange. When you deposit tokens, the platform may ask you to document the source of funds. Until that request is closed, the money stays out of reach. This is a compliance procedure, not a penalty for a specific action, and the timeline depends on the platform.
• Account closure. Multiple accounts violate the terms of service on most platforms, and an account is closed together with whatever balance sits on it.
• Residency and KYC limits. The platform decides based on your documents and country of residence, not on your network address.

What pulls wallets into one cluster

Filtering is built on the transaction graph, the public record of who sent what to whom and when. Wallets end up in the same cluster through overlaps in that graph, and the strongest signals look like this:

• A shared exit point. Withdrawals from dozens of addresses into a single exchange deposit address. That address is issued to one specific account, so once it is labeled as an exchange deposit, every sender converges on the same point.
• A single funding source. Gas for every wallet arrived from one address, or in one series of withdrawals from one account. The funding tree is the most direct way to assemble a cluster.
• Direct transfers between wallets. Addresses reference each other directly or through a single intermediate transaction.
• Timing patterns. Transactions arrive in batches inside a narrow window, around the same hour every day, with even gaps between addresses.
• Identical amounts. Matching deposit, swap and transfer sizes, round numbers, identical balances left after a withdrawal.
• The same route through the apps. The same contracts in the same order, the same pairs, the same bridges, the same number of operations.
• A synchronized exit. Every address goes quiet on the same day, usually right after the snapshot.

Note that nothing on that list involves the network. Every signal there comes from data users publish themselves, one signed transaction at a time.

Why the network address is the weakest signal

An IP address only lands in the logs of the services you actually went through: the RPC provider, the app frontend, the quest platform, the exchange. It is not in the blockchain and cannot be, because a chain stores addresses, amounts, contract calls and signatures. Three things follow from that.

• The signal does not always exist. If participation ran through the project site or a quest platform, the organizers do hold connection logs. If the activity was purely on-chain, the issuer works from the public chain, and the IP is seen by an infrastructure provider instead.
• The signal is unreliable on its own. One address behind several wallets is ordinary: a family behind one router, an office, a mobile carrier running thousands of subscribers through shared NAT. A method resting on IP alone would cut off honest users in bulk.
• The signal is short-lived. IP changes on any home connection and logs are kept for a limited time, while the transaction graph stays in the chain permanently and cannot be edited.

That trade is lopsided, which is why work at the network layer changes little here. Rerouting the connection closes the one signal that is private and short-lived. The strong signals stay exactly where they were: a shared deposit address and matching amounts do not go away because the traffic took a different path.

On-chain clustering and why it cannot be undone after the fact

Clustering is a set of heuristics that groups addresses by shared traits in their transaction history. In UTXO networks the basic heuristic is common input ownership: if several addresses signed one transfer, they are assumed to be controlled by one owner. In account-based networks such as Ethereum and compatible chains, the graph of transfers is used instead: who funded whom, who withdrew, which contracts the flow passed through. Labels for known addresses, including exchange deposits, bridges and mixers, are maintained and continuously extended by analytics firms.

The defining property of the method is that it is retrospective. The analysis can run at any point after the events, over the full history, rather than in real time. That means:

• A mistake cannot be removed. The transaction that linked two addresses stays in the chain forever, because blockchains support neither deletion nor edits.
• New labels apply to old history. An address that looks neutral today may be tagged as an exchange deposit tomorrow, and the link appears retroactively, with no action from you.
• Heuristics improve while the data does not expire. A method that did not exist at snapshot time can be applied to the same data a year later.
• A fresh address does not detach you from a cluster if it ever touched an old one, through a direct transfer, a shared gas source or a shared exit point.

What a VPN does here, and what it does not

A VPN changes the network address a service sees and encrypts traffic up to the server. That is the whole of it. It does not affect the contents of a transaction, and it does not turn ten wallets into ten different people, because a project separates people by money and behavior, not by connection. Privacy of the connection is a network problem, and it is solvable. Untraceable activity in a public ledger is a different class of problem, and network tools do not address it at all. A VPN also does not provide anonymity in the first place, and the reasons are covered in the guide on deanonymization through device identifiers.

Where a VPN earns its place for a crypto user

Tasks where a tunnel is the right tool:

• Public networks. Using a wallet or an exchange over Wi-Fi in a cafe, hotel or airport means an open network with spoofable DNS and fake access points. The tunnel closes the channel to the server, DNS queries included, provided the client is configured without leaks. Confirm that with a test for IP, DNS and WebRTC leaks.
• Privacy from your ISP. An ISP sees which domains your device reaches, through DNS queries and the server name in the TLS handshake. That is which services you use and when. Through a tunnel it sees only the address of the VPN server.
• Travel. Hotel and corporate networks often filter certain hosts and ports under their own rules, and familiar interfaces simply fail to load. Here a change of route solves a genuinely technical problem.
• Analytics and dashboards. Block explorers, stats panels and API portals are sometimes unreachable from particular networks for routing reasons. That is the ordinary case where a different exit point helps.
• Connecting to a node. Packet loss on the last mile turns into failed transaction broadcasts and dropped RPC calls. A tunnel to a nearby server sometimes gives a steadier route, but this is not a rule, because the extra leg can add latency instead. See how a VPN affects speed.

The short version. Sybil filtering runs on public and permanent data, and the network address is the one signal in that picture that is private and short-lived. A VPN does its own job honestly: it shields your connection from your ISP and from networks you do not control. It does not do the job it is sometimes bought for. What you pay for a free tunnel is covered separately in the risks of free VPNs.

Frequently asked questions