Airdrop farming

A farming operation is infrastructure, not a person with alt wallets

The mental model most teams start with is one clever user running fifteen MetaMask accounts. That is the bottom of the market. A medium-size operation runs 1,000 to 10,000 simultaneous anti-detect browser profiles on commodity cloud hardware, each presenting its own device fingerprint, time zone, language settings and behavioural pattern, at a cost per profile-hour of under a penny at scale.¹

The wallets are prepared months in advance. Operations create them 3 to 6 months before a target launch, run small swaps on DEXs, interact with verified protocols and accumulate enough on-chain history that the addresses look lived-in by the time a snapshot lands.¹ By then the qualifying behaviour is real. It happened. It just did not happen for the reason your eligibility rule assumed.

The economics are the part worth internalising. The total cost of running a 5,000-wallet operation against a major airdrop sits in the range of $30,000 to $80,000 in setup and infrastructure, and if the airdrop distributes $5,000 per legitimate participant, the operation breaks even on about 7 to 15 successful claims.¹ Read that ratio again. A 5,000-wallet farm needs a 0.3% success rate to stop losing money. Anything above that is margin.

The unit of analysis is the cluster, not the address

Because farming is an operation rather than an account, detection works by grouping addresses that share something the operator could not fully separate: a funding path, a timing pattern, a contract interaction sequence, a device. The mechanics of that grouping, and what each detection approach costs honest users, are covered in the sybil resistance entry linked below, so this page will not repeat them.

The one addition worth making here is that the strongest signal often is not on-chain at all. Capture the device fingerprint at the moment a wallet connects to your frontend, and if 50 wallets are connecting from 5 underlying devices, that pattern is visible no matter how carefully the addresses were separated on-chain.¹ Farmers can rotate proxies and randomise gas. Running 10,000 profiles on 10,000 physically distinct devices is the one thing that does not get cheaper at scale.

The tradeoff is that this signal only exists if you collect it, which means an SDK on your frontend and a data-retention position you can defend. That is a decision for the week you design the campaign, not the week you run the snapshot.

What exclusion looks like when a project publishes its rules

The Arbitrum Foundation documented its anti-Sybil rules rather than leaving them to inference. Three appear in its own eligibility documentation. If all of a recipient wallet's transactions occurred inside a single 48-hour window, one point is subtracted. If the wallet balance is under 0.005 ETH and the wallet has not interacted with more than one smart contract, one point is subtracted. And if the address was identified as a Sybil address during the Hop Protocol bounty programme, the recipient is disqualified outright.²

Notice the structure. Two heuristics apply a penalty rather than a ban, and only the externally sourced list disqualifies. That is a deliberate calibration: clustering produces judgments, not facts, and a scoring system leaves room for a wallet that is merely new rather than fake. It also means the published rule is now a specification. A wallet spread over 49 hours, holding 0.006 ETH, touching two contracts, clears all three.

How many got through is a question nobody can answer

The Arbitrum Foundation's eligibility page sets out the exclusion rules and publishes no aggregate count of addresses removed.² Third parties filled the gap, and they do not agree with each other.

X-Explore ran the Louvain community detection algorithm over the sub-graph of all 624,136 airdropped EOA addresses and reported more than 279,328 same-person addresses, of which it classified 148,595 as Sybil addresses that received the airdrop, accounting for roughly 253 million ARB or 21.8% of the tokens distributed.³ Trusta Labs, applying its own definition, reported 96,755 Sybil addresses in the eligible list, capturing 164,153,951 ARB.⁴ Both are named analysts publishing their method. Neither is the issuer.

The gap between them is not a rounding error, it is roughly a factor of 1.5 on addresses, and it exists because Sybil is a threshold on a similarity score rather than a fact about a wallet. Any founder quoting a single headline figure for airdrop farming capture is quoting somebody's threshold. Design against the ratio you can control, which is cost per qualifying action, not against a number you cannot verify.

What we tell teams to change before the campaign, not after

Start from the arithmetic above and invert it. If your per-address allocation is worth $5,000 and a farmer's marginal cost per prepared wallet is a few dollars, you have written a subsidy. Either lower the per-address ceiling and widen the base, or raise the cost of the qualifying action so that a farm cannot amortise it across thousands of profiles. Capital at risk, held duration and actions that require a counterparty are harder to fake cheaply than transaction counts are.

Two operational points that cost nothing. Take the snapshot at a block nobody could have anticipated, because a published date converts your rule into a shopping list. And publish the detection method after the snapshot rather than before, since the alternative is handing the operators a test suite.

The framing we use with founders is that an airdrop is a marketing spend with a capture rate, not a distribution with a leakage problem. You are buying attention and holders at some cost per genuine participant. Farming raises that cost. Decide what you are willing to pay per real user, then work backwards to the rule, and accept that some share of the budget leaves through the side door no matter what you write.