What is Sybil attack?

Creating many identities to gain influence a single participant should not have, whether to farm a token distribution across hundreds of wallets or to sway a vote.

Because addresses are free to create, any system that allocates by address rather than by person invites it. Defenses include proof of personhood schemes, activity heuristics, and clustering analysis that links wallets by funding patterns. Distributions routinely exclude thousands of addresses after such analysis, and legitimate users are sometimes caught by it. See airdrop farming and governance token.

The name comes from a 2002 paper by John Douceur on peer-to-peer systems, which argued that without a central authority vouching for identity, a single entity can present arbitrarily many of them.

How it works

The attack requires no cleverness, only that identity is cheap. An address costs nothing to generate, so any rule of the form "one per address" is really a rule of the form "as many as you care to fund".

Three defenses are used in practice and each has a cost.

Cost imposition makes each identity expensive. Requiring stake, gas spend, or a minimum holding period means a hundred identities cost a hundred times as much. This is what proof-of-stake voting weight does implicitly, and it converts the problem into plutocracy rather than solving it.

Clustering analysis links addresses by behavior. Wallets funded from the same source, transacting in the same pattern, or moving to a common destination are grouped and excluded together. This is what most airdrop sybil filters actually do, and it produces false positives on ordinary users who funded several wallets from one exchange withdrawal.

Proof of personhood ties an allocation to a verified human. It is the only defense that addresses the problem directly, and it requires a trusted verifier and the privacy trade-off that comes with one.

Example

Illustrative. A protocol allocates 1,000 tokens per eligible address to 10,000 addresses. A farmer creates 500 addresses, funds each with the minimum activity required, and qualifies all of them. They receive 500,000 tokens, or 5% of the distribution, against an ordinary user's 1,000. The farmer's cost is the gas and minimum balances across 500 wallets, which on a cheap chain is small relative to the payout. That arithmetic is why distributions on low-fee networks attract the most farming, and why filters that exclude thousands of addresses are routine rather than exceptional.

Why it matters when you buy

Sybil filtering shapes who receives a token before it trades, and therefore how concentrated its early supply is. The concentration pages show how trading in a coin is spread across venues, and the unlock pressure pages show how much supply is scheduled to arrive. The guide on spotting a scam covers the related pattern of manufactured activity.

Related terms

• airdrop farming — the most common motivation
• airdrop — the distribution being gamed
• governance token — where vote-buying applies
• points program — the modern farming target
• chain analysis — how clusters are detected
• wash trading — the volume equivalent of the same idea

Questions

Why do airdrops exclude so many addresses?

Because a meaningful share of qualifying activity is usually one person operating many wallets, and the project would otherwise hand most of the distribution to farmers. The filters are blunt and catch some genuine users.

Can a Sybil attack take over a blockchain?

Not on its own. Proof of work and proof of stake both weight influence by a scarce resource rather than by identity, so creating extra identities without extra hash power or stake achieves nothing. See proof of work.

Does identity verification prevent it?

It raises the cost substantially, which is why some distributions require it. It also introduces a verifier who knows exactly who received what, which is the trade being made.