What is a sybil attack?

A sybil attack is when one person creates multiple fake identities, wallets, or accounts to gain disproportionate influence on a network. In Web3 this usually means one user running many wallets to claim more than their share of a distribution. Mechanism: one persistent user controls dozens or hundreds of sybil wallets that look like distinct participants.; Common goals: drain an airdrop allocation, swing a DAO vote, or collect rewards meant for unique participants.; Other names: some teams call the same behavior sybil abuse or sybil fraud, the underlying tactic is identical.; Origin: the term comes from Brian Zill's 2002 paper at Microsoft Research, named after the book Sybil about dissociative identity disorder. ShieldLabs surfaces sybil activity through persistent visitor and user identification across sessions, regardless of wallet address, email, IP, or browser, so coordinated wallets resolve to one identity on the first visit.

What is sybil resistance?

Sybil resistance is the property of a system that prevents one entity from controlling multiple identities. Different mechanisms achieve it at different layers, each with its own trade-off. Proof-of-stake (cost-based): raises the cost of each identity, but favors large holders.; Proof-of-personhood (identity-based): ties one human to one identity, but adds user friction like iris scans, KYC video, or social verification.; Social-graph analysis: scores trust between accounts, but depends on existing trust networks.; Device intelligence: fingerprints the connection behind each wallet, with no user-side action required. ShieldLabs delivers device-intelligence sybil resistance, correlating coordinated rings to one identity without adding KYC friction for legitimate participants.

How do sybil attacks work in crypto?

In crypto and Web3, a sybil attacker creates many wallets to exploit any system that distributes rewards per wallet. The wallets are built to look like distinct users so each one collects its own share. Airdrops: claim allocations meant for one user across many wallets.; DAO governance: concentrate voting power across fake wallets to pass proposals.; Ambassador or quest programs: collect per-wallet rewards from one program participation, repeated at scale. Telltale signs cluster together: sybil wallets are usually funded from one source, share device fingerprints, route through the same VPN or anti-detect browser, and burst-claim within minutes. This differs from a 51% attack, which targets consensus through hash power or stake rather than fake identities at the application layer. ShieldLabs correlates these wallets back to one persistent identity at connection time, surfacing the shared device and network signals that on-chain analysis alone misses.

What is airdrop farming?

Airdrop farming is the deliberate creation of many wallets and accounts to claim a future token airdrop multiple times. It is the most common shape of sybil attack on Web3 airdrop campaigns and the core mechanism behind airdrop abuse. Who: farmers, also called airdrop hunters, run dozens or hundreds of wallets in parallel.; How: each wallet repeats identical on-chain behavior to look like a distinct user, then collects an allocation when the airdrop drops.; Tooling: industrial operations use anti-detect browsers, VPN rotation, and emulator farms to make wallets look unique to standard signup checks. ShieldLabs links farmed wallets back to one persistent visitor and user through device fingerprinting, anti-detect browser detection, cross-layer mismatch, IP intelligence, and other anonymity signals on every wallet connection.

How do operators detect sybil attacks at signup?

Operators detect sybil attacks at signup or wallet connection by combining several signals into one identity the moment a wallet connects, before tokens are minted or governance votes are cast. No single signal is conclusive, so they layer: Device fingerprinting: persistent identification across sessions, cleared cookies, and incognito.; Anonymizer detection: IP reputation plus VPN, proxy, Tor, and anti-detect browser signals.; Email checks: disposable-email detection on email-required flows.; Patterns: pre-built patterns like many accounts on one device, indicating coordinated rings. Layered together, these resolve dozens of wallets that look distinct back to one persistent identity, even when cookies are cleared and IPs rotate.

How do I prevent sybil attacks on my airdrop or DAO?

Effective sybil prevention combines three layers that work together at wallet connection, so risk is scored before any tokens move: Identity signals: device fingerprinting, IP intelligence, anti-detect browser detection, and cross-layer mismatch checks at wallet connection.; Patterns: pre-built patterns like many accounts on one device, indicating one person controlling many wallets.; Allocation rules: hold token claims or governance votes for review when risk crosses a threshold you set. Anti-sybil checks at this layer scale to millions of wallet connections without iris scans or KYC-video friction, scoring each wallet before tokens are minted.

How is ShieldLabs different from Proof-of-Personhood solutions?

ShieldLabs delivers sybil resistance through device intelligence that fingerprints the wallet connection with no user-side action, while Proof-of-Personhood solutions prove a unique human at the cost of onboarding friction. Proof-of-Personhood and crypto identity verification tools: iris-scan identity, KYC video verification, or social-graph attestation, strong uniqueness guarantees, but high onboarding friction that turns away a large share of legitimate participants when iris or KYC video is required.; ShieldLabs device intelligence: fingerprints the connection behind each wallet silently, with no iris scan, KYC video, or extra step for the participant.; They stack: ShieldLabs drops in next to a token-gating layer or Proof-of-Personhood check via API, not as a replacement. ShieldLabs returns pre-built patterns and a 0-100 risk score on every wallet connection from the Starter plan, self-serve up to Scale, and is ready for sybil attack prevention in 5 minutes.

Will ShieldLabs automatically block sybil wallets?

No. ShieldLabs blocks nothing automatically. It returns a 0-100 risk score and the signals behind it, and your code decides what to do with each wallet against the thresholds you set, for example requiring extra verification before allocating tokens, excluding a wallet from an airdrop, or allocating normally. ShieldLabs gives you 5,000 free identifications to tune those thresholds on real traffic before you enable any rules in production.

Sybil Attack Prevention

Prevent sybil attacks without iris scans or KYC

Keep airdrop allocations, points balances, and reward distributions on real participants, and stop one person from controlling hundreds of fake wallets

Start Free

Stop airdrop farmers

Catch coordinated wallet rings created to drain airdrop allocations at scale

Stop points farming

Catch fake wallets grinding protocol quests to inflate points balances ahead of token launches

Protect token budget

Keep quest payouts, presale allocations, and reward distributions on real participants

Keep real participants friction-free

Legitimate wallets connect and claim without KYC delays or iris scans

How ShieldLabs prevents sybil attacks

ShieldLabs recognizes the real visitor behind every anonymous session, so your team can stop coordinated wallet rings before allocations clear

Accurate Identification

Identify returning visitors and users across sessions, cleared cookies, incognito mode, rotated IP, and fresh wallet addresses

Anonymity Signals

Detection of VPN, proxy, Tor, anti-detect browser, IP reputation and other anonymity signals on every visit, with up to 99% accuracy

Risk Score

A ready-to-use score reflecting the risk of each visit, with the weight of every signal behind it

Ready-Made Patterns

Detection of the hidden connections between accounts that may signal multi-accounting, account farms, and more

Real-Time Analytics

See how much of your traffic is masked, with an overall quality score and a breakdown of the sources sending your visits

Start preventing sybil attacks in 5 minutes

Easily integrate into any wallet connection, airdrop registration, or token claim flow

1
Create your account
Get 5,000 free identifications
2
Add the snippet
It identifies every visitor and returns their anonymity signals and a risk score
3
Check your traffic quality
See how much of your traffic is masked, with an overall traffic score
4
Use the API and Webhooks
Apply the risk score and anonymity signals in your rules to stop fraud and abuse

Start Free

api.shieldlabs.ai/v1/visits/latest

{
  "request_id": "0c284695-cf0b-4755-8beb-0a2e9536595e",
  "visitor_id": "aa8c616a-8a25-4a5e-bee2-a9a08e5128a4",
  "device_id": "6a45967d-1371-9652-ba99-b01ea3992208",
  "user_hid": "u_9f2a41c7",
  "public_ip": { "ip": "62.197.149.124", "country": "United States" },
  "local_ip": { "ip": "45.83.91.7", "country": "United States" },
  "connection_type": "vpn",
  "os": "Windows",
  "browser": "Chrome",
  "device_type": "desktop",
  "risk_score": 85,
  "signals": [
    { "name": "antidetect_browser", "weight": 60 },
    { "name": "vpn", "weight": 15 },
    { "name": "timezone_mismatch", "weight": 10 }
  ]
}

Stop sybil farming before allocations clear

Free 5,000 one-time identifications, with transparent pricing that scales with your needs

Start Free Contact Us