How to detect airdrop wallet farms before allocation

To detect an airdrop wallet farm, investigate relationships across the cohort rather than judging each wallet in isolation. Combine on-chain funding and activity with permitted live device/account evidence, then review whether the linked participants violate the campaign’s eligibility rule. A common funding source or fresh wallet is a lead, not a complete exclusion case.

Start with the allocation rule and observation window

A farming investigation needs a defined question: which wallets may receive an allocation, over what qualifying period, and under what participant limit? Without it, ordinary multi-wallet use can be mislabeled as repeated participation.

Freeze a versioned input list for the initial analysis. Record chains, wallet normalization rules, relevant events and the snapshot cutoff. Treat newly arriving addresses and later evidence as additions with their own timestamps. This makes a correction traceable when an allocation is disputed.

For an illustrative points campaign, a participant might legitimately use a new wallet after a recovery. That case differs from submitting a series of wallets to multiply one participant’s reward. The allocation policy needs a way to distinguish replacement, additional participation and organizational use.

Read funding relationships in context

Funding links are useful when their meaning is preserved. A direct transfer between two participant wallets can have a different interpretation from both receiving funds through a large exchange, bridge or public sponsor.

Trusta Labs provides address-level Sybil scoring, while Nomis describes wallet clustering and behavioral segmentation. Ask whether the selected product returns inspectable relationships, only a score, or an assisted report. These outputs create different review workloads.

Add live evidence where the flow supports it

A clean-looking wallet history does not answer which browser or account submitted the claim. ShieldLabs’ Sybil solution combines live device/network intelligence with linked identities and ready-made Multi-accounting detection. It can add evidence about repeated participation and masking on supported visits.

The application must associate the wallet and participant with the observed flow. Bind wallet ownership through the application’s appropriate verification process and use trusted server results. A client-supplied label such as “safe wallet” is not a substitute for retrieving the intended observation and verifying that association.

Do not promise to identify every farm by one shared trait. Device relationships can be missing, ambiguous or legitimate. The review question is whether the combined evidence supports the campaign’s participation policy, not whether a graph happens to contain an edge.

Separate cohort discovery from eligibility decisions

A cluster is a group connected by a specified relationship. It should retain the reason for each edge and its observation window. A “funding cluster” and “same observed device” cluster are not interchangeable descriptions.

Use clustering to prioritize inspection. Then determine which members, if any, lack eligibility. Avoid applying a conclusion about one wallet to every transitively connected address without checking how the relationships were formed. Large hubs can join otherwise unrelated participants into an unhelpful giant component.

An assisted service can be useful when a team needs that interpretation. Human Passport Data Services describes batch classification, wallet clustering, low-activity handling and analyst review. Its published 0.05-US-dollar per-address price is a batch-analysis unit, not the cost of a live device identification.

Review before issuing irreversible allocations

A practical sequence is:

1. Version the eligible cohort and the campaign rule.
2. Analyze wallet history and relationship evidence.
3. Join verified live observations where they were collected.
4. Separate straightforward eligible, disputed and unresolved cases.
5. Request proportionate additional verification for ambiguous cases.
6. Resolve corrections before the final allowlist or allocation becomes binding.
7. Enforce the approved result at redemption, including direct calls and duplicates.

Do not silently change the cutoff during an appeal. Preserve which version of the evidence and policy produced the original decision, then record the reason for any correction. The new-user evaluation guide covers independent labels and review outcomes.

Budget for the complete campaign

A wallet analysis bill may count addresses. Live device products may count identifications or API calls. Credential schemes can add participant verification, sponsorship or support requirements. Review time and engineering belong in the budget too.

ShieldLabs includes 5,000 free identifications, allowing a team to evaluate supported new visits. It cannot reconstruct last season’s browser traffic from an address list. Use retrospective wallet analysis for that dataset and collect the missing evidence prospectively where justified.

See the comparison, evaluation routes and claim-integration guide before selecting a pilot. Confirm the required chains, features and production volume for each shortlisted product.

FAQ

Sources and further reading

Read October 21, 2026: Trusta Sybil Score API, Nomis Analytics for Airdrops, Human Passport Data Services, ShieldLabs Sybil solution and ShieldLabs pricing.