Approximately 40% of the TIA tokens distributed in Celestia’s airdrop were claimed by hunters, researchers from X-explore found.
We explore the Sybil Group in the Celestia Airdrop after claiming. We found 20.1% of addresses are controlled by
large scale sybil groups and 20.7% of addresses are controlled by normal sybil groups.
Detail in our Mirror: https://t.co/9UDUkR9XbO pic.twitter.com/jN1mi5VdLM— X-explore (@x_explore_eth) November 2, 2023
The token distribution was timed to the launch of the mainnet named Lemon Mint, which took place on October 31.
In total, 138,981 addresses claimed TIA out of 191,391 eligible. The declared distribution volume amounted to 44.4 million tokens — 74% of the planned 60 million TIA.
However, the number of wallets that carried out the so-called Sybil attack on the airdrop was nearly equal to the number of ordinary participants, the experts stressed.
They identified several hunter categories, classifying them by the addresses they controlled. The largest share, 17.05 million TIA (38.2% of the total mined), went to 51,494 hunter wallets that were not part of umbrella groups.
Large-scale groups, each concentrating more than 20 addresses, accounted for 5.22 million TIA (20.1%). Other categories of airdrop hunters received roughly the same amount of assets.
The researchers noted that the project team failed to effectively filter attacker addresses from the airdrop, despite their distinctive features.
The most effective hunter group owned a total of 300 wallets and received 77,391 TIA. The coins were transferred in uniform transactions of 258 tokens, which analysts say were hard to miss.
They noted that overall the attacking groups drove an on-chain activity spike in the early stage through large-scale operations. By the fourth block, the number of transactions reached 149, of which 101 were linked to hunter activity.
«This happened long before the spike in trading after the opening of deposits on exchanges like Binance, вроде Binance, roughly 95 blocks later,» the experts noted.
A certain sybil group was the first user to do large-scale transactions on Celestia. Their txs happened on block 4 before many CEXs support deposits. This indicates that some sybil groups have advanced technical skills. pic.twitter.com/9QKVhYK1zM
— X-explore (@x_explore_eth) November 2, 2023
In their view, substantial activity before the TIA listing on centralized platforms, as well as a number of other signs, indicates that drop hunters possess ‘advanced technical skills’.
Back in September, the Connext Network airdrop was subjected to a Sybil attack.