Blog

Technical posts on detection methodology + public retros on completed airdrops.

Unpublished drafts are in /content/blog in the repo.

• Calibrating presets against 600 real wallets — and why we found a 66% false-positive rate before we shipped

  2026-05-26

  Pre-pilot retro on 200 confessed sybils + 200 sybil-list addresses + 200 confirmed governance voters. Initial airdrop preset hit 100% recall — and 66% FP rate from CEX-funding clusters. After 5–10× cluster threshold bump: 100% recall, 0% FP. Real numbers, real fix, real source.

• Trained on 1000 real wallets: what we learned

  2026-05-25

  v0.5.0 ships the first real-Alchemy training corpus + on-chain governance-voters as a new genuine source (170 → 1,669, 10x). Adversarial recall went 0.0 → 1.0. Honest holdout limits explained.

• Replicating Linea's filter: 478K agreement, 45K candidates they missed

  2026-05-26

  Public retro-analysis of the Linea airdrop filter results. Aggregate-only. We agree with Linea on 478K addresses, disagree on 39K, and identified 45K candidates their filter missed.

• Why 30 seconds is the tell: detecting scripted wallets via inter-tx timing

  // DRAFT

  Real users transact at irregular, human-paced intervals. Sybil farms running shell scripts produce inter-tx gaps with characteristically low variance and high lag-1 autocorrelation. Here's why.

• Why training on Trusta's labels is a trap

  // DRAFT

  Every public Sybil list is itself an output of a detector. If you train on those, you inherit their false positives. We use a tiered confidence system to avoid this.

• Designing the appeals protocol

  // DRAFT

  After LayerZero published their Sybil list, thousands of users complained. We built the appeal flow into the product from day one — here's the spec.