Between September and November 2025, three well-funded crypto projects lost a combined $174M+ to sybil attacks. MYX Finance, Apriori and IRYS each watched freshly created wallets claim large shares of their token distributions, and none had adequate reputation filtering in place.
For any team planning an airdrop or token launch, the pattern matters more than the individual losses. The same playbook worked three times in a row.
One playbook, three launches
Each attack followed the same steps:
- Create wallets
- Fund them just before launch
- Claim tokens
- Dump immediately
The wallets had little or no history. What they had was timing, and in at least one case, apparent advance knowledge of when claims would open.
MYX Finance: $170M to 100 wallets
In September 2025, onchain analytics firm Bubblemaps traced 100 freshly funded wallets that collectively captured $170M worth of MYX, equal to 1% of supply. All of them were created on the same day and funded through OKX. None had any prior activity.
Bubblemaps called it “the biggest airdrop sybil of all time.”
- Sybil wallets: 100
- Tokens captured: $170M (1% of supply)
- Funding source: OKX, same day
- Prior activity: zero
Apriori: 80% captured before the announcement
In October 2025, 5,800 interconnected wallets, funded by just 13 source addresses, claimed 80% of all tokens Apriori distributed on BNB Chain. The wallets were funded days before Apriori publicly announced BNB Chain claims, which raises the question of insider knowledge.
The token went on to fall 61% from its all-time high.
- Sybil wallets: 5,800
- Share of BNB Chain distribution captured: 80%
- Funding sources: 13 wallets
- Token crash: -61% from ATH
IRYS: 900 bots, $4M gone in hours
In November 2025, Bubblemaps identified 900 newly created wallets that collectively captured 20% of the entire IRYS airdrop. Within hours, 500 of those wallets had sent $4M in IRYS tokens back to Bitget for immediate sale. The price dropped 16% in 24 hours.
- Sybil wallets: 900
- Airdrop captured: 20%
- Dumped to Bitget: $4M in hours
- Price impact: -16% in 24 hours
Why fresh wallets are easy to spot
What these wallets lacked was reputation. A sybil wallet on Ethos starts at a score of about 1200, the Neutral level. It has no vouch history, no reviews and no attestations, and one API call shows that.
According to Ethos, a project that set a minimum score of 1400 before allowing claims would have caught every one of the 5,800 Apriori bot wallets before they claimed a single token.
What a project can use
Ethos lists four pieces a team can add to a launch:
- Credibility scoring: scores from 0 to 2800, returned with one API call
- Sybil resistance by design: ETH staking, invitation bonding and review weighting make scores harder to fake
- Human Verification: live alongside the score
- Threshold filtering: set a minimum score, such as 1400, before a wallet can claim
Score-gating is automated, and the integration is free. The API doesn’t require a key.
The takeaway for launch teams
In all three cases, the damage happened within hours of claims opening, and the wallets responsible had no track record to speak of. A check for history before a wallet can claim targets that weakness, and it has to be in place before launch day.
This article is adapted from the Ethos case study.
