Connext Sybil Hunter Bounty: Exposing Cross-Chain Farming Networks

Case study header image for Connext Sybil Hunter Bounty by Stakeridoo.

Connext Sybil Hunter Bounty: Exposing Cross-Chain Farming Networks

Introduction

In August 2023, Connext (now Everclear) launched a community-driven Sybil filtering program to protect its NEXT token airdrop from coordinated farming.

Stakeridoo joined the hunt, deploying a proprietary blend of graph analytics, cross-chain flow tracing, and behavioral pattern analysis — refined through years of hands-on Sybil investigations. Without revealing every detail of our process, we combined large-scale data analytics with targeted heuristics to uncover wallet clusters that automated filtering systems might miss.

The result: Over 30 submitted clusters totaling 950+ addresses — directly safeguarding legitimate user rewards.

Background

Connext (now Everclear) ran an airdrop with a Sybil Hunter Program to ensure allocations stayed fair. “Sybil farms” involve actors creating or controlling several or even hundreds of wallets to claim an unfair share of the rewards. To counter this, Connext incentivized the community with bounty rewards for verified reports of Sybil clusters.

Between August 24 and September 1, 2023, participants submitted evidence of suspicious wallet activity. Successful reports received 25% of recovered NEXT tokens, with the first half paid at claim opening on September 5, 2023, and the remainder vesting over 24 months.

📄 Official Connext announcement:

Methodology

To maximize detection precision while avoiding false positives, we implemented a multi-stage investigation pipeline designed specifically for Sybil detection in airdrops and bounty programs.

Key elements:

Preprocessing & Data Hygiene – Filtering out smart contracts, known infrastructure addresses, and previously cleared accounts to reduce noise.
Targeted Data Collection – Extracting large-scale on-chain datasets via custom SQL queries across multiple chains.
Multi-chain Network Graph Analysis – Uncovering wallet relationships through transaction link mapping.
Asset Movement Tracing – Detecting coordination patterns in token flows across and within chains.
Heuristic Pattern Analysis – Applying Stakeridoo’s proprietary clustering logic to highlight behavioral similarities that suggest coordinated control.
Iterative Review & Parameter Tuning – Manually inspecting edge cases to confirm findings and refine thresholds.

📊 Process Overview: Public GitHub repository for this bounty → github.com/Stakeridoo/Connext

Findings

Our investigation uncovered dozens of coordinated wallet clusters targeting the Connext airdrop. These clusters ranged from small, tightly linked groups to large-scale networks involving hundreds of addresses.

Key highlights:

950+ newly reported addresses — roughly 17% of all addresses ultimately excluded from the airdrop.
Largest single cluster exceeded 200 linked wallets, exhibiting synchronized cross-chain activity.
Many groups demonstrated repeatable transaction flows and mirrored activity patterns indicative of coordinated control.

Outcome

In total, 5,725 Sybil addresses were removed from the eligibility list of 62,070 addresses — recovering over 5.9M NEXT tokens. Of these, 1.44M NEXT (25%) were redistributed to participating hunters, with 50% subject to a two-year vesting schedule.

Measured impact:

Prevented an estimated five-figure USD equivalent in illegitimate reward claims.
Directly improved airdrop integrity, ensuring fairer distribution to genuine community members.

Stakeridoo’s results:

4th place out of 48 participating hunters
7.7% of total bounty payout

Our work directly improved the integrity of the Connext token distribution by intercepting large coordinated farms before rewards were claimed.

📄 Connext program wrap-up: Connext Forum – Sybil Hunter Results & Insights

Strategic Takeaway

This case underscores that advanced multi-chain Sybil detection is not just about running algorithms — it requires combining automated analysis with human judgment, domain expertise, and iterative refinement. The same approach can be adapted for high-stakes events such as grants, governance votes, and reward programs.

For deeper insights into the program’s strengths, challenges, and recommendations for future iterations, read our Opinion: Reflections on the Connext Sybil Hunter Bounty.

Call to Action

Don’t let coordinated farms drain your token allocation.
📧 Contact us at info@stakeridoo.ch — we’ll review your case and design a tailored investigation plan.