loader
banner
Analysis header image showing a magnifying glass over a bar chart, representing on-chain data verification of 19,891 zkSync wallets.

Analysis: 19,891 Wallets on zkSync – Data Verification in Action

How curiosity, precise filtering, and data tools revealed the verified size of a massive wallet farm.

Introduction

When Ling’s viral Twitter thread revealed an extreme airdrop farmer on zkSync with over 21,000 wallets, the number was quickly repeated across media and the community — often without deeper verification.

In blockchain forensics, accuracy matters. My objective wasn’t to echo the claim, but to validate it with precise, on-chain data.

This analysis details how, within just over an hour, I verified the claim count, cleaned the data, and published a precise dataset for the community.

Background

Screenshot of Ling’s original zkSync Sybil hunter thread.

On September 10, 2023, Ling published a detailed thread showing how a single actor:

  • Funded thousands of wallets with small ETH amounts

  • Created a closed-source token ($GEM)

  • Built a private DEX to simulate activity between wallets

  • Claimed rewards across more than 21,000 wallets

While the post spread quickly, my focus was to validate the figure through precise on-chain analysis.

Motivation

The driver was clear: curiosity and the pursuit of accurate data.

  • What exactly was the size of the whitelisted wallet cluster?

  • Could the claim count be confirmed from on-chain data?

  • How many addresses were failed attempts, bots, or simply not whitelisted?

Methodology

SQL query filtering zkSync Sybil wallets using $GEM token data.

Choosing the data source

At the time, only Zettablock offered a queryable on-chain data warehouse for zkSync.

Building the filter
I wrote a SQL query targeting the $GEM token contract, filtering for:

  • Successful claims

  • Transfers >0.1 GEM (removing failed/non-whitelisted claims)

  • Only from the whitelisted addresses

Execution speed
From seeing the tweet to having the dataset ready: less than 1 hour of work.
Dataset published to GitHub within 17 hours of Ling’s thread.

Findings

CSV file listing 19,891 zkSync Sybil wallets.

  • Ling’s original claim: 21,877 wallets

  • Verified count: 19,891 legitimate claimer addresses

📊 Data made publicly available here: GitHub link

Outcome

The dataset allowed anyone to:

  • Analyze the cluster in depth

  • Build visualizations of funding flows

  • Compare behavioral patterns across wallets

While the number difference might seem small (~2,000 wallets), it highlighted an important point: precise filtering matters.

Key Takeaway

Speed is important in blockchain investigations — but accuracy is what gives the work lasting value.
A viral number can be exciting, but a verified dataset is what enables deeper analysis, collaboration, and better detection models.