LayerZero filtered out 803,093 wallets — 38% of its entire snapshot — from a single airdrop. Linea filtered roughly 40% of its claimants. The tools projects use to catch farmers have gotten genuinely sophisticated, and the tools farmers use to evade them have escalated right alongside. The question worth actually answering isn't who's winning that arms race — it's whether an ordinary person's time is still well spent farming at all.
How big the filtering operations have actually gotten
The numbers here are larger than most people realize. LayerZero's June 2024 ZRO airdrop remains the largest documented Sybil filtering operation in crypto history: out of an initial snapshot of roughly 2.08 million wallets, the project filtered 803,093 of them — about 38% — before distributing over $700 million in tokens to the 1.28 million wallets that survived review. Linea ran a comparable filter on its own airdrop, removing approximately 517,000 of 1.3 million eligible addresses, also close to 40%. These aren't edge cases anymore. Filtering a third to nearly half of all claimants has become close to standard practice for any airdrop large enough to attract serious farming activity.
How projects are actually catching farmed wallets
The detection methods have moved well past simple heuristics. Modern Sybil detection typically looks at several signals together rather than any single red flag:
- Funding source clustering — multiple wallets receiving funds from the same originating address or exchange account in a short window
- Behavioral pattern matching — wallets executing the same swaps, in the same order, on the same protocols, within similar timeframes
- Wallet graph analysis — mapping the web of connections between addresses to identify clusters controlled by one entity
- IP and device fingerprinting — correlating wallets that consistently connect from the same network infrastructure
- Shallow-history flags — wallets with no organic on-chain activity outside the specific protocol being farmed
LayerZero's process is worth understanding as a case study in how far this has evolved: alongside its own internal analytics and third-party firms like Nansen and Chaos Labs, it ran a public bounty program letting community members submit evidence of wallet clusters for a share of the recovered tokens, plus a self-report program that offered farmers who voluntarily identified themselves a reduced allocation rather than nothing at all if caught later. That's a genuinely clever incentive structure — it turns detection into something the community actively participates in, and it gives farmers a rational reason to come forward rather than risk getting caught with nothing.
Real cases of large-scale abuse, and what they show
A few documented incidents illustrate what's actually happening at the extreme end. Around 100 freshly funded wallets claimed roughly 9.8 million MYX tokens — worth about $170 million at the time — in near-simultaneous transactions during the MYX Finance airdrop. Avantis saw more than 300 addresses, all controlled by a single entity, pocket an estimated $4 million using the same basic playbook: dormant wallets, funding from one exchange, a coordinated claim, then pooling and cashing out. IRYS was hit by a cluster of 900 nearly identical wallets, funded a single day before launch, that captured about 20% of the entire drop and sold roughly $4 million worth of tokens almost immediately. As long as a successful run like that can be worth millions of dollars and the tooling to attempt one keeps getting cheaper, organized farming operations aren't going away regardless of how good detection gets.
The part that should actually worry honest users
Here's the genuinely uncomfortable part of this arms race: the same signals that catch farmers can also catch real people. If you fund several of your own legitimate wallets from one exchange account within a short window, or use a handful of protocols in a similar sequence to everyone else because that's simply the common, obvious way to use them, clustering algorithms can flag you right alongside the professional farms. Being a genuine user is a real defense against most scrutiny, but it isn't automatic immunity — which is a meaningful cost of this arms race that mostly falls on ordinary people rather than the sophisticated operations with dedicated infrastructure built specifically to avoid exactly this kind of overlap.
So — is farming still worth it?
The consensus that's emerged across people actually studying this, separate from anyone selling evasion tools, is fairly consistent: yes, but the winning strategy has genuinely changed. Deep, organic activity concentrated on a small number of wallets now outperforms shallow activity spread thin across many — precisely the opposite of the "run 50 wallets, do the bare minimum on each" approach that worked in earlier cycles. Projects have gotten better at rewarding wallets that look like real long-term users: varied interaction patterns over time, genuine transaction history outside the specific protocol being farmed, and consistency rather than a single concentrated burst of activity right before a snapshot.
Put plainly: the version of airdrop farming that's dying is mass, low-effort, spray-and-pray wallet creation. The version that's arguably become more valuable, not less, is simply being an early, genuine user of a protocol you'd have reason to use anyway — which was always the actual intent behind rewarding early adopters in the first place, before the practice got industrialized into something closer to an assembly line.
My honest take
If your plan involves dozens of wallets, scripted timing, and tools built to spoof your digital fingerprint, I think the arms race genuinely has made that specific approach a worse bet than it used to be — filter rates in the 80–100% range for farms using shared infrastructure aren't uncommon anymore, and the tooling required to avoid that keeps getting more expensive and technical to maintain. If your plan is closer to "use a handful of promising protocols the way you'd actually want to use them, consistently, over months," I don't think anything about this arms race has made that less worthwhile — if anything, it's the exact behavior projects are now actively trying to identify and reward over the alternative.
This piece is informational, not financial advice. Airdrop eligibility, filtering methods, and outcomes vary by project and change constantly — there are no guarantees any specific approach results in an allocation. I hold no undisclosed positions in the projects mentioned beyond what I've stated elsewhere on this site.