How sybil farming works on Solana

A sybil farm is a set of wallets built to look like independent users while actually being controlled, or at least coordinated, by one operator. The goal is almost always the same: multiply an allocation — an airdrop, a whitelist spot, a claim — by pretending to be many people instead of one.

On Solana, building a farm is cheap. Wallet creation costs almost nothing, and a script can generate hundreds of keypairs in seconds. The hard part for an operator isn't creating the wallets — it's making them behave differently enough that they don't get grouped together later.

The funding problem

Every wallet in a farm needs SOL to pay fees before it can do anything else. Funding dozens or hundreds of wallets one at a time, from a single source, in a short window, is one of the clearest tells a farm produces. Operators who know this will stagger transfers, route through intermediate wallets, or fund in smaller batches — but the underlying pattern, a shared funder and a compressed time window, is difficult to fully hide.

The execution problem

Even careful operators tend to reuse tooling. A script that pays gas from the same fee-payer wallet, or submits the same sequence of transaction types, sources, and programs across its earliest transactions, will leave that fingerprint across every wallet it touches. Two wallets that transact identically down to that sequence rarely arrived there independently.

Why one signal isn't enough

Shared funding alone isn't proof of coordination — plenty of legitimate users fund new wallets from the same exchange. The signal becomes meaningful when it lines up with other independent evidence: a matching execution fingerprint, a shared history of being flagged in an earlier investigation, or timing that repeats too precisely to be coincidence. Farms get caught not by any single signal, but by several independent ones agreeing at once.