Solana Sybil Detection
Group coordinated wallets into evidence-backed clusters before you distribute — with independent signal families, per-wallet confidence, human review built in, and precision tracking against confirmed outcomes.
A single weak signal is never sybil proof. Plenty of legitimate users share an exchange funder or reuse a popular fee payer. A cluster only reaches high confidence when independent signal families agree after known-entity discounting — and every member carries its own evidence so a reviewer can disagree with the machine.
Illustrative example — mock cluster, addresses, and confidence values.
Four steps from wallet list to evidence-backed clusters
VikingIntel takes a list of wallets and returns grouped, scored, evidence-traced clusters — typically in minutes, not days.
Screen a claimant snapshot
Submit the wallet list you are about to pay. VikingIntel resolves each wallet's funder, derives detection signals from its earliest transactions, and clusters the ones that look scripted rather than organic.
Ad-hoc triage any address list
Paste up to 25 addresses for a quick screen, or run bulk triage (Pro) to rank a large list by how quickly its wallets converge on exchanges after receiving funds.
Review clusters, not vibes
Every cluster ships with member lists, shared-funder and behavioral evidence, and per-cluster confidence. Human reviewers record approve/reject decisions that become permanent review history.
Calibrate against outcomes
When distributions actually pay out, VikingIntel records which flagged wallets got funded anyway. When outcome observations are recorded, precision and recall can be measured against those confirmed outcomes.
Independent families, not one heuristic
Multiple signals from the same family count once. A cluster reaches high confidence only when independent families agree after known-entity discounting. The Funding Lineage family catches the most common pattern directly: a funding fan-out, where one wallet funds dozens of others in a compressed window before any of them touch the airdrop contract.
- Shared funder
- Funding burst
- Wallet age batch
- Shared fee payer
- Matching tx-type/source/program sequence
- Timing synchronization
- Coordinated buy timing
- Coordinated exit timing
- Shared rare-token history
- Flagged as a farm wallet in an earlier investigation
Signals that repeat within one execution fingerprint collapse into a single family — VikingIntel doesn't simply add every raw heuristic together.
How cluster confidence is scored
Confidence is not a single model output — it is a composed score derived from which signal families fired, how many independent families agree, and whether known entities have been discounted. The formula is transparent and auditable.
Family-weighted composition
Each signal family (shared funder, execution fingerprint, timing sync, funding burst, trade coordination) produces an independent strength score. Signal weights reflect the current detection model — calibrated by developer expertise against known fraud patterns. Scores from different families compose with a single-signal cap, not additively, so one strong signal alone can never push a cluster to high confidence.
Known-entity discounting
Before scoring, verified exchange hot wallets and bridge contracts are stripped from the signal graph. If two wallets both withdrew from Binance on the same day, that shared funder link is discounted — not ignored, but weighted down. This reduces false positives from exchange clustering.
Two-family minimum gate
A cluster cannot reach “high” confidence unless at least two independent signal families agree. One signal family, no matter how strong, caps the score below “high.” This prevents the most common false-positive pattern: two unrelated users who happen to share the same exchange funder.
Outcome calibration
When distributions pay out, VikingIntel records which flagged wallets received funds. Where outcome observations exist, that data feeds into precision and recall metrics, giving you measurable accuracy per snapshot. Calibration tooling measures performance against confirmed outcomes so operators can evaluate future weight changes — never applied automatically.
41 of 41 wallets funded from a single source within a 6-minute window.
Shared fee payer and a matching tx-type / source / program sequence across 37 of 41 wallets.
35 of 41 wallets previously flagged as farm wallets in an earlier investigation.
The address set is likely operated by a single actor — awaiting human confirmation.
Capabilities
Multi-signal clustering
Wallets link via independent signal families — shared funder, shared fee payer, matching execution fingerprint, funding bursts, timing sync, trade coordination — merged by union-find with confidence composed from the signals that fired.
Per-member evidence
Each member carries its own evidence pointers: the signatures behind every signal, the exact fee-payer overlaps, the timing deltas. Reviewers decide wallet-by-wallet, not cluster-by-blanket.
Known-entity discounting
Verified exchange hot wallets and bridges are excluded from linkage so unrelated users who merely withdrew from the same CEX never merge into one cluster.
Bulk triage (Pro)
Paste a large address list — a heist's cashout wallets, a suspicious distribution — and get it ranked by exchange proximity with per-address hit detail.
Decision & calibration loop
Approve or reject clusters as an analyst; when the airdrop pays out, outcome observations record who was actually funded. Analyst decisions become part of the calibration dataset, allowing operators to measure precision and recall against confirmed outcomes.
Exportable reports
Snapshot results generate versioned reports with the full evidence ladder — suitable for sharing with a team or attaching to a gating decision.
What makes this different from other sybil tools
Most sybil detection tools give you a list and a score. VikingIntel gives you evidence you can audit, clusters you can review, and precision numbers measured against confirmed outcomes when available.
Evidence, not accusation
Every cluster ships with per-member evidence: the exact signatures behind every signal, the fee-payer overlaps, the timing deltas. A reviewer can trace a flag back to the raw on-chain data — no black box, no "trust the model."
Built for human review
The UI is designed for analysts, not dashboards. Review clusters one at a time, approve or reject each with a decision that becomes permanent audit history. Human judgment is the final gate — VikingIntel provides the evidence to make it well-informed.
Calibrated against reality
When outcome observations are recorded, VikingIntel can measure precision and recall against those confirmed outcomes. Results are reported per dataset rather than presented as a universal accuracy claim.
No identity data required
Detection runs on on-chain evidence alone. No KYC, no email addresses, no phone numbers. You can screen wallets you know nothing about — because the clustering comes from what they did on-chain, not who they told you they are.
One layer, not the whole stack
Detection is one of several sybil deterrents protocols run — usually together, not instead of each other.
KYC / identity
Phone, credit card, or ID checks at signup. Raises the cost of making a wallet, but adds friction for every legitimate user too.
Staking requirements
Locking collateral to participate. Deters casual farming but does nothing against a well-funded operator running hundreds of wallets.
Tiered / diminishing rewards
Structuring payouts so ten small wallets earn less than one wallet with equivalent activity. Reduces the payoff, doesn’t stop the behavior.
Detection (this)
Finds coordinated wallets after the fact, from on-chain evidence alone — no identity data required, and it runs on activity that already happened.
Most protocols run detection alongside one or two of the others — identity checks stop some farmers before they start, detection catches the rest from what they actually did on-chain.
Measured precision, not just claims.
VikingIntel tracks detection quality against real payout outcomes — not synthetic benchmarks.
When outcome observations are recorded, each snapshot screen can report precision against funded sybil wallets — you see measured accuracy numbers for your distribution when ground truth data is available.
Exchange and bridge hot wallets are discounted before scoring, reducing false positives from shared-exchange-funder patterns.
Two independent signal families must agree before a cluster reaches high confidence — no single weak signal is ever sybil proof.
Common questions
How is this different from just checking if wallets share a funder?
Shared-funder detection is one signal family — and on its own, it produces too many false positives. Two unrelated users who withdrew from the same Binance hot wallet "share a funder" but aren't coordinated. VikingIntel discounts known entities and requires multiple independent signal families to agree before flagging a cluster.
Do I need KYC or identity data to run detection?
No. Detection runs entirely on on-chain evidence — transaction signatures, fee payers, funding patterns, timing, and trade sequences. You can screen wallets you know nothing about, which is exactly the scenario where sybil detection matters most.
What happens if I disagree with a cluster?
Every cluster carries per-member evidence so you can evaluate wallet-by-wallet. If a cluster looks wrong, you reject it — the decision is recorded as permanent review history and becomes part of the calibration dataset, allowing operators to measure false positives and evaluate future model changes.
How fast does it run?
Quick Screen (up to 25 addresses) usually returns results in about a minute. Bulk snapshots depend on list size and RPC load, but typical production runs finish in single-digit minutes. The engine derives its investigation signals from Solana RPC data rather than relying on a third-party attribution database.
Can I export results?
Yes. Every snapshot generates a versioned report with the full evidence ladder — cluster membership, per-member signals, confidence scores, and review decisions. Reports are suitable for sharing with a team, presenting to a DAO, or attaching to a gating decision.
What false-positive rate should I expect?
When outcome observations are recorded, VikingIntel reports measured precision for every snapshot rather than quoting a blanket number. Entity-aware discounting (removing shared-exchange-funder noise) is the main driver of accuracy. Every snapshot includes per-member evidence so you can evaluate and reject false positives individually.
Screening a distribution soon?
Run a real snapshot through the sybil engine — free accounts include Quick Screen, up to 25 addresses at a time within your daily investigation quota.
No credit card required · Free forever