Sybil Detection
Group coordinated wallets into evidence-backed clusters before you distribute — with independent signal families, per-wallet confidence, human review built in, and precision tracking against real payout outcomes.
A single weak signal is never sybil proof. Plenty of legitimate users share an exchange funder or reuse a popular fee payer. A cluster only reaches high confidence when independent signal families agree after known-entity discounting — and every member carries its own evidence so a reviewer can disagree with the machine.
Illustrative example — mock cluster, addresses, and confidence values.
A standalone workflow — "screen, review, calibrate"
Sybil Detection is not a checkbox inside another tool. It is a complete detection workflow with its own screening surfaces, its own review loop, and its own measured track record.
Screen a claimant snapshot
Submit the wallet list you are about to pay. VikingIntel resolves each wallet's funder, derives detection signals from its earliest transactions, and clusters the ones that look scripted rather than organic.
Ad-hoc triage any address list
Paste up to 25 addresses for a quick screen, or run bulk triage (Pro) to rank a large list by how quickly its wallets converge on exchanges after receiving funds.
Review clusters, not vibes
Every cluster ships with member lists, shared-funder and behavioral evidence, and per-cluster confidence. Human reviewers record approve/reject decisions that become permanent review history.
Calibrate against outcomes
When distributions actually pay out, VikingIntel records which flagged wallets got funded anyway. Precision and recall are tracked against those outcomes over time.
Independent families, not one heuristic
Multiple signals from the same family count once. A cluster reaches high confidence only when independent families agree after known-entity discounting.
- Shared funder
- Funding burst
- Wallet age batch
- Shared fee payer
- Matching tx-type/source/program sequence
- Timing synchronization
- Coordinated buy timing
- Coordinated exit timing
- Shared rare-token history
- Flagged as a farm wallet in an earlier investigation
Signals that repeat within one execution fingerprint collapse into a single family — VikingIntel doesn't simply add every raw heuristic together.
Capabilities
Multi-signal clustering
Wallets link via independent signal families — shared funder, shared fee payer, matching execution fingerprint, funding bursts, timing sync, trade coordination — merged by union-find with confidence composed from the signals that fired.
Per-member evidence
Each member carries its own evidence pointers: the signatures behind every signal, the exact fee-payer overlaps, the timing deltas. Reviewers decide wallet-by-wallet, not cluster-by-blanket.
Known-entity discounting
Verified exchange hot wallets and bridges are excluded from linkage so unrelated users who merely withdrew from the same CEX never merge into one cluster.
Bulk triage (Pro)
Paste a large address list — a heist's cashout wallets, a suspicious distribution — and get it ranked by exchange proximity with per-address hit detail.
Decision & calibration loop
Approve or reject clusters as an analyst; when the airdrop pays out, outcome observations record who was actually funded. Precision and recall are calibrated from real decisions.
Exportable reports
Snapshot results generate versioned reports with the full evidence ladder — suitable for sharing with a team or attaching to a gating decision.
Confidence you can audit
Cluster confidence is composed from the specific signals that fired — and the evidence ladder shows exactly which ones, at what strength, for whom.
41 of 41 wallets funded from a single source within a 6-minute window.
Shared fee payer and a matching tx-type / source / program sequence across 37 of 41 wallets.
35 of 41 wallets previously flagged as farm wallets in an earlier investigation.
The address set is likely operated by a single actor — awaiting human confirmation.
Screening a distribution soon?
Run a real snapshot through the sybil engine — free accounts include Quick Screen, up to 25 addresses at a time within your daily investigation quota.