An unknown individual generated 21,877 Sybil wallets, a token and even launched a DEX just to fake on-chain activity.

An individual has made a whole ecosystem with its own token, wallets, and even launched a decentralized exchange (DEX) just to fake on-chain activity.

🚨Warning: 21877 sybil wallets by one person #zkSync Let's disclosure this individuals sybil tactics, he funded all of his wallets with very small amounts of ether, then he deployed Gemstone ( $GEM ) token that wasn't open source. (https://t.co/UXS2O2fivg) ++ pic.twitter.com/firJbfcdfL

— Lingland 09. ∎ (@lingland09) September 10, 2023

You might also like: Fake LayerZero airdrop drains victims’ wallets

According to a DeFi analyst @lingland09, the individual funded 21,877 Sybil wallets with very small amounts of ether (ETH) and then deployed a smart contract for a token dubbed gemstone (GEM). Later, the coder developed a personal non-open sourced DEX “just for indirectly applying transactions between his wallets,” @lingland09 explained.

Fake on-chain activity with GEM tokens done by the coder through a personal DEX | Source: X

Once the exchange was up and running, the individual added liquidity to GEM tokens with 80 ETH to make the artificial token valuable.

“Then he swapped $gem tokens that he claimed from 21877 wallets at gem/eth pair and gained 0.6-0.7 eth value of profit.”

@lingland09

To automate the whole process, the coder made a trading bot, generating ten transactions with $10,000 in volume on zkSync Era network. Although the reason behind the activity remains unclear, @lingland09 suggests the coder is a “professional airdrop hunter” who might be faking activity on the zkSync Era network to prepare for a possible airdrop.

In March 2023, crypto.news reported that Arbitrum’s airdrop for its governance token, ARB, faced significant Sybil activity, exacerbated by what experts call “ineffective” detection rules. A crypto security researcher, X-explore, found that Arbitrum’s Sybil detection rules had flaws, exploited by almost 280,000 same-person and over 148,000 Sybil airdrop addresses.

Read more: Scammers hijack Aptos Network Twitter to promote fake APT airdrop