sybil

HOW IT STARTED
We launched Last Pixel: a social experiment shaped as a survival game.
The rules are simple. A canvas of one million squares, one per person. Claim a
square, then confirm you are still there before your window closes — 24 hours at
the start, one minute at the end. Miss once and your square is dark forever.
Whoever is still confirming after everyone else has quit takes the pool — a
full canvas puts a million dollars in it.
No skill. No strategy. No luck. Pure stubbornness.
Remember that. Everything below turns on it.
HOW WE RAN THE AIRDROP
An empty canvas attracts nobody, so to seed it we set aside 10,000 free squares.
Finish a short quest, get a square, pay nothing.
We announced it in one of the largest airdrop communities: two million followers
on Telegram and 1.6 million on X. The post cost $449.
It went out at 13:42.
HOW WE CAUGHT THEM
What looked wrong first was not the volume. It was how even it was. The squares
were going out too smoothly for a crowd of real people.

We grouped accounts by the referral link that brought them in. Ten links ran far
ahead of everything else. This is how many each one brought:
300 300 300 300 299 299 298 298 298 297

Ten people do not accidentally invite 300, 300, 300, 299, 299, 298. That is not
statistics. That is a config file.
Then we looked at the accounts themselves. Their Telegram IDs all sit between
1.3 and 2.0 billion — registrations from 2020 and 2021, not one recent among
them. Not new users. Aged stock, bought in bulk.
Then we checked the clock.
The post went out at 13:42. The first of the ten distributor accounts appeared
at 17:38, the tenth at 18:25 — three of them within two seconds of each other.
At 19:01 the flood began.
They read the post, spent four hours building the rig, and pointed it at us the
same evening.
THE OTHER SIGNALS
The quest had one optional task: join our Discord. It gave nothing and counted
for nothing — we marked it optional because it is the heaviest step with the
smallest return.
It was completed by 5,439 out of 5,439.
Real people never hit a hundred percent. Not on the mandatory steps, and
certainly not on the one with no reward.
And the median time from registration to holding a square: 48 seconds. No human
joins a channel, waits for the membership check, reads a quiz question and
answers it inside a minute.
THE RISK IN EVERY TELEGRAM AIRDROP
Here is what is worth knowing if you hand out tokens.
The post you pay for is an announcement to your audience and a tip-off to a farm
operator at the same time. He reads those channels precisely because that is
where giveaways get published. Assume he is on your recipient list before you
have even clicked "pay."
A captcha will not save you. Cloudflare Turnstile stood in front of registration
the whole time and was solved twelve thousand times. That is not a complaint
about Cloudflare: solving costs about a dollar per thousand, and every captcha
goes the same way regardless of whose it is. As an anti-bot defense, the captcha
is finished.
FIGHTING THE FARM
Once it was clear the airdrop had failed, we did two things in a row.
First we cut the giveaway from 10,000 to 6,000 and stopped it.

Then we logged everyone out. Every session, every cookie, all at once. To
confirm your window you now had to sign in through Telegram again.
The reasoning was narrow. They had automated registration completely — twelve
thousand accounts proved it. But re-authentication is a different code path, and
scripts built for signup runs usually do not have it: after registering they keep
the cookie and reuse it forever.
We were betting on the gap between "can create an account" and "can create an
account twice."
We deleted nobody. We asked everyone to log in again.
THEY DID NOT COME BACK
The window closed at 23:48 UTC.
By then all 6,000 squares we had given away were dark. The first 5,439 went out
before the logout, on their own: they simply never came back to confirm their
first window. The last 553 went dark after it. Not one of those accounts signed back in.
The script could pass a captcha twelve thousand times. Answer the quiz. Join the
channel. Tick the optional box. Attach a fresh wallet. Confirm on schedule for
two days straight.
It could not sign in a second time.
That is the whole defense. Not a smarter captcha. Not machine learning. Not a
fraud score. A logout button.
It cost us something too. The logout hit everyone indiscriminately, and a real
player lost his square simply because he never noticed he had been signed out.
We put it back and gave him a full fresh window. He did nothing wrong. Our
defense did.
WHAT THEY WERE ACTUALLY AFTER
Their playbook never changes: complete the airdrop, attach a wallet, wait for
the token, sell everything in the first hour after listing. The wallet is the
whole point. It is where the tokens are supposed to land.
Of 12,821 accounts, 12,680 attached one. Every address different, not one repeat
in twelve thousand. That is not people. That is a generator.
There is no token. There never was.
The quest handed out a square: no market, no transfer, no resale. The only way
to use it is to keep coming back for weeks and pressing a button.
Twelve thousand aged Telegram accounts, burned for the right to babysit a button.
And the proof that leaves no room for doubt: after the free squares ran out,
another 6,686 accounts registered anyway. 6,656 attached a wallet. Zero completed
the quiz. Zero got a square.
They did not even try. Sign in, attach wallet, stop.
They did not want a square. They wanted a row in the database with a wallet on it
when the snapshot came.
THE UNCOMFORTABLE PART
Hundreds of new airdrops go through Telegram channels every day.
Founders believe they have attracted real participants — people who will stay in
the project, do something in it, hold on to something. They count registrations,
celebrate the growth, report it to investors.
In reality the giveaway goes to farms. And on listing day they sell all of it at
once, collapsing the price on exactly the real people who did show up.
We got off lightly: there was no token, so there was nothing to take. The farm
burned twelve thousand accounts on us and got zero. Projects with a token will
not be that lucky.
Checking who is on your list costs one query:
SELECT referred_by, count(*) FROM users
GROUP BY 1 ORDER BY 2 DESC LIMIT 10;
If you see 300, 300, 300, 299 in there, you already know what it means.
And to whoever is running the farm: we know you are reading this. Get around this
one too and we will write it up with the same numbers and the same detail. No
hard feelings. That is the experiment.
THE BOARD IS BLANK AGAIN
This morning, out of a million squares, six are alive.
Two days ago there were 6,000.
Emptiness.
So the honest pitch is not "come beat the bots" — the bots are gone. It is this:
the canvas is empty, and it will not be this empty again. Whoever takes a square
today is not joining a game in progress. They are the game in progress.
A square is $4 — a symbolic price, the cost of a coffee. Paid entry is the only
entry now. Registration closes in early September, and after that there is no
way in at all.
No skill. No strategy. No luck. Whoever gives up last wins — and right now almost
nobody has started.
Fill the canvas and the prize reaches a million dollars. The pool sits in a
smart contract: neither we nor anyone else can withdraw it, and the payout is
on-chain.
The bots are gone. Come take their place.
lastpixel.live
#Airdrop #Sybil #Web3Security #BotFarm #LastPixelLive