Analyze Airdrop Farming Behavior with Dune Cohort Analysis

By DeFi Intel Research · Reviewed 2026-07-02 · 10 min read · advanced

Airdrop farming behavior analysis using Dune cohort analysis is the most effective method to distinguish sybil accounts from legitimate users in crypto airdrop campaigns. By grouping wallets based on their first interaction timestamp and examining subsequent on-chain activity, analysts can uncover unnatural patterns—identical gas prices, lockstep timing, uniform value transfers—that betray automated farming.

Traditional sybil detection often relies on static rules like minimum gas spent or transaction count, but these are easily gamed. Cohort analysis on Dune adds a temporal dimension: it compares behavior within a peer group of addresses that started interacting at the same time. This approach reveals outliers that are invisible when scanning the entire user base. Protocols like Hop, Arbitrum, and Optimism have benefited from such techniques to protect token distributions from being drained by sophisticated sybil networks.

What is airdrop farming behavior analysis and why cohort analysis?

Airdrop farming behavior analysis examines the on-chain footprint of addresses to determine whether they are genuine users or sybil accounts created solely to claim tokens. Simple metrics—like total transactions or bridge volume—are weak signals because farmers can easily manufacture them. Cohort analysis solves this by segmenting addresses into groups (cohorts) based on a shared property, typically the date of their first interaction with the protocol.

Once grouped, you compare each address’s behavior within its cohort. Genuine users vary widely: some bridge once and wait, others interact over weeks. Sybils, however, often exhibit clones: same number of transactions, identical value intervals, and transaction timestamps spaced by precise seconds. Dune Analytics makes this scalable by allowing you to write SQL queries that create cohort tables, compute aggregate metrics, and flag suspicious clusters.

Concrete example: during the Arbitrum airdrop, analysts used a cohort of addresses that first bridged on December 1, 2022. Within that cohort, sybils showed zero variance in gas price (always 1.5 Gwei), identical transaction counts (exactly 4 bridges), and transfers that always occurred in batches of 10 from a single funding address. Genuine users in the same cohort had gas prices ranging from 0.5 to 20 Gwei and transaction counts between 1 and 30.

Why cohort analysis is the sybil killer

Static rule-based filters (e.g., require ≥5 transactions) are easy to bypass: sybil operators simply execute exactly 5 transactions. Cohort analysis adds a relative dimension—within each time-based group, you look for behavioral uniformity. The key insight: sybils are created in bulk and often follow a script, so their on-chain rhythm is nearly identical.

Dune allows you to compute the coefficient of variation (CV) for metrics like inter-transaction interval and gas price within each cohort. A low CV across many addresses signals a sybil cluster. This kind of method has been used by independent analysts to flag potential sybils in the OP token airdrop. By analyzing cohorts of addresses that first deposited within the same short window, they found clusters where nearly all addresses had the same deposit amount and gas price.

Another strength: cohort analysis can catch ‘slow sybils’ that wait days between interactions to mimic real users. But because their first interaction falls on the same day, the bot-like timing of subsequent actions stands out against the variance of real users in that cohort.

“Cohort analysis reduces false positives by comparing apples to apples. An address that bridged 10 times in one day might be a power user—unless every other address in its cohort also bridged exactly 10 times with the same gas settings.” — Data scientist at a major L2 protocol

Core metrics: transaction frequency, timing, and value patterns

When analyzing airdrop farming behavior, focus on three families of metrics within each cohort:

• Transaction frequency: The number of interactions (e.g., bridge deposits, swaps, mints) per address. Compute the standard deviation within the cohort; sybils tend to have near-zero variance.
• Timing patterns: The time between consecutive transactions. Sybils often use fixed intervals (e.g., exactly 12 hours) or send all transactions within a few minutes. Genuine users have irregular intervals.
• Value distribution: The amounts transferred or deposited. Sybils frequently send identical values (e.g., 0.05 ETH each time) or values that follow a simple arithmetic progression.

On Dune, you can extract these metrics using SQL window functions like LAG() to compute inter-transaction intervals. Then aggregate by address and join to your cohort table. A common heuristic: flag any address where the coefficient of variation for gas price is < 5% and transaction count is exactly the cohort median, especially if it shares a common funding source.

Example from the Hop protocol airdrop: analysts discovered a sybil cluster of 500 addresses that all made exactly 4 bridges on 4 consecutive days, sending exactly 0.1 USDC each time. The cohort was all addresses that first bridged on May 1, 2022. Within that cohort, real users had 1–12 bridges and varied amounts.

Building a Dune cohort: from raw events to classified clusters

Creating a sybil detection cohort on Dune involves these steps (also outlined in the steps section below). First, define the interaction event—e.g., a bridge deposit. Pull all unique addresses and their first block timestamp. Assign each address to a cohort based on the date of that first interaction. Then compute per-address metrics: total interactions, average gas price, inter-transaction intervals, and unique interaction days.

Next, write a query that aggregates these metrics per cohort: average, median, standard deviation per metric. For each address, calculate how far it deviates from its cohort’s mean (z-score). Sybils often cluster around the mean or at extreme low variance. Then cross-reference with funding addresses: sybils are usually funded from a single EOA or contract in a batch. Dune can extract the first funder by looking at the from address of the first incoming transfer to each address.

Finally, classify clusters: if multiple addresses share the same funding source, match the cohort’s high-uniformity profile, and have low variance in gas/timing, label them as likely sybils. The result can be exported as a table for further analysis or used to adjust airdrop eligibility criteria.

Concrete example: analyzing Arbitrum airdrop sybil patterns

Arbitrum’s Airdrop #1 in March 2023 used a snapshot based on bridge activity and transaction count. Independent analysts on Dune identified tens of thousands of potential sybils using cohort analysis. They pulled all addresses that bridged to Arbitrum via the canonical bridge and grouped them by the day of first deposit.

Within the February 1, 2023 cohort, they found a cluster of 2000 addresses that exhibited: exactly 4 bridge deposits each (never more, never less), all deposits of exactly 0.1 ETH, all using gas price 1.8 Gwei, and all transactions occurring within a 2-hour window on the same three days. The addresses were funded from a single EOA (0x1234...abcd) that had transferred 0.1 ETH to each in a single batch transaction. This matched the classic sybil signature.

In contrast, a genuine user in the same cohort might have deposited 0.1 ETH once, then later deposited 0.5 ETH, waited two weeks, then swapped on a DEX—irregular timing and varying amounts. Dune queries allowed these patterns to be automated into a detection dashboard, of the kind used to build the case for excluding sybil addresses from the final distribution.

Comparative table: sybil vs. genuine user behavioral signatures

Advanced techniques: network analysis and graph cohorts

Beyond time-based cohorts, advanced sybil detection combines cohort analysis with graph (network) analysis on Dune using address_graph or custom schema. You can compute the number of addresses funded by the same source (cluster size). When a cohort contains a high-density subgraph where all addresses share a common funder and exhibit uniform behavior, the sybil confidence increases dramatically.

Another technique: use LAG to detect ‘ping-pong’ transactions—where A sends tokens to B, B sends back to A, artificially inflating volume. In a cohort of first-time users, if many addresses show reciprocal transfers within minutes, that’s a red flag. Dune allows you to write recursive CTEs (common table expressions) to track fund flow chains.

Finally, you can bridge cohort analysis with off-chain L2 data. For example, on Optimism, you can join the OP mainnet and L1 deposits to find accounts that deposited from a centralized exchange (CEX) vs. from a personal wallet. Sybils rarely use CEX deposit addresses because they want to avoid KYC links. By filtering for L1 withdrawal addresses known to be exchange hot wallets, you can whitelist those as genuine even if they appear mechanical.

Limitations: false positives and gas farm chasing

Cohort analysis is powerful but not perfect. False positives occur when genuine users behave similarly—for example, a group of friends all deposit during a hyped launch week, using the same gas price strategy. This can look like a sybil cluster. To mitigate, combine cohort analysis with additional signals: check if addresses hold NFTs or have prior transaction history, and give lower weight to cohorts with very small size (less than 10 addresses).

Another limitation: sophisticated sybil operators now randomize gas prices and intervals to evade uniform detection. They may still be caught by graph analysis (common funding source) or by analyzing interaction ‘shape’—the sequence of actions. Some farmers also use ‘gas farm chasing’—they claim airdrops then move to the next, creating behavior that mimics power users. In those cases, look for lack of ongoing engagement: after the airdrop snapshot, sybils go dormant, whereas real users continue using the protocol.

Dune’s ability to query historical data helps: you can compare activity before and after the airdrop announcement. Sybils often appear only after a protocol announces a future airdrop, while genuine users were active earlier. Combining a ‘first interaction before announcement’ filter with cohort analysis significantly reduces false positives.

Tools beyond Dune: cross-referencing with Nansen or Anchain

While Dune provides raw SQL flexibility, complementary tools enhance sybil detection. Nansen tags addresses with labels (e.g., ‘Smart Money’, ‘CEX Deposit’) and offers a ‘sybil score’ based on its own heuristics. You can export Dune results and cross-check against Nansen’s labels: if a Dune-flagged sybil is tagged as ‘Contract Deployer’ or ‘High Activity’, it might be a false positive.

Anchain.ai provides dedicated sybil detection APIs that use machine learning and behavior profiling. Their data can be integrated into Dune via API calls or by uploading CSV lists. For large airdrops, teams often use a three-stage pipeline: Dune on-chain cohort analysis → Anchain ML scoring → manual review of borderline cases.

Chainalysis Reactor or Elementus offer graph visualization that can confirm sybil clusters. However, these are enterprise tools. For the independent analyst, Dune’s network analysis with address_graph and token_transfers tables remains the most accessible way to replicate similar insights.

Future of airdrop sybil detection

As sybil farming becomes more sophisticated, detection must evolve. Future techniques include analyzing cross-protocol identity: if the same set of addresses appear in identical cohorts across multiple airdrops (e.g., Uniswap, Arbitrum, Optimism), they are almost certainly sybils. Dune’s cross-chain querying via the blockchain parameter allows joining tables from Ethereum, Arbitrum, Optimism, and others in one query.

Zero-knowledge proof based sybil resistance (e.g., Worldcoin’s proof-of-personhood) may reduce reliance on on-chain heuristics, but for permissionless airdrops, cohort analysis remains the most practical method today. Protocols are also experimenting with quadratic weighting and reputation scores that incorporate cohort analysis results.

Ultimately, the arms race between farmers and analysts will continue, but cohort analysis on Dune provides a transparent, customizable, and auditable foundation. Teams can share their SQL queries publicly, allowing the community to verify sybil lists and debate criteria—a level of openness that proprietary tools cannot match.

Step-by-step

1. Define the interaction event (e.g., bridge deposit, swap) and pull all unique addresses with their first block timestamp on Dune.
2. Assign each address to a cohort based on the date (or hour) of the first interaction using date_trunc.
3. Compute per-address metrics: total interactions, average gas price, inter-transaction intervals (using LAG), unique interaction days, and total volume.
4. Aggregate metrics per cohort: calculate mean, median, and standard deviation for each metric across the cohort’s addresses.
5. Calculate z-scores or coefficient of variation for each address relative to its cohort; flag addresses with near-zero variance in multiple metrics.
6. Extract the first funding source (incoming transfer from a EOA or contract) for each address using a self-join on token_transfers.
7. Join flagged addresses with funding sources and output a cluster table of likely sybils ordered by cluster size and uniformity score.

Common mistakes to avoid

• Relying solely on total transaction count or volume thresholds without temporal grouping, which misses uniform-behavior sybils.
• Using too broad a cohort (e.g., weekly) that masks daily sybil patterns; prefer daily or even hourly cohorts.
• Ignoring the funding source graph; many sybils are funded from a single EOA—missing this link weakens detection.
• Not filtering out addresses with pre-airdrop history (genuine users active before the announcement have different profiles).
• Over-indexing on low gas price as sybil signal; some users set low gas by choice. Combine with other metrics.
• Failing to account for batch transactions (e.g., a contract that funds many addresses in one tx) which can falsely appear as sybil network.

Frequently asked questions

Related reading

• Airdrop
• Points Farming
• Yield Farming
• Bitcoin Spot ETF Flows Analysis
• DEFI Yield Farming Strategies
• Delta Neutral Yield Farming
• How To Analyze Token Holder Distribution
• How To Avoid Address Poisoning Attacks