Data snapshot: Feb 24, 2026. Type tracking deployed Feb 18.
24,902 wallets exhibit identical behavior: bridge(s) of ~$18K, complete all one-time quests, skip Connect X and Weekly TVL, hold $0 in vaults. Total volume attributed: $468.8M.
Sybil wallets are identified by bridge amount:
- Any user with any bridge to Katana valued between $17,000 and $19,000
SELECT DISTINCT "userId" FROM "Intent"
WHERE type = 'BRIDGE_TO_KATANA'
AND "usdValue" BETWEEN 17000 AND 19000The amount range is consistent with bridging ~10 ETH per wallet (at ETH ~$1,840 during Feb 18-24). Most sybils bridge exactly once, but 547 users bridged multiple times in this range — an earlier filter requiring exactly one bridge missed these multi-bridge sybils.
| Metric | Sybil | Organic | Total |
|---|---|---|---|
| Users | 24,902 (39.3%) | 38,468 (60.7%) | 63,370 |
| Bridge volume | $468.8M (>99%) | $235K (<1%) | $469.0M |
| Bridge intents | 25,514 (94.2%) | 1,572 (5.8%) | 27,086 |
| Swap intents | ~24,184 (84%) | 4,488 (16%) | ~28,672 |
| Swap volume | ~$4.7M (86%) | $760K (14%) | ~$5.5M |
| Vault deposit intents | ~23,263 (93%) | 1,715 (7%) | ~24,978 |
| Vault deposit volume | ~$45K (2%) | $2.0M (98%) | ~$2.1M |
| TVL held | $0 (0%) | $20.88M (100%) | $20.88M |
Organic numbers are from fresh queries. Sybil swap/vault counts are derived (total minus organic) and approximate.
Picture 27,000 people at an ATM. If they were real people, they'd withdraw $20, $500, $3,000, all different amounts. Our data shows 25,000 of them withdrawing between $18,252 and $18,505. That's a $253 window. That does not happen organically.
| Amount Range | Bridges | % of Total | Volume |
|---|---|---|---|
| $0 (dust) | 422 | 1.6% | $126 |
| $1-$100 | 1,026 | 3.8% | $16K |
| $100-$1K | 49 | 0.2% | $16K |
| $1K-$5K | 17 | 0.1% | $36K |
| $15K-$18K | 825 | 3.1% | $14.5M |
| $18K-$20K | 24,669 | 91.3% | $453.9M |
| $50K-$100K | 2 | 0.0% | $167K |
91.3% of all bridge intents are $18K-$20K. The amount is consistent with bridging exactly ~10 ETH per wallet (at ETH price ~$1,840 during Feb 18-24, 10 ETH = ~$18,400).
| Range | Bridges |
|---|---|
| $17,000-$17,100 | 14 |
| $17,100-$17,200 | 20 |
| $17,200-$17,300 | 15 |
| $17,300-$17,400 | 16 |
| $17,400-$17,500 | 269 |
| $17,500-$17,600 | 169 |
| $17,600-$17,700 | 115 |
| $17,700-$17,800 | 13 |
| $17,800-$17,900 | 30 |
| $17,900-$18,000 | 174 |
| $18,000-$18,100 | 651 |
| $18,100-$18,200 | 1,667 |
| $18,200-$18,300 | 4,525 |
| $18,300-$18,400 | 4,372 |
| $18,400-$18,500 | 6,119 |
| $18,500-$18,600 | 5,665 |
| $18,600-$18,700 | 1,616 |
| $18,700-$18,800 | 54 |
The core cluster is $18,100-$18,700 (23,964 intents). The variation is ETH price movement during the week.
| Bridges per user | Users | % of Users | Avg Volume/User |
|---|---|---|---|
| 1 | 25,220 | 96.9% | $17,738 |
| 2 | 687 | 2.6% | $25,580 |
| 3 | 98 | 0.4% | $31,042 |
| 4+ | 28 | 0.1% | varies |
96.9% of bridge users bridge exactly once. The remaining 3.1% (813 users) bridge multiple times — 547 of these have at least one bridge in the $17K-$19K range and are included in the sybil set. The multi-bridge sybils are likely the same operator running wallets through multiple rounds.
20 randomly selected bridge intents - 17 out of 20 fall in the $18,178-$18,678 range:
| Intent ID | User | Date | USD Value |
|---|---|---|---|
| 0x4b9e...a701 | 0xe4a3...4c2e | Feb 18 | $18,178 |
| 0x2148...1301 | 0x61eb...8464 | Feb 19 | $18,256 |
| 0xbff1...a601 | 0xf541...1808 | Feb 22 | $11 |
| 0x98f9...8c01 | 0x39a0...38cd | Feb 21 | $18,533 |
| 0xd000...7a01 | 0x3d62...eefa | Feb 19 | $18,477 |
| 0x4f53...8401 | 0xbc03...d8ba | Feb 21 | $18,673 |
| 0xf994...3401 | 0xe160...820c | Feb 19 | $18,400 |
| 0x436c...5e01 | 0xcd2d...9934 | Feb 21 | $18,678 |
| 0xb9cf...0001 | 0x6efb...4817 | Feb 21 | $18,388 |
| 0x1bea...1f01 | 0xd44c...ea47 | Feb 19 | $18,463 |
| 0x7b8e...f901 | 0x8d71...b82e | Feb 19 | $18,485 |
| 0x30a6...1501 | 0xa2bc...2d40 | Feb 20 | $18,359 |
| 0x9f7d...5a01 | 0x44c8...f054 | Feb 19 | $18,271 |
| 0x9985...af01 | 0xa106...49b6 | Feb 19 | $18,441 |
| 0xed55...2e01 | 0x2d73...2b74 | Feb 19 | $18,485 |
| 0x0ae5...5c01 | 0x4f6c...5820 | Feb 20 | $18,433 |
| 0x5c85...d201 | 0x4c57...77c7 | Feb 22 | $18,203 |
| 0xa681...bf01 | 0x35c9...0de1 | Feb 20 | $18,247 |
| 0x2e98...9a01 | 0xd8b9...04b8 | Feb 20 | $18,421 |
| 0x3094...e301 | 0xcd58...2d9fe | Feb 22 | $18,507 |
| Quest | Raw | Organic | Sybil | Sybil % |
|---|---|---|---|---|
| Verify Wallet | ~63,000 | 38,002 | ~25,000 | ~40% |
| Fund Wallet | ~52,000 | 26,975 | ~25,000 | ~48% |
| First Swap | ~49,000 | 25,024 | ~24,000 | ~49% |
| Swap Major Asset | ~49,000 | 24,973 | ~24,000 | ~49% |
| First Vault Deposit | ~48,400 | 25,423 | ~23,000 | ~47% |
| Weekly Swap | ~53,000 | 29,197 | ~24,000 | ~45% |
| Connect X | 7,068 | 7,068 | 0 | 0% |
| Weekly TVL | 4,753 | 4,753 | 0 | 0% |
Organic numbers are from fresh queries. Raw/sybil are approximate (raw has grown slightly since last full count).
Connect X and Weekly TVL are the only quests sybil wallets don't complete. This makes sense:
- Connect X requires a real X account (cost/risk too high to create fake accounts at scale)
- Weekly TVL requires holding $50+ in vaults for a week (ties up capital)
The sybil operator runs ~25K wallets through this exact sequence:
- Create fresh wallet
- Bridge
10 ETH ($18.4K) — sometimes multiple rounds from the same wallet - Complete fund_wallet quest
- Do a swap (completing first_swap, swap_major_asset)
- Do a dust vault deposit (completing first_vault_deposit)
- Do a weekly swap (completing weekly_swap)
- Skip Connect X (0%) and Weekly TVL (0%)
- Move capital out — sybils hold $0 in vaults
The sybil wallets distort the swap gaming numbers significantly:
| Bucket | Swaps | % |
|---|---|---|
| Below $10 min | ~800 | 2.8% |
| Bare minimum ($9.50-$11) | ~460 | 1.6% |
| $11-$100 | ~1,400 | 4.9% |
| $100-$500 | ~25,700 | 89.6% |
| $500+ | ~300 | 1.0% |
| Bucket | Swaps | % |
|---|---|---|
| Below $10 min | 1,373 | 30.6% |
| Bare minimum ($9.50-$11) | 1,404 | 31.3% |
| $11-$100 | 1,382 | 30.8% |
| $100-$500 | 287 | 6.4% |
| $500+ | 42 | 0.9% |
The raw data made swaps look organic (90% at $100-$500). The organic-only data shows 62% are at or below the $10 minimum, with only 6.4% in the $100-$500 range. The sybil wallets were doing uniform ~$196 swaps, masking the real behavior. The $100-$500 bucket collapsed from 23% to 6.4% when the corrected filter removed multi-bridge sybils that the original filter missed.
Shows whether sybil activity is ongoing or has stopped. Run this to get the latest:
SELECT
DATE(i.timestamp) AS day,
COUNT(*) AS bridges_18k_19k,
COUNT(DISTINCT i."userId") AS unique_users,
ROUND(SUM(i."usdValue")::numeric, 2) AS total_volume
FROM "Intent" i
WHERE i.type = 'BRIDGE_TO_KATANA'
AND i."usdValue" BETWEEN 18000 AND 19000
GROUP BY DATE(i.timestamp)
ORDER BY day;| User | Bridges | Total Volume | Avg/Bridge | First | Last |
|---|---|---|---|---|---|
| 0xcb9b...1086 | 6 | $110,906 | $18,484 | Feb 18 | Feb 19 |
| 0x4f0a...181f | 2 | $100,089 | $50,045 | Feb 18 | Feb 18 |
| 0xe359...c65 | 4 | $74,139 | $18,535 | Feb 21 | Feb 22 |
| 0x7b9e...68ac | 4 | $74,017 | $18,504 | Feb 19 | Feb 19 |
| 0xa699...09d | 4 | $73,979 | $18,495 | Feb 19 | Feb 19 |
| 0x43e9...8268 | 4 | $73,795 | $18,449 | Feb 18 | Feb 19 |
| 0x948b...50d6c | 4 | $70,739 | $17,685 | Feb 22 | Feb 23 |
| 0x0e79...5f2e2 | 4 | $70,734 | $17,683 | Feb 23 | Feb 23 |
| 0x0a89...ed184 | 4 | $70,631 | $17,658 | Feb 23 | Feb 23 |
| 0x7d94...f50a | 4 | $69,981 | $17,495 | Feb 23 | Feb 23 |
The top user (0xcb9b) made 6 bridges averaging $18.5K each - likely the operator testing. Users with 4 bridges each at ~$18.5K are likely the same operator with wallets that did multiple rounds.
User #2 (0x4f0a) is an outlier - 2 bridges averaging $50K. This one may be legitimate.