$174M stolen in 3 months: why sybil filtering is life or death
Three launches. Three disasters. One pattern.
Between September and November 2025, three well-funded crypto projects lost a combined $174M+ to sybil attacks. None had adequate reputation filtering. The attacks followed the same playbook every time: create wallets, fund them just before launch, claim tokens, dump immediately.
MYX Finance (Sep ’25)
Apriori (Oct ’25)
IRYS (Nov ’25)
MYX Finance: $170M to 100 wallets
In September 2025, Bubblemaps traced 100 freshly-funded wallets, all created on the same day via OKX, that collectively captured $170M worth of MYX. Bubblemaps called it “the biggest airdrop sybil of all time.”
Apriori: 80% captured before announcement
In October 2025, 5,800 interconnected wallets, funded by just 13 source addresses, claimed 80% of all tokens distributed on BNB Chain. The wallets were funded days before Apriori publicly announced BNB Chain claims.
IRYS: 900 bots, $4M gone in hours
In November 2025, Bubblemaps identified 900 newly-created wallets that collectively captured 20% of the entire airdrop. Within hours, 500 of those wallets had funneled $4M in IRYS tokens back to Bitget for immediate sale.
What Ethos adds to the stack
A sybil wallet on Ethos starts at ~1200 (Neutral). No vouch history, no reviews, no attestations. One API call reveals this instantly. Set a minimum threshold of 1400 and every one of those 5,800 Apriori bot wallets would have been caught before claiming a single token.
How you could use this
Don’t be the next sybil headline.
Integrate reputation filtering before your launch, not after the damage is done.