The Scale of the Challenge

When 185,480 wallets joined t3rn's testnet, we faced the challenge of protecting our community from Sybil attackers whilst not injecting unnecessary friction for our real users. Sybils use automated scripts to create fake wallets designed to farm tokens and siphon rewards away from our wonderful community..

Our audit with Human.Tech uncovered the full extent of the problem. These weren't random anomalies. They were calculated efforts to exploit the system. One Sybil ring alone contained 1,152 wallets, and over 14,000 wallets were grouped into rings of 10 or more. These large clusters show the level of automation and coordination some actors employed to farm or steal the airdrop.

The numbers speak for themselves. Clearly identified Sybil wallets held 4.9 million BRN tokens that rightfully belonged to our real users. Allowing this kind of exploitation would undermine everything t3rn stands for. We're here to build a secure and fair cross-chain protocol that rewards real participation, not deception.

Our Solution: Precision Detection Meets Real-World Results

The analysis was powered by Human.Tech using a methodology called Model Based Detection (MBD), a machine learning system that classifies wallets based on onchain activity patterns across chains including Ethereum, Arbitrum, Optimism and Base. MBD assigns a score between 0 (Sybil) and 100 (Human), helping us precisely segment participants.

• Wallets funded at the same time from identical sources? Flagged.

• Synchronized transactions across clusters? Detected.

• Scripted, robotic behaviour? Grouped and isolated.

Every wallet now has a defined status. Every real user has a clear path to their TRN rewards.

Footnote: Detection combined internal block-lists, on-chain clustering of funding/CEX deposits, and MBD scoring.

The Findings: A Clear Picture of Our Ecosystem

After analysing all 185,480 wallets that engaged with our testnet, we placed each into a distinct category based on behavioural patterns and onchain data. This gave us a transparent, structured approach to reward distribution. It protects real contributors and gives uncertain cases a fair path forward.

Human

These wallets passed all legitimacy checks. They were either on verified human lists or showed consistent human-like behaviour across chains. What it means for you: Congratulations, you're fully whitelisted. No action is needed.

Farmers

This group includes small clusters of wallets, usually between 2 and 9. Some may belong to developers testing infrastructure or prospective Executors preparing for launch. To keep things fair, we applied a simple rule: Only the wallet with the highest BRN balance in each cluster is eligible to claim. What it means for you: You can use the top wallet in your cluster to claim.

Unknown

This is the largest group and likely contains many genuine but newer users. These wallets had low onchain activity, often just one or two actions, which meant we couldn't confidently judge them. What it means for you: You'll need to verify your identity through Human Passport to claim your tokens.

Suspected Sybil

These wallets showed multiple red flags such as mirrored behaviour or suspicious funding origins. However, the evidence wasn't definitive enough to exclude them outright. What it means for you: You still have a path to claim. Verification via Human Passport is required.

Sybil

This group was definitively identified as Sybil actors. These wallets showed signs of large-scale automation and orchestration, including simultaneous funding and robotic execution. What it means for you: These wallets are excluded from the airdrop, increasing value for verified users.

Why Burn the BRN from Sybil Wallets?

We welcomed good-faith participation in our testnet, whether as Executors or swappers. However, some wallets sought to exploit the system through large-scale, coordinated automation; generating fake identities purely to farm BRN. Following Human.Tech’s guidance, we flagged and excluded wallets in rings of 10 or more, a threshold chosen to balance fairness and rigour. This behaviour went against the purpose of our testnet and undermined our ability to reward genuine users. As a result, BRN held by these Sybil wallets will be burned.

Clarifying the Farming Wallets Policy

Some wallets in our dataset belong to farming rings - small groups of 2 to 9 wallets controlled by a single account holder. These participants did not exhibit the large-scale automation or exploitative behaviour seen in Sybil clusters. In fact, many of them likely represent sophisticated users, including developers testing the protocol, early community members exploring Executor roles, or highly engaged users stress-testing the system. We recognise that many of these farmers contributed meaningfully to the success of the testnet. Their activity helped validate core functions at scale and brought valuable volume to the protocol.

To respect their participation while upholding fairness and the one-user-one-claim principle, only the primary wallet in a farming ring (the one with the highest BRN balance) will be eligible to claim the airdrop. To claim the full value earned across all wallets, the owner will be required to manually transfer the BRN from their other wallets into this single primary wallet before claiming. This allows engaged participants to consolidate their earnings while respecting the designated claim limits (20k for Users & 40k BRN for Executors). This strikes a balance: it prevents over-allocation while offering a clear and compliant path for engaged participants to access the value they earned.

How the Airdrop Claim Will Work

When you connect your wallet to the claim site, you'll see one of the following outcomes:

• Whitelisted Wallet (Human Wallets) You'll see a success message confirming your eligibility. Your TRN will be ready to claim when the claim window opens. No action needed.

• Verification Required (Unknown, the primary wallet from each Farmer cluster and Suspected Sybil wallets) You'll be guided to Human.Passport, our verification partner, where you can raise your humanity score to prove you are a human, and become eligible. A score of 20+ is required to verify. You will need to choose several Stamps, or verifiable credentials, to build up this score.

Here are some examples of Stamps you can verify:

• Verify your EVM wallet with transaction history

• Connect a KYC-verified exchange account

• Add an email address or social profile

• Link a GitHub account (for developers)

• And more…
  
  

• Part of a Farming Cluster (Non-primary wallets in a cluster) You'll see a message explaining that this wallet is not eligible for the airdrop claim. To ensure the BRN held in this wallet is included in your airdrop, you must first transfer it to your designated primary wallet (the one in your cluster with the highest BRN balance). Only that primary wallet can be used to complete the final airdrop claim.

• Blacklisted Wallet (Sybil category) You'll be notified in the dashboard that this wallet is ineligible due to Sybil behaviour.

This Is Why We Built t3rn

We believe in a web3 that rewards real users. This airdrop process, this filtering, this structure; it all exists to protect our community, honour your contributions, and build trust in what we're creating together. Thank you for being part of the journey so far. Your participation in the testnet, your patience during this process, and your commitment to the ecosystem mean everything.

The claim window is opening soon.

For exact dates and updates, follow our official channels on X (Twitter), Discord, and Telegram.