🎭 Sybil Attack Sybil Attack
One person or entity creates many fake identities — accounts, nodes, or wallets — to gain outsized influence over a network, while everyone else believes each identity is a separate, independent person.
🎭 The simple version — one person wearing many masks
Imagine a product page where one seller posts hundreds of glowing reviews under different names so the item looks loved. Or a vote where one person stuffs the ballot box with fake slips. A Sybil attack is the same trick on a crypto network: a single operator runs many fake identities at once, then uses the illusion of "lots of independent participants" to sway votes, polls, reputation, or even how a blockchain agrees on what's true.
📖 The name comes from the 1973 book Sybil, about a woman with many distinct identities. The term itself was introduced in a 2002 research paper, The Sybil Attack, written at Microsoft Research.
🧱 Why it threatens a blockchain
Open networks lean on a simple idea: one node, one voice. Decisions like which transactions are valid get settled by participants who are supposed to be independent. If one attacker secretly controls a big share of the nodes, that assumption breaks. With enough fake nodes — and the resources behind them — an attacker could try to block or censor transactions, isolate honest nodes, or set the stage for a larger takeover.
🎁 Where beginners actually meet it — airdrop farming
The most common real-world brush with Sybil attacks is airdrop farming. A project gives away free tokens to early users, so one person makes hundreds or thousands of wallets to claim the same giveaway over and over. By a 2025 estimate from research firm Dragonfly, billions of dollars in airdrops either go to these fake-wallet farmers or stay undistributed because projects can't safely tell real users apart. Big token airdrops like Arbitrum have worked to filter out suspected Sybil wallets before handing out tokens.
🛡️ How crypto fights back — Sybil resistance
No single defense fully stops it; networks usually combine several. The core idea is to make each identity expensive or verified so spinning up a crowd of fakes stops being free.
| Defense | How it raises the cost of faking |
|---|---|
| ⛏️ Proof-of-Work | Each voice needs real computing power; faking many would cost a fortune in hardware and electricity |
| 🪙 Proof-of-Stake | Each validator must lock up real coins; running many fakes means staking enormous capital |
| 🧍 Proof-of-personhood | Tools like BrightID and Worldcoin try to confirm one real human per identity |
| 🔍 Wallet analytics | Services like Nansen and Dune cluster wallets that move together to flag likely fakes |
💸 On large networks the cost is staggering: a successful attack on Bitcoin or Ethereum would run into the millions or billions in compute or staked tokens. That price tag is the real defense.
🚨 Things beginners should know
- 🎭 Fakes are cheap by default — In an open network, a new wallet or account costs almost nothing, so the door to Sybil attacks is always there
- 🧾 Multi-wallet airdrop farming is a Sybil attack — Projects increasingly detect and remove these wallets, so farming can mean getting nothing
- 🧍 Identity checks are a trade-off — Proof-of-personhood fights fakes but raises privacy questions; there's no perfect answer yet
- 🔒 Cost is the shield — A network is Sybil-resistant only when each identity is expensive or verified, not just because it's "decentralized"
❓ よくある質問
- Is a Sybil attack the same as a 51% attack?
- No. A Sybil attack is the cheap step of faking many identities. A 51% attack is bigger: it also needs the attacker to control most of a network's mining power or staked coins. Faking identities can help set up a 51% attack, but on its own it doesn't give an attacker majority control.
- Why doesn't decentralization stop fake identities by itself?
- Because in an open network anyone can join for free, and creating a fresh wallet or node costs almost nothing. That cheapness is exactly what makes Sybil attacks possible. Safety comes from making each identity expensive (Proof-of-Work, Proof-of-Stake) or verified, not from being decentralized alone.
- Where will I run into Sybil attacks as a beginner?
- Most often in airdrop farming: one person makes hundreds or thousands of wallets to claim the same free-token giveaway many times. Projects try to detect and filter these wallets, which is why some airdrops add identity checks or remove suspected fake accounts.