# Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach

arXiv: https://arxiv.org/abs/2505.09313 · HTML: https://mlsanity.com/paper/2505.09313/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 22 references that are in the map.
- First posted on arXiv 14 May 2025.

## Builds on (most cited first, 8 of 8)

- [Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding](https://mlsanity.com/paper/1911.09259/) (2019)
- [Modeling and Understanding Ethereum Transaction Records via a Complex Network Approach](https://mlsanity.com/paper/2012.15462/) (2020)
- [Characterizing and Detecting Money Laundering Activities on the Bitcoin Network](https://mlsanity.com/paper/1912.12060/) (2019)
- [Ethereum Fraud Detection with Heterogeneous Graph Neural Networks](https://mlsanity.com/paper/2203.12363/) (2022)
- [Characterizing Entities in the Bitcoin Blockchain](https://mlsanity.com/paper/1810.11956/) (2018)
- [A Probabilistic Model of the Bitcoin Blockchain](https://mlsanity.com/paper/1812.05451/) (2018)
- [Empirically Analyzing Ethereum's Gas Mechanism](https://mlsanity.com/paper/1905.00553/) (2019)
- [Fighting Sybils in Airdrops](https://mlsanity.com/paper/2209.04603/) (2022)

## Built on by (most cited first, 4 of 4)

- [Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem](https://mlsanity.com/paper/2606.26028/) (2026)
- [How Agentic Is Agentic Commerce? A Population-Scale Measurement of x402 Adoption and Authenticity](https://mlsanity.com/paper/2607.12575/) (2026)
- [Modeling Decisions in Blockchain Analytics: A Leakage-Aware Evaluation of Tree-Based vs. Sequential Models](https://mlsanity.com/paper/2607.27350/) (2026)
- [Compression-Based Behavioral Similarity for Open-World Sybil Discovery on Ethereum](https://mlsanity.com/paper/2607.27370/) (2026)

## Abstract (arXiv)

Sybil attacks pose a significant security threat to blockchain ecosystems, particularly in token airdrop events. This paper proposes a novel sybil address identification method based on subgraph feature extraction lightGBM. The method first constructs a two-layer deep transaction subgraph for each address, then extracts key event operation features according to the lifecycle of sybil addresses, including the time of first transaction, first gas acquisition, participation in airdrop activities, and last transaction. These temporal features effectively capture the consistency of sybil address behavior operations. Additionally, the method extracts amount and network structure features, comprehensively describing address behavior patterns and network topology through feature propagation and fusion. Experiments conducted on a dataset containing 193,701 addresses (including 23,240 sybil addresses) show that this method outperforms existing approaches in terms of precision, recall, F1 score, and AUC, with all metrics exceeding 0.9. The methods and results of this study can be further applied to broader blockchain security areas such as transaction manipulation identification and token liquidity risk assessment, contributing to the construction of a more secure and fair blockchain ecosystem.