Solana WET Presale Compromised by Sybil Wallets as HumidiFi Plans Relaunch

In a recent presale event for the Wet (WET) token on the Solana blockchain, complications arose due to the involvement of bot farms that used over 1,000 wallets to claim nearly the entire token supply in mere seconds. This presale was hosted on the decentralized exchange aggregator Jupiter and sold out almost instantly. Unfortunately, real buyers were essentially shut out as one entity managed to dominate the sales, according to the event's organizers.

Key Takeaways

A bot farm exploited the Solana WET token presale, using over 1,000 wallets to dominate the sale, prompting the project’s organizers to cancel it.
HumidiFi, the team behind the token, plans to hold a new launch and conduct an airdrop for legitimate participants.
Bubblemaps identified the alleged attacker through wallet clustering and linked the action to a specific Twitter user.
Sybil attacks are becoming more common in crypto, and project teams are urged to implement stronger security measures, such as KYC protocols and manual reviews to prevent future incidents.

Solana WET presale hijacked by Sybil wallets as HumidiFi resets launch

HumidiFi, the automated market maker (AMM) behind the presale, acknowledged the incident and chose to cancel the launch altogether. They announced plans to develop a new token and perform an airdrop for legitimate buyers, explicitly excluding the bot operator. "We are creating a new token. All Wetlist and JUP staker buyers will receive a pro-rata airdrop. The sniper is not getting anything," stated HumidiFi. They also confirmed a new public sale scheduled for Monday.

Source: Jupiter

Bubblemaps Detects the Alleged Attacker's Identity Through Wallet Analysis

On Friday, blockchain analytics platform Bubblemaps reported that they had identified the individual behind the presale attack by observing unusual clustering of wallets during the token sale. In a post on X, the company revealed that around 1,100 out of 1,530 participating wallets showed similar funding and activity patterns, indicating they were likely controlled by the same actor.

Bubblemaps CEO Nick Vaiman shared with Cointelegraph that their analysis highlighted several unusual patterns among presale participants, noting many of these wallets had no previous on-chain activity and were funded by a small number of wallets with similar transaction amounts in a brief time frame. "Despite some clusters being disconnected on-chain, the behavioral similarities in size, timing, and funding strongly suggest a single entity is involved," Vaiman commented.

According to the analytics firm, the bot operator funded thousands of new wallets sourced from exchanges, each receiving 1,000 USDC before the sale commenced. They noted that one of the wallet clusters “slipped,” eventually linking the attack to a Twitter username, “Ramarxyz,” who later asked for a refund on the same platform.

Bubblemaps demonstrated the wallets participating in the presale. Source: Bubblemaps

Related: Pepe Memecoin Website Exploited, Redirecting Users to Malware: Blockaid

The Importance of Tackling Sybil Attacks as a Major Security Concern

This incident follows a series of Sybil attack events from November where single entities managed to secure significant portions of token distributions. For instance, on November 18, one actor took control of 60% of the APR token airdrop from aPriori. Then on November 26, wallets linked to Edel Finance were accused of claiming 30% of their own EDEL tokens, although the co-founder has disputed these allegations, claiming that the tokens were placed in a vesting contract.

Vaiman informed Cointelegraph that Sybil attacks are increasingly prevalent in token presales and airdrops, though he noted that each incident has its unique characteristics. He emphasized that project teams should consider implementing Know Your Customer (KYC) protocols or utilize algorithms designed to detect Sybil activities. Additionally, conducting manual reviews of presale or airdrop participants before distributing tokens could enhance security.

"Sybil activity is a critical security threat that must be addressed during token launches," Vaiman advised. "Projects should invest in dedicated teams or seek assistance from professionals specializing in Sybil detection."

Key Takeaways

Bubblemaps Detects the Alleged Attacker's Identity Through Wallet Analysis

Related: Pepe Memecoin Website Exploited, Redirecting Users to Malware: Blockaid

The Importance of Tackling Sybil Attacks as a Major Security Concern

Magazine: Inside a 30,000 Phone Bot Farm Stealing Crypto Airdrops from Real Users