Source: CoinEdition Original Title: 900 Wallets, $4M Missing: IRYS Airdrop Hit by Manipulation Claims Original Link: https://coinedition.com/900-wallets-4m-missing-irys-airdrop-hit-by-manipulation-claims/

IRYS Airdrop Sybil Attack Analysis

Key Findings

• 900 new wallets funded by a major exchange claimed 20% of the IRYS airdrop
• Users appreciate the airdrop but express concerns about growing manipulation claims
• aPriori previously faced a large Sybil attack involving thousands of connected wallets

The IRYS airdrop, one of the most talked-about token launches this month, is now under scrutiny after on-chain analytics platform Bubblemaps published findings hinting that a large portion of the distribution may have been claimed by coordinated Sybil wallets.

Bubblemaps also shared new data showing that for 38 past tokens with major wallet clustering issues, more than half of the project teams listed the United States as their location, followed by Europe and India.

Unusual Wallet Activity Before Launch

According to Bubblemaps, suspicious activity began one day before the IRYS airdrop went live. The platform reported that 900 new wallets were funded by a major crypto exchange within tight time windows. Each wallet showed the same three traits:

• No previous on-chain history
• Received nearly identical amounts of ETH
• Claimed the IRYS airdrop immediately at launch

This cluster alone reportedly claimed around 20% of the entire airdrop supply. Bubblemaps also identified 20 separate funding batches, each sending ETH to about 50 wallets between November 21 and 24. All of these wallets displayed the same behavior pattern.

Tokens Moved and Sent to Exchange

Bubblemaps found that about 500 wallets linked to the suspicious clusters moved all their IRYS tokens to fresh wallets and then sent them to a major exchange.

Around $4 million worth of tokens has already reached the exchange, but Bubblemaps says there is still no evidence connecting the IRYS team to these wallets. The investigation is ongoing through Bubblemaps’ Intel Desk, where the community can vote to bring the case more attention.

Community members have reacted to the latest developments. One contributor expressed mixed feelings: “2025 has been brutal for a lot of us, and that IRYS drop literally helped me pay bills when I needed it most. At the same time, I’m gutted seeing what’s happening in the community right now.”

Similar Case: aPriori (APR) Airdrop

The IRYS issue is similar to an earlier problem with the aPriori (APR) airdrop. In that case, Bubblemaps discovered that almost 60% of the APR tokens were claimed by one unknown group using 14,000 connected wallets.

Later, investigators found that 80% of the tokens on BNB Chain went to about 5,800 wallets linked to a single cluster. aPriori had lowered its eligibility rules to make the airdrop easier for real users, but this also made it easier for Sybil farmers to take advantage. The company said no team or foundation members were involved, but the damage to the airdrop had already happened.