Airdrop Advanced Strategy: Survival Rules Through the Witch's Fog
In the current environment of rapid development of AI+ on-chain analysis technology, the detection methods of witches are becoming increasingly precise, and simple batch operations are becoming less effective.Author: 0x老董
Core Rules for User Selection by Project Teams
When designing airdrop strategies, project teams rarely rely on a single standard for selection; instead, they evaluate user quality from multiple dimensions to ensure that airdrops are distributed to truly valuable addresses. From the perspective of project teams, they prefer high TVL, high-net-worth users, and genuine active users who can participate in ecological construction over the long term. Based on these principles and combined with the strategies of historical airdrop projects, Lao Dong summarizes several core selection dimensions.
- Interaction-Based Selection Criteria
Transaction frequency, transaction volume, and activity: Reflects the user's level of activity on-chain. Frequent trading and deep interactions indicate a certain level of investment in the ecosystem, but excessively high data may also indicate wash trading behavior. For example, Starknet W's long and wrong trades.
Gas consumption: The total amount of transaction fees paid by users can indirectly reflect their actual participation and contribution. For example, Zkfair distributes airdrops based on gas consumption; currently, Morph distributes points through gas.
Contract interactions & creation: Can be used to measure whether users participate in multiple ecological projects, helping to distinguish genuine users from mere wash traders. For example, arb and zksync both have weighted contract interaction counts.
- NFT & Asset-Based Selection Criteria
Whitelists, public sales, task acquisition: Generally, such NFTs are limited in quantity, which can control deflation and serve as a certificate for airdrops, also representing a higher level of user participation in the project. For example, XAI distributes airdrops based on NFTs.
OAT badges and SBT: As on-chain achievements or non-transferable identity certificates, they can effectively prove users' long-term contributions and genuine participation. For example, the pilot OAT from odos and the LXP from linea.
Token holding airdrops, NFT staking: Holding tokens or staking NFTs not only shows users' trust in the project's assets but may also bring additional incentives, while also helping to assess the quality of users' assets and risk control. For example, the NFT airdrop tokens from MOCA and PENGU.
- Points Tasks and Task Platforms
Points accumulation and ranking: Completing tasks on platforms like Galxe, Zealy, or the official platform itself to earn points; the higher the points, the higher the participation level. At the same time, points ranking can serve as an important basis for airdrop distribution. For example, IO's Galaxy points task, SCA's points airdrop, and many LSD project points airdrops.
Cross-ecological tasks: Requiring users to complete tasks across multiple platforms or ecosystems to comprehensively assess users' overall activity and ecological contributions. For example, many Odyssey tasks, move, and linea require completing various ecological tasks to earn rewards.
- Community and Social Contributions
Twitter/Discord/Telegram activity: Users complete social tasks in communities, such as tweeting and retweeting, or speaking and participating in discussions on DC and TG, thereby obtaining corresponding identity markers. This type of task is relatively complex and has high airdrop value. For example, the current kaito obtains points through Twitter interactions, and the move gorilla character is worth thousands of U. Dogs distribute airdrops based on TG account age and activity.
Early members (OG roles) and invitation contributions: Users who joined early or were invited are more likely to receive airdrops to incentivize long-term participation, such as the OG roles in IP with thousands of token airdrops.
Content creation and social media interaction: Promotion and discussion on platforms like Twitter, Medium, and YouTube help spread the project while also reflecting users' recognition of the project. For example, the creator role in move.
- Node Building and Technical Contributions
- Full nodes, mining, validators: Technical participation such as running nodes, participating in mining, or serving as validators directly supports network security and performance, which is highly valued by project teams. For example, IO's worker uses GPUs to mine points, nillion nodes run on CPUs, and grass obtains points through IP and traffic.
- GameFi and Entertainment Interaction
Gold farming, P2E: Earning tokens through in-game tasks in GameFi projects reflects users' participation and indicates their reliance on the project's entertainment ecosystem. For example, CATI earns tokens by raising cats. Large games like bigtime earn tokens through in-game gold farming.
Attack and defense confrontation: Witch detection dissection and counter-strategies.
Project Teams' Witch Identification Strategies
In the previous article's data analysis, among 100 projects in 2024, the proportion of those explicitly checking for witches reached 32%.
In airdrop activities, the core essence of project teams checking for witches is also a selection method to filter out high-quality, genuine, and highly contributive addresses, avoiding airdrops being occupied by large-scale, low-quality addresses. This is not solely targeted at studios; even individual users may be regarded as witch addresses due to reasons such as inability to maintain interactions. Just as project teams continuously optimize selection rules, studios can still achieve good results. Therefore, understanding the methods project teams use to check for witches and adopting corresponding defensive strategies is key to ensuring good results. Here, Lao Dong lists some obvious types of witch risk.
Witch Defense Tactics Manual
- Address Creation & Abnormal Fund Flow
Project teams will prioritize checking the creation time, recharge path, and fund aggregation of addresses. Such address aggregation behavior is one of the easiest ways to be flagged as a witch, with main tactics including:
Creating multiple addresses on the same day: If a large number of new addresses are created and funded on the same day, they are likely to be marked as batch witch accounts.
One-to-many or many-to-one: Transferring funds from the same address to multiple small accounts, or aggregating funds from multiple addresses into the same wallet, is viewed as abnormal fund distribution.
Similar amounts recharged in a short time: If multiple addresses recharge similar or close amounts at similar times, they may be judged as operated by the same controller.
Bulk withdrawals in a short time: If funds from multiple addresses are simultaneously withdrawn to the same wallet, it is a high-risk behavior.
Prevention strategies:
When creating new addresses, create a small number of accounts each day and randomly select recharge times to avoid concentrated operations.
Use CEX (Binance, OKX, etc.) sub-accounts as transit stations to avoid direct aggregation on-chain.
Randomize the amounts and times of fund recharges to avoid fixed amounts and fixed times for bulk operations.
Space out withdrawal times and try to use different CEX sub-addresses for withdrawals.
- Abnormal On-Chain Interaction Behavior
Project teams will analyze the interaction patterns of addresses, collectively referred to as homogenized interactions, focusing on the following behaviors:
Similar NFTs or domain names: If multiple addresses receive the same NFT or domain name, they are easily recognized as batch operations.
Similar transaction frequencies: If multiple addresses have similar interaction counts and contracts, they are likely to be judged as bot operations.
Identical transaction sequences & amounts: If the interaction order, amounts, and transaction targets of addresses are the same, they are likely to be identified as batch accounts.
Fixed-time interactions: If multiple addresses' interaction times are concentrated within a certain period (e.g., completing tasks within 24 hours), the risk is high.
Prevention strategies:
Use different accounts to complete different tasks, spacing out interaction times to avoid simultaneous identical operations.
Insert "smoke bomb projects" during interactions, such as participating in some DEX interactions, lending, and other low-cost dapps to make on-chain behavior more natural.
Randomly interact with different contracts; do not have all accounts interact with the same DEX, bridge, or contract. Select a portion of addresses to interact with a portion of contracts.
Space out interaction times throughout the 24 hours, randomizing interaction times instead of fixed-time bulk synchronous operations.
- IP and Off-Chain Data Analysis
In addition to on-chain data, project teams will also analyze IP addresses, UI interface interactions, browser fingerprints, and social media data to screen for witches through off-chain data:
Same IP / same device: If multiple accounts use the same IP or browser fingerprint, the risk of being detected as operated by the same person is extremely high.
Similar social media behavior: If multiple Twitter accounts have similar posting content, liking sequences, and interaction patterns, they are likely to be excluded by project teams. DC inactivity may lead to being kicked from channels.
Email associations: Multiple accounts using similar email naming conventions may trigger risk control.
UI interface checks: Directly interacting through contract interactions without engaging in the project's UI interface may trigger risk control in some projects, such as Electric Sheep.
Prevention strategies:
Use proxy IPs and fingerprint browsers to change device information.
When nurturing accounts, pay attention to the randomness of social interactions to avoid homogenized content.
Use different emails for registration to avoid overly similar email naming.
Try to use front-end interaction scripts to avoid being detected through the UI interface.
Gradient Strategy: Reasonable Account Allocation to Reduce Detection Risks
To improve airdrop success rates, it is recommended to adopt a gradient strategy, categorizing different types of accounts to avoid all accounts being subjected to the same pattern and facing collective bans. Currently, project teams are increasingly favoring premium accounts, with ZK's minimum and maximum addresses differing by 100 times in rewards, STRK differing by 20 times, and ARB differing by 16.32 times. From a ZK perspective, creating 100 premium accounts is equivalent to the earnings of 10,000 low-quality accounts, which can reduce effort while also lowering witch risks. However, low-quality and lottery accounts are also necessary; for example, Tensor and Magic Eden represent victories for low-quality accounts, while HMSTR represents a victory for lottery accounts, shining brightly. Different strategies lead to completely different outcomes.
Premium Accounts (no cost considerations, focus on nurturing accounts) - Each dimension should reach at least the top 1%
High-quality interactions, participation in multiple ecosystems, binding social accounts, providing human proof, such as Gitcoin.
Personal use wallets, small but premium, increasing contributions to the on-chain ecosystem.
Simulate real user behavior, operate long-term, and avoid one-time airdrop grabs.
Low-Quality Accounts (minimum airdrop threshold, moderate operations) - Each dimension should reach at least the top 20%
Only participate in core airdrop tasks, avoiding obvious witch operations.
Moderate trading, avoiding overly frequent or regular interactions.
Lottery Accounts (batch accounts, low-cost trial and error)
Only perform simple, cost-effective tasks, strictly controlling costs.
May adopt more aggressive and bold strategies, but will not affect the main accounts.
Conclusion
In the current environment of rapidly developing AI and on-chain analysis technology, witch detection methods are becoming increasingly precise, and simple batch operations are becoming less effective.
Therefore, for studios, witch operations need to possess higher randomness and realism, while also flexibly adjusting strategies, combining gradient accounts, decentralized interactions, and optimizing fund paths to reduce the probability of being banned.
For individuals, if lacking the operational capabilities of a studio team, it is recommended to focus on a small number of premium accounts for refined operations, participating in multiple ecosystems, increasing social activity, and building a genuine identity chain to enhance airdrop returns. Only by knowing oneself and the enemy, mastering core selection logic, and flexibly adjusting operational methods can one remain undefeated in airdrop activities!
