Preconditions
- You have prepared the wallet addresses for analysis, and can access full transaction records of multiple addresses via blockchain explorers (such as Etherscan) or professional on-chain data tools.
- You understand the core "pseudo-anonymity" property of blockchain addresses: addresses are not directly tied to real-world identities, but their on-chain activity can reveal hidden correlations.
Matching balances across addresses do not automatically confirm they are controlled by the same group of bots. However, the combination of fully identical balances, near-simultaneous creation time, and highly similar interaction patterns is a key red flag for identifying address clusters.
It is impossible to confirm address correlation based on identical balances alone. To determine if a single entity controls multiple addresses (known as Sybil addresses), you need to conduct a comprehensive analysis combining the full lifecycle behavior of the addresses, their fund sources, and transaction network structures.
Step 1: Check for Highly Aligned Lifecycle Timelines
[What to do]: Compare the first transaction timestamp, first gas fee receipt time, and first activity participation time across all target addresses.
[How to do it]: Pull the first transaction record of each address on the blockchain explorer and record its exact timestamp.
Situation A: If the first transactions of all addresses fall within the same hour, and their first gas fee receipt times are also in a close range, this is a high suspicion marker. Sybil addresses are usually created in batches in a short window, and activated right before airdrop snapshot deadlines.
Situation B: If address creation dates are spread across different periods, and each address has a distinct active usage period of varying length, the pattern is far more consistent with real user behavior.
[Completion Criteria]: Clearly map the "lifecycle start point" of each address, and verify if they present a clustered distribution on the time axis.
Step 2: Verify if All Initial Funds Come From the Same Distribution Contract
[What to do]: Trace the initial funding source of each address, to confirm if all addresses received their starting capital from the same upstream address.
[How to do it]: Check the first incoming transaction of each address on the blockchain explorer, and trace back the originating fund address.
Situation A: If the first deposit for all addresses comes from the same "distribution contract" or the same upstream wallet, this is a high suspicion marker. This almost always indicates the addresses were generated in batches by a single entity that distributed seed funds to them.
Situation B: If funding sources are scattered, coming from crypto exchange withdrawals or independent individual wallets, the addresses have very low risk of being part of a controlled cluster.
[Completion Criteria]: Confirm whether all target addresses share the exact same root funding source.
Critical Warning: Many crypto projects now use address clustering technology paired with machine learning models to detect Sybil addresses, with detection accuracy exceeding 90%. Even if you run multiple addresses that you believe hold separate identities, project teams can still group your addresses into a single cluster via transaction network topologies (such as star structures or chain structures) and disqualify them from airdrops.
Step 3: Check for Overly Regular Transaction Patterns
[What to do]: Compare operation habits across addresses including interaction frequency, transaction amount ranges, and gas fee settings.
[How to do it]: Review the full transaction history of each address, and pay close attention to the following details:
Situation A: If operation times across addresses are highly synchronized (for example, all complete the same number of interactions within the exact same 1-hour window), with nearly identical transaction amounts and gas fee parameters, this is a high suspicion marker. Real users have natural, random variations in their operation habits, while bot-controlled addresses show almost uniform operation patterns.
Situation B: If each address has clear, distinct variations in interaction timing, transaction amounts, and activity frequency, the pattern matches real user behavior.
[Completion Criteria]: Clearly identify if the addresses show "copy-paste" level similarity in their operation patterns.
Common Misjudgment Causes
Many analysts immediately mark addresses as bot-controlled solely because they hold identical balances. But it is not uncommon for real users to hold similar balances across multiple wallets, especially for risk diversification or to participate in multiple decentralized projects. The core basis for judging if addresses are controlled by the same entity is behavioral consistency, not matching balance numbers.
Post-Analysis Validation Method
Use on-chain visualization tools such as Bubblemaps, input all target addresses, and check if they form a single color-coded cluster or a dense connected area on the bubble chart. If multiple addresses are grouped into the same cluster on the visualization, it confirms there is verifiable on-chain correlation between them.
Next Step Actions
If you confirm that the set of addresses belong to the same controlling entity (whether yours or a third party's), treat them as a single whole rather than multiple independent individuals when analyzing market behavior. Especially when assessing airdrop eligibility, review the project's public Sybil detection rules in advance to avoid accidental disqualification. For additional verification, Bubblemaps' Magic Nodes feature can automatically reveal hidden links between related wallets.
