Bots Farm: The Invisible Enemy Threatening Encryption Airdrops

In a refrigerated warehouse in the suburbs of Ho Chi Minh City, Mirai Labs CEO Corey Wilton witnessed the astonishing scale of cryptocurrency Airdrop abuse. In this room, which is only the size of a one-bedroom apartment, nearly 30,000 smartphones were piled up.

Wilton has wanted to witness this behind-the-scenes operation mode for four years, which had a devastating impact on the NFT horse racing game Pegaxy that he led in 2021. At that time, Pegaxy's daily active users peaked at 500,000, but then came a large number of reports about "Bots farms." These Bots could control hundreds of accounts simultaneously, quickly buying high-win-rate racehorses and repeatedly entering races to earn game currency, ultimately cashing out in reality.

Pegaxy was originally an automated racing game where 15 horses compete. However, the emergence of Bots farms has transformed the game from "who can win" to "who can extract value faster," distorting the game atmosphere and accelerating the project's decline.

In May of this year, with the assistance of a former Pegaxy player, Wilton finally had the opportunity to exclusively visit a "highly specialized mobile phone farm" in Vietnam. Located in a remote area, the interior of this tin shed is filled with metal racks, each densely packed with thousands of smartphones, leaving only narrow passages for employees to walk through, resembling a "knockoff" encryption mining farm.

This farm offers rental services, allowing customers to rent equipment according to their needs. Unlike traditional Bots servers, each mobile phone here is equipped with an independent SIM card and device fingerprint, and can also disguise its IP geolocation, making it harder to detect. Mobile phones have a high cost-performance ratio between computing power and cost, and a single device can be quickly replaced if damaged.

In the case seen at Wilton, an operator controls a "master phone" via a computer, which is connected to more than 500 "slave phones". All operations of the master phone are synchronously copied to the slave devices. The client base covers both Web2 and Web3 industries, including K-pop agencies boosting traffic and casinos simulating real players.

However, the core business of the farm is "manufacturing". They acquire damaged or old smartphones at low prices, and through refurbishment, package them into "self-service mobile farm" equipment for sale overseas. They can produce over 1,000 deployable farm phones each week, with each "mobile farm kit" containing about 20 devices.

This large-scale operation explains why "bot-assisted encryption airdrop mining" has become a persistent issue in the industry. By creating a large number of wallet addresses and faking user behavior, these operators obtain free tokens that should have been awarded to genuine early users. Although most airdrops do not require phone number verification, unique device fingerprints and IP addresses can still bypass anti-bot attack mechanisms.

Such behavior often leads to tokens being quickly sold off, impacting market prices, and making it more difficult for real users to obtain Airdrops. Many projects see a large amount of fake activity before the Airdrop, and after the Airdrop is completed, the number of users and token prices often drop sharply.

Last June, the Airdrop of the Ethereum Layer 2 scaling project ZKsync was subjected to a massive Bots attack. "Airdrop hunters" collected over 3 million ZK tokens through 85 wallet addresses, worth $753,000. Additionally, another user publicly bragged about making nearly $800,000 using an "efficient $ZK witch attack strategy."

ZKsync responded that the current witch attack strategies are becoming increasingly complex, making it difficult to distinguish them from real users; overly strict filtering may mistakenly harm a large number of real users. A certain trading platform stated that the behavior patterns of AI-driven Bots are closer to humans, as they can highly simulate real people in browsing habits and interaction times, greatly increasing the difficulty of identification.

Daren Matsuoka, a data scientist at a16z Crypto, believes that witch attacks are a problem that has only emerged in recent years. In the past, the high Gas fees provided a natural resistance to witch attacks for Layer 1 chains, but with infrastructure optimization and a significant reduction in operational costs, the dynamics of offense and defense have changed.

Eddy Lazzarin, the CTO of a16z Crypto, emphasized the importance of building a "proof of humanity" mechanism. He proposed the concept of "proof of personality": allowing real humans to easily and freely verify their identities while making it costly for bots or fraudsters to commit large-scale forgery. The iris scanning verification of the World project is a typical example.

However, Ethereum co-founder Vitalik Buterin pointed out that "one person, one ID" is not a perfect solution. It may bind all historical behavior to a single attack point, which poses a great risk once leaked. At the same time, biometric and government identity information itself may also be forged.

Although airdrops can be manipulated, they still have their significance. Airdropping tokens to real users helps achieve decentralization of project governance and disperse control, while also generating buzz. Lazzarin stated: "Airdrops are essentially a marketing tool."

Wilton also agrees with this view, believing that project teams should anticipate that some users will sell their tokens, which is a part of the marketing cost to acquire users. The key is to ensure that these users are real people and "willing to stay in the long term." A certain trading platform believes that in some scenarios, if used properly and transparently, automated Bots can actually play a positive role, such as providing liquidity, executing user strategies, or conducting stress tests.