From time to time, major exchanges hold various events to attract new users, increase user activity and attention on the exchange, launch new coins, and so on. No matter what the intention is, the exchange certainly does not want a user to control a bunch of accounts and pretend that they are eligible for the exchange's intention and start sybil attack. Now let's analyze the sybil attack situation of recent activity on the FTX exchange.

Introduction to the analyzed activity (approx. 66% multi-bonus-getting users content):

This is a recent launch of FTX's Euro stable coin top-up prize pool.

1. Activity target group: FTX.COM and FTX Pro users who have passed Level 2 KYC identification requires name date of birth, address, English name, phone number and SMS authentication, description of source of funds, passport or other government-issued identification (front and back), which also includes face recognition. In terms of results, KYC is of limited use for sybil attack prevention.

2. Get the bonus conditions: if you make a net top-up of more than 100EUROC to the FTX wallet during the campaign period, you will get the bonus.

3. Event period: July 29th 14:00 UTC to August 12th 14:00 UTC Campaign Bonus: Bonus per user = 150,000 EUROC / Total number of eligible users Since a top-up of more than 100 EUROC is counted as one user, the sybil attackers have the will to control a large number of accounts to increase the final percentage of the bonus

4. Activity links:

   https://help.ftx.com/hc/en-us/articles/8073943197076-Deposit-100-EUR-fiat-or-EUROC-to-share-a-pool-of-150-000-EUROC-

The analyzed activityThe following chart shows the number of addresses deposited to EURO coin before and after de-duplication, which shows that during the campaign there were many cases when one address gave deposits to multiple addresses. In the graph below, the blue line shows the number of addresses before the de-duplication, and the green line shows the number of addresses after the de-duplication.

Data to be analyzed: FTX exchange EUROC currency deposits, cumulative deposits greater than or equal to 100EUROC will be considered, upward tracing of data within 5 hops

Analysis of judgment criteria: If A address deposit EUROC to B address , A and B is considered a two-person group. If A and B is a group, B and C is a group, then ABCD is a group. A group can also be commonly understood as a group of people who have had a direct or indirect EUROC transfer relationship during the activity. The final implementation uses the Union-Find Algorithm - all addresses that have made EUROC transfers to each other during the campaign are placed in the same group, and after eliminating non-exchange addresses the final group corresponding to the FTX exchange users is obtained. Then the hot wallet addresses of contracts and exchanges are excluded.

The funding flow tracking algorithm used: a fusion of depth-first algorithm and width-first, which can be understood as a simple version of the network flow. The user's funding stream is tracked in one or more hops according to the timeline.

Analyzing from the perspective of on-chain information, the case of the same person topping up to different accounts to get more rewards during the activity period just corresponds to the case of topping up EUROC to different accounts of FTX from the same address.

So first, analyze the aggregation behavior of FTX based on the on-chain information to get the most recent aggregation address of FTX, then invert all the user addresses based on the characteristics of aggregation, and finally analyze the deposit behavior of these user addresses to EUROC during the campaign period. The following figure is a group that can be analyzed in one jump, whose tail number is 8b5c.It directly deposited 100EUROC to four FTX exchange user addresses in order to obtain more bonuses.

But analysis of one-step based transfers, can only analyze the case of a person directly using the same address to FTX multiple users to play money. If the person is a little smarter, in order to avoid tracking, he chose to send money to several different addresses at first, and then let these addresses send money to FTX exchange.We can not detect this situation.

For example, this figure below shows the group. This address with suffix of afac can be said to be very clever . He perfectly bypassed the detection of one hop. This example is a good illustration of the necessity of analysis of multi-step based transfers.

But this algorithm can also lead to some minor problems, such as if the hot wallet of the outgoing funds from Exchange A is traced, it will lead to all users of Exchange A being detected as a group, because the outgoing funds from the exchange are made through a large pool called the hot wallet.

We have to do something to prevent this misclassification from being discovered, so if we identify it as an exchange hot wallet address (yes, we can identify it as an exchange hot wallet address, and by transferring money to >100 people in a short period of time at that address and some other judgment conditions, we can also determine which exchange it corresponds to), then we will stop the tracing and will not group the groups into one as a result.

Moreover, if we encounter a smart contract address, we will not put the addresses that have interaction with this contract into the same group.

Group Type 1

These groups do not hide their actions, perhaps with confidence in the benevolent generosity of FTX. He directly topped up multiple FTX wallets greater than or equal to 100EUROC in some one- step transfers. if FTX does not take any anti-fleece measures, he will be a fully loaded winner of this game.

Group type 2

This type of group has a portion of funds that are directly topped up and then called to several other addresses to get them to participate in the activity as well.

Group Type 3

This group variety, which I call the smartest attackers, perfectly circumvented the detection of analysis of one-step based transfers, but still had a little less patience, were detected after the analysis of multi-step based transfers. The size of this group is 10.

Group type 4

As shown below, 0x2551f92a90914a813798b56530ab82fa704482e0 controls 366 FTX wallets, which means that his earnings are 87980.7636 EUROC, or 58.65% of the total prize pool. The vast majority of this group's direct top-ups were in the amount of 101EUROC, associated with 12 FTX users.And the rest were first allocated n 101EUROC to an intermediate address, which then topped up the money to the corresponding multiple FTX accounts. All top-ups occurred on August 9, 2022. The source of their funds all originated from address 0x2551f92a90914a813798b56530ab82fa704482e0.

The intention of FTX is to have more real users join this campaign, on the one hand, to have new users, and on the other hand, to have more people accept and use the Euro stable coin. However, because of the existence of sybil attack, most of the prize money went to the hands of attackers. At the same time, the interests of real users are also very much damaged, the bonus pool that should belong to real users is divided by the devil a large part. If FTX had the ability to identify witches, the woolly party of this event would not be so simple to attack directly, so presumably FTX would not filter them. This also illustrates the importance and necessity of the basic risk control service of anti-wool from another perspective.

A simple calculation, FTX's bonus pool is 150,000 EUROC, a total of 624 users with cumulative recharge greater than or equal to 100 participated in this activity. The final analysis shows that there are a total of 442 user addresses which belong to attackers, excluding groups below the size of 5, a total of 414, or 66.35%, normal users only account for 33.65%. In other words, 99525EUROC were given to the attackers for no reason, and I can already imagine FTX's face after losing so much money because of the wool party.

Now let me imagine the expressions of the users. If the prize was awarded to 624 users, each user would have received 240.3846 EUROC, but if FTX had taken the war seriously, eliminated the wool players and awarded the prize to 210 real users, each user would have received 714.2857 EUROC. Users lost 473.9011 EUROC. which is about twice the amount the user really got.

P.S. If there is a need for related testing or anti-sybil attack services, please do not hesitate to contact us directly. We sincerely hope we can help you.

Appendix: The following is a summary of FTX users whose belong to attackers