The largest witch hunt in history comes to an end: LayerZero's elaborate anti-witch campaign上演prisoner's dilemma
TechFlow Selected TechFlow Selected
The largest witch hunt in history comes to an end: LayerZero's elaborate anti-witch campaign上演prisoner's dilemma
On May 30, LayerZero's weeks-long witch-purging campaign officially concluded.
Navigating Web3 tides with focused insightsAuthor: Nancy, PANews
On May 30, LayerZero's weeks-long witch purge officially concluded. While witch-hunting has become standard practice in project airdrops, LayerZero's elaborate anti-witch campaign turned into a crypto version of the "Prisoner's Dilemma."
In the classic "Prisoner's Dilemma," two suspects are interrogated separately after committing a crime. Due to insufficient evidence, police offer several options: if both resist, they each receive a 3-year sentence due to lack of proof; if both confess, they each get 5 years; if one confesses while the other resists, the confessor gets 2 years and the resistor receives 7 years.
Today, this quintessential game theory scenario became an accurate portrayal of LayerZero’s airdrop event. As a high-valuation leading project, LayerZero naturally attracted intense user farming activity. Yet before the community could celebrate any major rewards, a rigorous anti-sybil review arrived first.
Anti-Witch Competition Escalation: From Self-Reporting to Mutual Denunciation
Earlier this month, LayerZero announced a 14-day self-reporting program for sybil activities. In return, users who self-reported would receive 15% of their expected allocation, though these names would remain unpublished. Users identified as witches who failed to self-report would receive no token distribution.
To reassure users and demonstrate fairness, LayerZero later clarified that the self-reporting initiative targeted large-scale sybil operations rather than individual users, and that LayerZero employees were prohibited from claiming airdrops—any violation would result in immediate termination.
The self-reporting initiative saw significant participation. For many multi-account farmers and farming studios, self-reporting offered a way to salvage partial rewards instead of risking total loss upon detection. According to data released by LayerZero Labs, over 338,000 addresses self-reported during this phase, with more than 803,000 addresses preliminarily flagged as potential sybils. Each qualifying address received 15% of its expected token allocation, while the remaining 85% was redistributed to eligible users.
However, self-reporting was merely the appetizer. The bounty hunting campaign intensified the cleansing process into an escalating competition.
From May 18 to May 31 marked LayerZero’s bounty hunting period. According to LayerZero’s submission portal, a total of 3,550 reports were submitted.
Yet this hunt quickly spiraled into chaos, turning into a moral battlefield testing human nature. Under LayerZero’s bounty rules, reporters had to identify at least 20 addresses engaged in sybil behavior. Successful bounty hunters would receive 10% of the witch’s expected token allocation, with the remaining 90% returned to legitimate addresses. However, if the reported address was originally entitled to zero tokens, the hunter would also receive nothing. In cases of duplicate reports on the same address, only the first reporter would be rewarded. To prevent false positives, LayerZero allowed wrongly accused addresses to appeal via a form submission.
The program immediately sparked widespread community reporting. As previously revealed by LayerZero CEO Bryan Pellegrino, within hours of launch, over 3,000 witch reports and 30,000 appeals flooded in. The massive volume of spam caused numerous GitHub accounts to be suspended, forcing LayerZero to temporarily pause the bounty program just two days after launch. Pellegrino announced the introduction of a deposit mechanism: reporters would now need to stake 0.02 ETH to submit a report.
On May 28, LayerZero Labs reopened the witch bounty report submissions, increasing the deposit requirement to 0.5 ETH, with the campaign set to conclude within 48 hours (Beijing Time, 8:00 AM on May 30). This meant only addresses willing to post collateral could submit reports. Honest or successful submissions would have their deposits refunded after TGE. Reports involving plagiarism, fraud, flawed methodology, or spam would result in non-refundable and permanently burned deposits. Ethereum blockchain data shows that LayerZero collected over 240 ETH in deposits during the two-day restart period, equating to approximately 480 reports.
Driven by economic incentives, various reporting farces continued to unfold. Examples include farming studio employees quitting to report internal accounts, top airdrop recipients of certain projects being reported, users targeting clusters of whale/farming KOL sybil addresses, and rumors circulating that security firm Trusta had submitted 470,000 suspected witch addresses to LayerZero—all of which the firm denied, stating it would never report any address.
Image source: Community
Nonetheless, this reporting mechanism led to numerous false accusations. Bryan Pellegrino responded that anyone could include whatever they wanted in a report, but not every report was valid—meeting the threshold of "conclusive evidence" was actually extremely difficult.
@vga.eth's analysis titled “Analysis of LayerZero Witch Reporting” highlighted key points. Official criteria for identifying witches included: 1) Clusters of tens, hundreds, or thousands of addresses interacting together, showing clear fund flow patterns such as one-to-many transfers or multi-to-one consolidations; 2) Cross-chain transactions of $0.01 or less solely to increase interaction on a chain; 3) Mass minting of valueless NFTs to boost cross-chain interactions—small amounts are acceptable; 4) Use of popular sybil farming tools like L2Pass. Meanwhile, bounty hunters focused on: 1) Identical cross-chain transaction directions; 2) Addresses with consistent contract calls; 3) Uniform contract interaction habits and sequences, often withdrawing from the same centralized exchange account with similar amounts and timing; 4) Minimal mainnet interactions and low EVM-wide balances (under $200).
Currently, the final witch list remains undetermined, awaiting official review and announcement by LayerZero. However, based on Bryan Pellegrino’s earlier statements, only 6.67%-13.33% of the estimated 6 million addresses are expected to qualify for the airdrop. In his latest response to user inquiries, he stated, “90%-95% of the举报 reports must be valid, possibly even higher—though invalid reports are quickly ‘discarded.’ Nothing is perfect.”
With the witch hunt concluded, LayerZero participants now await their "judgment day."
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
PANews
