Sybil attacker will take 3026125 token ARB if the team do nothing!

[stanlagermin]

Hello, I found something interesting about this wallet address: 0x59d4087f3ff91da6a492b596cbde7140c34afb19

He made 2,417 transactions within 6 hours, that includes sending small ETH to 1656 different wallets :

Details: https://arbiscan.io/txs?a=0x59d4087f3ff91da6a492b596cbde7140c34afb19

And each recipient wallets, he made 2 interactions with ARB token contract:
For example,

1. 0x3E5A2B1020c454079f5A7702fa204752C584d6A0
   
   Tx: https://arbiscan.io/address/0x3e5a2b1020c454079f5a7702fa204752c584d6a0

2. 0x3aBeC2bbEc31c978a4a7e5b0cD2090cB759A0c01
   
   Tx: https://arbiscan.io/address/0x3abec2bbec31c978a4a7e5b0cd2090cb759a0c01

I check all 1656 recipient wallets above:https://github.com/stanlagermin/sybil-wallet-list/blob/main/sybil_wallets.csv
with: https://cointool.app/airdrop/arb

IT MAKES ME SHOCK!!!!!! 2800875 ARB TOKEN

I also recognize that every recipient wallet has at least one transaction relate to this wallet: 0xcc577C130c019529FF1e721F9BEeA24a7DC1402D

For example:

1. 0x3E5A2B1020c454079f5A7702fa204752C584d6A0
   
   Tx: https://arbiscan.io/tx/0x9556ae9962c8034eb98f3f817eb5ecbb6d3e588fb71c70b84dcc5247dfcda998

2. 0x3aBeC2bbEc31c978a4a7e5b0cD2090cB759A0c01
   
   Tx: https://arbiscan.io/tx/0x73e7f173ced28ab9aecf019d050609f2a85367917fce3bef56aa9b37f23d8fe7

From my point of view, that guy did all actions above is an airdrop farmer or a hacker because some people say that their wallet got hacked and being in a Sweeper-bot. Anyway, the team should do something to prevent getting at least 2800875 ARB Token from bad person.

[stanlagermin]

Update:

I take a look about this wallet: 0xcc577C130c019529FF1e721F9BEeA24a7DC1402D which is Sweeper-bot recipient wallet.
There are 2225 different wallets which sent ETH/Tokens to it, and 1791/2225 wallets is eligible for airdrop with total amount: 3026125 ARB

Here is the list of 1791 wallets which relates with Sweeper-bot address:
https://github.com/stanlagermin/sybil-wallet-list/blob/main/Sybil_wallets_update.csv

[Pizaru]

It's a waste of time to investigate. Team will not respond

[liangfenxiaodao]

The transactions above seem to be poisoning:

They happened 6 hours ago, long after the snapshot and announcement.
And the transaction amount are all super tiny, even cannot be used to pay gas.

[liangfenxiaodao]

To arbi team:

Please ignore such stupid things. There have been poisoning everywhere since Hop announced the anti-sybil rules. A tiny amount of transferring shouldn't be taken as sybil attack.

[bitcoinzhang1]

I randomly checked several accounts and found that their behavior patterns lacked similarity; Small transfers occur after the announcement of an air drop, which is more like poisoning

[stanlagermin]

Can you help me to explain this? every recipient wallet has at least one transaction relate to this wallet: 0xcc577C130c019529FF1e721F9BEeA24a7DC1402D

So all the wallet in the list get poisoning by send money to this address 0xcc577C130c019529FF1e721F9BEeA24a7DC1402D

Also, every recipient wallets made 2 interactions with ARB token contract at the same time. :) I think he prepare for claiming and send all ARB right before real owner try to claim the ARB.

The transactions above seem to be poisoning:

They happened 6 hours ago, long after the snapshot and announcement. And the transaction amount are all super tiny, even cannot be used to pay gas.

[ausername123-byte]

So all the wallet in the list get poisoning by send money to this address 0xcc577C130c019529FF1e721F9BEeA24a7DC1402D

[0xpeche]

It is not a sybil attacker, those are all compromised wallets:
https://twitter.com/0xPeche/status/1637639563743985665

Check the behavior on the addresses he funds, all of them had sweeping bots on them.

I can also confirm that by the fact that one of the victims contacted me for help.

[WillyamPangestu]

THAT'S NOT SYBIL'S ADDRESS!
BUT FB19 IS A HACKER ADDRESS THAT HAS COMPROMISED MANY PEOPLE'S WALLETS!

YOU CAN CHECK THE FLASHBOTS DISCORD, MANY PEOPLE ARE VICTIMS OF COMPROMISED WALLETS AND THE FB19 WALLET TX APPROVE ARB ON THE VICTIM'S WALLET.

AND THE BASTARD HACKER INTENDS TO STEAL THE ARB TOKEN WHEN THE CLAIM PROCESS IS OPENED.

PLEASE BLACKLIST THE BASTARD HACKER'S FB19 ADDRESS.

THE OTHER 1656 ADDRESSES ARE "VICTIMS" NOT SYBIL!

THANK YOU.

[achmadback]

nggeh

[misterkuye]

It's a hacker, he uses a sweeper bot on wallets. My wallet is among the victims of this.

0x81069f658da5fac80bbeee0023a21f0531d144dc

[PRATHAM181199]

They are not Sybil attacker Bro, my wallet also in this list because our wallets got hacked and hacker set sweeper bot to withdraw funds instantly u can check there no funds on any wallet , also try to send some small amount fund it will automatically transfer within seconds to the hacker address