Bubblemaps, a blockchain analysis platform, recently revealed that a single entity allegedly siphoned off approximately 4 million dollars in tokens from the Avantis (AVNT) third quarter airdrop through over 300 addresses, causing an uproar in the community. This incident, suspected to be a Sybil Attack, highlights the significant challenges of fair distribution and abuse prevention in DeFi airdrops. This article will take you through the details of the incident, how to claim the third quarter airdrop, the rewards mechanism, and how to avoid becoming the next victim.

(Source: Bubblemaps)
Bubblemaps' on-chain analysis shows that the behavior of the involved wallets is highly consistent:
The source of funds is concentrated in the largest CEX exchange in the United States and comes only from a few known senders.
Claim the airdrop immediately after completing the transaction on Avantis.
Concentrate the tokens into a few wallets and transfer them to centralized exchanges like Gate.
Most wallets are idle for a long time before the Airdrop, and the capital injection and claiming model are perfectly aligned.
This behavior pattern is almost identical to the past MYX Airdrop attack, showing a high degree of collaboration and planning.
On September 16, the AVNT price is temporarily reported at 1.11 USD, having pulled back from the previous day's 1.56 USD.
Platform positioning: A decentralized leveraged trading platform based on the Base blockchain, supporting synthetic asset trading.
Token Use: AVNT is used for governance, staking, liquidity incentives, and community rewards.
Total supply: 1 billion tokens, of which part is used for airdrop, staking rewards, and ecological development.
Event duration: Starting from September 9, 2025, for a period of 60 days.
Eligibility: Active users who trade synthetic assets or provide liquidity on Avantis.
Standard Claim: Directly claim allocated tokens
Enhanced Claim: Pledging all airdrop tokens within the first 18 hours can earn an additional 35% rewards.
Unclaimed Token: Returned to the Avantis Foundation treasury after the event ends.
A Sybil Attack refers to an attacker creating a large number of false identities to gain disproportionate resources or power.
Risk: Disrupting the fairness of Airdrops, harming the interests of real users, weakening community trust.
Introduce KYC verification or reputation system
Raise the participation threshold (such as minimum trading volume, staking requirements)
Use on-chain behavior analysis to filter suspicious addresses
Airdrop can only be claimed through the official Avantis website or verified community channels.
If you plan to stake, be sure to complete it within the first 18 hours to receive additional rewards.
Beware of phishing websites and fake customer service to avoid leakage of private keys and mnemonic phrases.
The Avantis Q3 AVNT Airdrop was originally intended to reward real users and liquidity contributors, but the $4 million Sybil Attack incident has sounded the alarm for the DeFi Airdrop mechanism. For participants, this is both an opportunity to obtain rewards and a risk scenario that must be approached with caution. In the future, finding a balance between the spirit of decentralization and anti-abuse mechanisms will be a core issue that the entire cryptocurrency industry must address.