IRYS launched this week with momentum, hype, and a clean narrative: a decentralized data infrastructure layer branded as “the on-chain AWS.”
Backed by more than $13M raised from VCs, the project promised cheaper, faster, and more resilient data rails for Web3.
But within 48 hours of launch, a much different story surfaced.
According to new research from @bubblemaps, a cluster of 900 near-identical wallets claimed 20% of the IRYS airdrop, then funneled millions in tokens straight to Bitget, raising fresh concerns around Sybil attacks, pre-funded wallets, and fairness in major token distributions.
Already, $4M worth of IRYS has been moved to Bitget.
And the pattern behind the wallets is difficult to ignore.
The Airdrop: Designed for Early Users, Quickly Exploited
Two days ago, IRYS launched its token with an 8% airdrop reserved for early users, a reward meant to celebrate organic adoption and decentralization.
Instead, it appears that a coordinated cluster slipped in just before the cutoff.
Someone claimed 20% of the $IRYS airdrop
Using a cluster of 900 identical wallets funded just before launch
$4M already sold 🧵 pic.twitter.com/Xas2AjZoxn
— Bubblemaps (@bubblemaps) November 28, 2025
@bubblemaps’ analysis shows:
- 900 addresses funded immediately before launch
- All funded through Bitget
- Wallets receiving near-identical ETH amounts
- No prior on-chain activity
- All claiming IRYS as soon as the airdrop opened
In other words, the exact fingerprints of a Sybil operation.
The total haul?
Roughly 20% of the entire airdrop allocation.
For a project positioning itself as a core data layer for Web3, that’s a worrying start.
How the Wallet Cluster Was Built
The timeline is precise.
Between Nov 21 and Nov 24, Bitget sent ETH to batches of fresh wallets, 20 separate funding waves, each consisting of roughly 50 addresses.
Every address:
- Was brand new
- Had zero on-chain history
- Received almost identical ETH amounts
- Appeared within tight time windows
- Claimed IRYS immediately at launch
This is not organic user behavior.
This is systematic preparation.
The fact that all 900 wallets followed nearly identical steps, from creation to funding to claiming, is what triggered the red flags.
$4M Already Sent Back to Bitget
What happened after the claims further confirms the pattern.
Roughly 500 of the 900 wallets executed the exact same sequence:
1. Claim IRYS
2. Move tokens to a fresh intermediary wallet
3. Route everything to Bitget
4. Likely execute a market sale
As of today, more than $4M in IRYS has already hit Bitget.
That means nearly half of the Sybil cluster has already cashed out.
The rest remains in motion.
While the data points to a highly coordinated farm-and-dump structure, there is currently no evidence linking the IRYS team to the wallets.
The research only establishes:
- the behavior,
- the timing,
- and the routes of funding and disposal.
The actor behind the operation is still unknown.
IRYS: A High-Profile Launch Now Under Pressure
The timing couldn’t be worse.
IRYS entered the market with strong positioning, a decentralized storage and data network aimed at providing:
- lower costs,
- faster access,
- fully on-chain compute pipelines.
VCs backed the vision with more than $13M, positioning IRYS as a major infra player heading into 2025.
But now the conversation is dominated by Sybil clusters, not technology.
The optics matter:
- A brand-new token
- Supposed to reward real users
- Instead, millions siphoned by clean, pre-funded wallets
- All linked to a single CEX funding source
Fairness questions hit hard in the days after launch, especially when token price discovery is still underway.
Sybil Problems Aren’t New, But This Scale Is
Airdrop exploitation is not new in crypto.
But the industrial scale of this one stands out.
The numbers tell the story:
- 900 brand-new wallets
- 20 coordinated funding batches
- Identical ETH deposits
- Simultaneous claiming behavior
- 20% of the airdrop captured
- $4M already off-ramped
This is not one actor clicking fast.
This is structured farming.
Bitget’s role as the funding and withdrawal rail also introduces a new layer. It’s not evidence of wrongdoing, but the consistent routing through one exchange highlights how centralized hubs can serve as infrastructure for Sybil attacks at scale.
What Comes Next: Investigation and Governance Vote
@bubblemaps has left the door open for further findings, saying there is “no evidence linking the team to those wallets” but confirming that investigation continues.
A case is now live on the Bubble Maps Intel Desk, and users holding $BMT can vote to push the case into public spotlight for deeper review.
That includes:
- tracing intermediaries
- expanding cluster mapping
- monitoring more Bitget routes
- analyzing disposal patterns
- and identifying links between wallet controllers
If the case receives enough governance votes, it becomes a front-page investigation inside the Intel Desk ecosystem.
Airdrop Fairness Is Entering a New Era
This IRYS incident marks yet another example of how sophisticated Sybil frameworks have become.
Airdrops were once a reward for early adopters.
Now they’re a battleground between:
- real users,
- bot farmers,
- institutional farming operations,
- and exchanges acting (sometimes unknowingly) as funding rails.
The scale of this IRYS cluster, 20% of a major airdrop captured through 900 wallets, shows how far the industry still is from solving fairness.
Sophisticated actors increasingly use:
- fresh wallets
- batch funding
- patterned claims
- fast liquidity exits
- high-volume exchange routing
And unless protocols enforce strong anti-Sybil models from day one, the same outcome repeats.
IRYS Still Has Room to Recover, But Trust Took a Hit
The IRYS team hasn’t been implicated.
The tech remains unchanged.
The roadmap is still intact.
But perception matters.
A project can raise millions, launch cleanly, and ship strong infrastructure, and still lose narrative control in 24 hours if the token distribution appears compromised.
For IRYS, the next few weeks will be critical:
- community response
- team transparency
- exchange cooperation
- and continued on-chain research
- will shape how investors and users view the network going forward.
For now, the data stands:
- 20% of the airdrop captured.
- 900 wallets.
- $4M sold.
- Cluster still under investigation.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!
