Apriori, a trading infrastructure startup backed by Binance founder Changpeng Zhao’s venture firm, is under fire after onchain records showed suspicious activity surrounding the project’s recent token airdrop.

On October 23, Apriori conducted the airdrop, which was meant to distribute the project’s APR token among its community and contributors.

But an analysis shared with and reviewed by DL News found that approximately 80% of the tokens on BNB ($991.65) Chain were claimed by a single clustered group of more than 5,800 wallets.

The activity has all the hallmarks of an industrial scale Sybil attack, a strategy where attackers deploy multiple wallets to repeatedly claim airdrops.

The timing surrounding the activity is also suspicious as whoever is behind the wallet cluster set it up before the airdrop and its eligibility requirements were public knowledge.

Apriori and its founder Ray Song did not respond to multiple requests for comment.

$30m project

The incident risks damaging Apriori’s reputation before the project has even launched.

Apriori’s APR token trades at a $93 million market value, down 60% from its all-time high on October 23, according to CoinGecko data.

Apriori is developed by former Jump Trading, Coinbase and Citadel Securities engineers. It has raised a total of $30 million from venture firms including YZi Labs, formerly Binance Labs. Other investors include HashKey Capital, Pantera Capital, and Primitive Ventures.

YZi Labs, HashKey Capital, Pantera Capital, and Primitive Ventures did not respond to requests for comment.

Apriori aims to build an execution layer for onchain crypto markets using high-frequency trading practices. This, the project says, will increase efficiency and reduce the potentially harmful impact of maximal extractable value strategies.

Suspicious transactions

Apriori has ties to Monad, a highly-anticipated Ethereum-compatible blockchain, and is building a liquid staking platform on the Monad testnet.

The expectation among the Apriori community was that the airdrop would take place on Monad when the blockchain launches later this year.

But on October 22, Apriori announced instead that it would launch its token on Ethereum and BNB Chain, the Binance-affiliated blockchain.

Onchain records show that between October 19 and 20, many wallets in the 5,800 cluster were funded with small amounts of BNB needed to execute airdrop claim transactions.

That’s days before Apriori announced publicly that its airdrop would be claimable on BNB Chain. This raises questions about how the person controlling the cluster knew to prepare wallets on BNB Chain in advance.

All 5,800 wallets had received BNB tokens from the same 13 wallets in the weeks leading up to the airdrop. It’s unclear who owns those 13 wallets.

Several other onchain researchers have also conducted analyses of the airdrop that show similar suspicious activity and a lopsided distribution of tokens.

The wallets became eligible for the airdrop by buying Apriori’s testnet token on the Monad testnet in early October. The testnet tokens have no value, and the eligibility criteria for the airdrop were only publicly revealed on October 22.

These wallets had no prior transaction history of receiving funds from Binance, and no prior transaction history on the Monad testnet before buying up the testnet token.

Sybil attacks

Airdrops are a popular way for crypto projects to incentivise users and reward those who contributed to a project’s early success.

But because they reward users with valuable tokens — sometimes worth tens of thousands of dollars — they’re a target for so-called Sybil attackers.

These buccaneering users create hundreds, if not thousands, of wallets to claim airdrops multiple times.

A prominent Sybil attacker previously told DL News he had made over $10 million through such strategies.

In some previous instances, insiders were responsible for Sybil attacks on their own project’s airdrops.

Tim Craig is DL News’ Edinburgh-based DeFi correspondent. Reach out to him with tips at tim@dlnews.com.