Sybil attack

The term was coined by John R. Douceur in his paper The Sybil Attack, presented at the IPTPS workshop in March 2002. The name refers to Sybil, a clinical case of multiple identity disorder. The paper's key result is blunt: without a logically centralized authority certifying identities, Sybil attacks are always possible except under unrealistic assumptions about resource parity and coordination among entities. The attacker generates many identities at near-zero cost and uses them to surround and isolate a victim node, inflate weight in a vote, capture an airdrop with thousands of wallets, or skew P2P routing tables.

The Sybil attack defines the threat that justifies every Sybil resistance mechanism. It is the cheapest, most pervasive attack in open systems with no identity cost, and understanding its mechanics is the first step to designing robust networks and token distributions. As good practice, teams measure the cost of creating an identity and deliberately raise it with computation, stake or verification.

In practice, mass airdrop farming through thousands of wallets is a recurring pattern, and several teams analyze and filter addresses linked to a single entity before distributing. Sybil and eclipse attacks have also been documented on Bitcoin's P2P network and against Ethereum nodes. The defense always comes down to making identity creation expensive, which is exactly what Proof of Work, stake or verified identity provide.