Citrea Found Out Who Was Real
Before a Single Token Went Out
Citrea brought ZeruAI its real candidate list, 1,981 wallets that all qualified on paper, and asked which of them were actually people. ZeruAI read every wallet, checked what each one did with the last airdrop it received, mapped the groups moving together, and returned a weight for every wallet with a written reason behind it.
Delivered before distribution, not measured after it
Four readings for every wallet on the list
Reputation
Behaviour unrelated to the airdrop
Retention
What it did with the last tokens it received
Automation
Read against 320M+ wallets as a probability
Coordination
The list read as a population, not one by one
183 Wallets Had Already Dumped
Someone Else’s Airdrop
The most useful thing to know about a wallet before you give it tokens is what it did with the last tokens it was given. That history is public and permanent, and almost nobody checks it.
Across Citrea’s list, 183 wallets were caught claiming an airdrop and selling it. None of those airdrops were Citrea’s. They were other distributions on Scroll, Optimism, Base, Ethereum and BNB Chain, in tokens including SCR, OP and XEN.
Every call is backed by transactions: 183 claim hashes and 162 confirmed sell hashes, each with a public explorer link in the file Citrea received. A separate sweep found 176 more wallets running the same claim-and-dump pattern that were not on Citrea’s list at all.
How Fast They Sold
Cumulative share of the 162 confirmed sellers, from claim to first sell
The median wallet was out in 16 minutes. The fastest registered a sell in the same minute it claimed. Every point is a pair of public transactions, not a model output.
Every Wallet Was Active
More Than Half Were Automated
These were not empty addresses padding a list. The median wallet had 2,868 transactions behind it and the busiest had 29,156, so every one clears an activity check. A signature only reads as a signature when you know what ordinary looks like, which is why each wallet is compared against more than 320 million others.
| Stage | Wallets | Share | Detail |
|---|---|---|---|
| Screened | 1,981 | 100% | Real candidate wallets. Median 2,868 transactions, busiest 29,156 |
| Carrying automation signatures | 1,094 | 55.2% | Read against a population of more than 320 million wallets |
| Flagged for coordination | 207 | 10.4% | Members of the 17 coordinated groups found in the pool |
| Caught claiming and selling elsewhere | 183 | 9.2% | Each backed by a public claim hash; 162 with a confirmed sell hash |
The sets overlap, so the shares do not add up.
17 Coordinated Groups
Covering 11% of the Pool
Past behaviour catches the wallets that already showed their hand. The harder question is who is about to act, and that is answered by reading the list as a population rather than one address at a time.
That view surfaced 17 coordinated groups. 12 were fully connected, meaning every wallet in the group was linked to every other one. The strongest carried a risk score of 0.83 out of 1.
Each of those wallets clears a per-wallet filter on its own. The structure only exists between them.
A group is not a verdict
Wallets moving together prove shared automation, not shared ownership. A custodian or a relayer can look similar. The group moves the unit of review from one wallet to the whole set, and hands a human the evidence to make the call.
The Highest-Risk Group
Nine wallets, every pair linked, one collection address
Nothing Was Banned
Everything Was Weighted
Automation and coordination came through as probabilities, not labels, so the consequence scales with the confidence instead of flipping at a line. 31% of the wallets with a readable history had already sold a previous airdrop, the single most predictive thing to know before giving anyone anything.
One Finished Row, Verbatim
User type: trader, restaker; dominant sector: DeFi App. Protocol breadth: active across 104 protocols. Retention: tends to hold received assets rather than quickly selling. 6 events; claimed 258.29 tokens; sold 1.81 tokens; holding 256.48 tokens (99% retained); confidence: High.
Every wallet in the allocation has one. A recipient who asks why they got what they got has an answer, and so does one who asks why somebody else got more.
Whales Did Not Eat the Pool
Share of the token pool by recipient percentile. No single wallet received more than 0.4%. In most points programmes the top 10% take the majority of the drop.
What This Means for Your Protocol
What the Citrea Engagement Shows
- 01
A large minority of any qualifying list is not there to use the protocol. In Citrea’s pool, 35% of wallets carried automation above even odds, 11% sat inside a coordinated group, and 31% of those with a readable history had sold a previous airdrop.
- 02
The evidence exists before the snapshot. The claim-and-sell receipts were written on-chain, by the wallets themselves, months before Citrea asked. Nobody had to be identified and nothing had to be self-reported.
- 03
The deliverable has to be defensible. Citrea received a weight for every wallet and a sentence saying why, so the allocation can be published and explained line by line.
What ZeruAI Provides
zDrop scores a candidate list against a corpus of more than 320 million wallets, reads the list as a population rather than one address at a time, and returns a weight for every wallet with the reason behind it.
Citrea used it before distribution, when the answer can still change who gets what. After a distribution, the same data can only measure the damage.
Method and limits
Figures come from the allocation sheet delivered to Citrea for its real candidate list of 1,981 wallets. Wallet addresses are withheld; Citrea received the unredacted version. Sell-speed shares use the 162 wallets with a confirmed sell as the denominator, and the retention figure uses wallets with a readable history. Automation and coordination readings are probabilities for review, not legal attribution, and the sets overlap. How the detection is built is not published.