How GAIB Reclaimed Millions
Between One Airdrop and the Next
GAIB's first airdrop had no behavioral filter. Sybil wallets captured 21% of all tokens, dumped within hours, and left. For V2, GAIB applied zScore before distribution. These are the verified, on-chain results.
This is not a simulation. GAIB is a live client.
V1 — How value left the ecosystem without zScore
GAIB Protocol
Distributes tokens to all recipients
Flat Airdrop
No scoring, all wallets equal
64% Quick Dump
300–400 wallets sell within 1 hour
CEX Liquidation
95% CEX-only exit, no holding intent
Flat Distribution Rewarded the Wrong Wallets
Sybils Took 21% of Tokens and Left the Same Day
GAIB designed their first airdrop to reward community members who genuinely engaged with the protocol. With no behavioral filter, eligibility was determined by on-chain activity count alone.
What actually happened: wallets scoring 300–400 received 2.5× their fair share of the distribution. 64% of them sold within one hour of claiming, and 95% used CEX-only exits — zero intent to hold, participate, or contribute.
A protocol that rewards activity without measuring intent will always fund the wallets optimized to appear active.
In the Age of AI Agents, This Gets 100× Worse
- $20/month AI agents can simulate legitimate DeFi activity at scale — scripting deposits, withdrawals, and governance votes across hundreds of wallets simultaneously.
- They generate identical transaction fingerprints across coordinated clusters — the exact pattern that flags 99.1% tx-count uniformity in GAIB's V1 sybil band.
- Without behavioral intelligence that measures tenure, cross-protocol depth, and network patterns, the next airdrop will face coordinated extraction at industrial scale.
Three Behavioral Patterns
Made Sybil Identity Unambiguous
Post-V1 analysis of wallet behavior extracted three compounding signals. Together, they made the 300–400 scoring band statistically indistinguishable from a bot cluster.
of sybil-band wallets claimed on the same day, at the same time windows. Human airdrop recipients spread claiming across days and weeks. Coordinated bot clusters don't.
of wallets showed identical transaction counts — a statistical impossibility for genuine users. Bot scripts leave a fingerprint: identical actions, identical timing, identical amounts.
used centralized exchange destinations exclusively — no DeFi interaction, no staking, no holding. The exit was the only purpose. Token received → token sold → wallet dormant.
Token Retention by zScore Band
Higher score = less dumping = protected token value
Behavioral Fingerprint — zScore 300–400
% of wallets in band exhibiting each pattern
Measured Outcomes from the Live Deployment
GAIB applied zScore before V2 distribution. The delta between V1 and V2 was measured on-chain. The numbers below are not projections — they are the verified results.
| Metric | V1 — Unfiltered | V2 — zScore Applied | Delta |
|---|---|---|---|
| Sybil-band share (300–500) | 21% of distribution | 13.5% of distribution | −36% |
| Quality-band share (700–900) | 41.7% of distribution | 54.7% of distribution | +31% |
| Avg tokens, 300–400 wallets | 2,357 tokens/wallet | 1,024 tokens/wallet | −57% |
| Avg tokens, 700–800 wallets | 815 tokens/wallet | 1,215 tokens/wallet | +49% |
| Sell pressure (quick dumps) | High — 64% within 1 hour | Reduced — fewer sybils eligible | −50% |
Per-Wallet Token Allocation: V1 vs V2
Sybil bands received less. Quality bands received more. Capital moved to where it belongs.
Retention comparison — bad actors vs genuine users
Bad Actors · zScore 300–400
Retained by Bad Actors
Quality Users · zScore 700–800
Retained by Genuine Users
What This Means for Your Protocol
Lessons from GAIB's V1 → V2 Journey
- 01
Activity count without behavioral depth is exploitable. GAIB's V1 rewarded wallets that looked active. zScore sees through that — it measures what the activity was, not just how much of it there was.
- 02
The damage is measurable. 21% of V1 tokens went to wallets that sold within hours. zScore scored those wallets at 300–400. The signal existed before distribution — it just wasn't being read.
- 03
The fix does not require new infrastructure. GAIB integrated zScore as a pre-distribution filter. One API call per wallet. No changes to smart contracts. No new eligibility criteria. The V2 results speak for themselves.
What ZeruAI Provides
zScore is a behavioral reputation score (0–1,000) for every EVM wallet, derived from on-chain activity across 40+ chains. Queryable via API. Mintable as an on-chain credential. Integrated at the distribution layer — not after.
GAIB used it to convert V1 leakage into V2 efficiency. The full dataset from both rounds is available publicly to verify the delta.
Behavioral Fingerprinting
Tx patterns, timing, value flow, network behavior
Network Clustering
Graph analysis to identify coordinated wallet clusters
ML Classification
89.7% precision on known sybil patterns