8.1M ELX Tokens Extracted
85% Gone Before the Day Was Out
Elixir distributed 40.9M tokens to 15,622 wallets. 35% were bad actors, and nearly all of them cashed out within the same day they received tokens. A behavioral filter could have prevented 62% of the leakage.
How value leaked
Elixir
Protocol distributes 40.9M ELX tokens
Airdrop
15,622 wallets receive tokens
35% Extract
5,470 bad actors cash out same day
DEX / CEX
8.1M ELX liquidated instantly
Tokens for DeFi Liquidity Providers
Liquidated on the Very Same Day
Elixir's airdrop was designed to reward committed DeFi participants, wallets that had contributed liquidity, engaged with perp DEX infrastructure, and built a meaningful onchain footprint over time.
What actually happened: 35% of all recipients (5,470 of 15,622) acted as extractors, wallets that farmed eligibility with no intention of participating. They moved 8.1M ELX to exchanges at machine speed, with 85.1% exiting the same day.
This was not panic selling. The velocity, 85% same-day, is the signature of pre-planned extraction, not human behavior.
In the Age of AI Agents, This Gets 100× Worse
- $20/month AI agents can simulate perp DEX liquidity provisioning and interact with DeFi infrastructure across hundreds of wallets simultaneously, qualifying for DeFi-native airdrops at industrial scale.
- They auto-execute same-day liquidation the moment tokens unlock, coordinating exits across wallets in seconds, faster than any manual intervention.
- Without behavioral intelligence that reads pre-existing exit history, the next airdrop will face the same same-day extraction at hundreds of millions of scale.
Three Behavioral Patterns
Reveal a Coordinated Same-Day Extraction
Analysis of 15,622 wallet records shows an extraction pattern defined not by opportunism, but by speed and coordination, behaviors no simple eligibility checklist can detect.
of all bad wallets liquidated their ELX on the same day they received it. Across every score band, between 84% and 89% of dumpers were same-day sellers, a velocity that leaves no room for genuine change of mind.
of all airdrop recipients scored below 100 out of 1,000, and 79.5% scored below 200. These wallets have shallow onchain histories with little evidence of sustained DeFi engagement or protocol loyalty.
same-day exit rate was remarkably consistent across all score bands, from 84% in 0–100 to 88% in 200–300. Even mid-score wallets extracted at the same speed, indicating the extraction behavior is not score-correlated but pre-planned.
Wallet Outcomes by Score Range
Higher scores shift balance toward holding, but bad actors exist at every band
Same-Day Exit Velocity by zScore
Instant exits vs total bad wallets: the gap is near zero at every band
If zScore Was Used
zScore was not live during the Elixir airdrop. The analysis below simulates outcomes if a behavioral filter (zScore ≥ 200) had been applied to the observed dataset, a conservative threshold that excludes only the lowest-quality behavioral profiles while keeping all established DeFi participants.
The Bottom Line
One behavioral filter, applied before the distribution snapshot, would have blocked 78% of all bad wallets and preserved 5 million ELX from wallets that exited the same day they received them.
| Metric | Actual (No Filter) | With zScore ≥ 200 | Impact |
|---|---|---|---|
| Eligible wallets | 15,622 | 3,196 | −80% |
| Bad wallets | 5,470 (35.0%) | 1,202 (37.6%) | −78% |
| ELX tokens leaked | 8,098,658 | 3,090,156 | −62% |
| ELX tokens saved | - | 5,008,503 | - |
Score Before the Snapshot
Apply a zScore ≥ 200 baseline before locking any eligibility list. With 80% of Elixir wallets scoring below 200, standard eligibility criteria alone cannot distinguish extractors from genuine DeFi participants.
Flag Same-Day Exit Histories
85% same-day velocity is a definitive behavioral signal. Wallets with a documented history of instant liquidation across multiple protocols should be deprioritized or subject to time-weighted vesting, not blocked outright, but slowed.
Shadow → Enforce → Iterate
Run the behavioral filter in shadow mode for one full cycle. Compare actual token retention vs. projected outcomes. Enforce for the next distribution. Adjust thresholds based on measured false-positive rates and community feedback.
What Comes Next
For Protocols
- 01
Score before you distribute. An 85% same-day exit rate is not bad luck. It is the predicted outcome when eligibility is checked but behavior is not. Cross-protocol behavioral history reveals velocity extractors before they claim.
- 02
Treat same-day exit velocity as a disqualifying signal, not just a disappointment. Wallets with a documented history of instant liquidation across airdrops are operating a structured playbook, not making individual decisions.
- 03
Introduce time-weighted release schedules. Pair a behavioral gate at entry with a vesting curve post-claim. Genuine participants stay; extractors, facing delayed access, self-select out before the snapshot.
What ZeruAI Provides
zScore, a universal behavioral reputation score (0–1,000) for every EVM and non-EVM wallet, derived from onchain activity across 40+ chains. Queryable via API. Mintable as an onchain credential.
Protocols integrate zScore to filter airdrop recipients, identify instant-exit histories, underwrite credit risk, assess agent reliability, and allocate incentives based on real behavioral contribution, not eligibility checklists alone.
Every number in this report is derived from public onchain data. Download the raw dataset to verify the findings independently.