8.1M ELX Tokens Extracted
85% Gone Before the Day Was Out
Elixir distributed 40.9M tokens to 15,622 wallets. 35% were bad actors — and nearly all of them cashed out within the same day they received tokens. A behavioral filter could have prevented 62% of the leakage.
How value leaked
Elixir
Protocol distributes 40.9M ELX tokens
Airdrop
15,622 wallets receive tokens
35% Extract
5,470 bad actors cash out same day
DEX / CEX
8.1M ELX liquidated instantly
Tokens for DeFi Liquidity Providers
Liquidated on the Very Same Day
Elixir's airdrop was designed to reward committed DeFi participants — wallets that had contributed liquidity, engaged with perp DEX infrastructure, and built a meaningful onchain footprint over time.
What actually happened: 35% of all recipients (5,470 of 15,622) acted as extractors — wallets that farmed eligibility with no intention of participating. They moved 8.1M ELX to exchanges at machine speed — with 85.1% exiting the same day.
This was not panic selling. The velocity — 85% same-day — is the signature of pre-planned extraction, not human behavior.
In the Age of AI Agents, This Gets 100× Worse
- $20/month AI agents can simulate perp DEX liquidity provisioning and interact with DeFi infrastructure across hundreds of wallets simultaneously — qualifying for DeFi-native airdrops at industrial scale.
- They auto-execute same-day liquidation the moment tokens unlock, coordinating exits across wallets in seconds — faster than any manual intervention.
- Without behavioral intelligence that reads pre-existing exit history, the next airdrop will face the same same-day extraction at hundreds of millions of scale.
Three Behavioral Patterns
Reveal a Coordinated Same-Day Extraction
Analysis of 15,622 wallet records shows an extraction pattern defined not by opportunism, but by speed and coordination — behaviors no simple eligibility checklist can detect.
of all bad wallets liquidated their ELX on the same day they received it. Across every score band, between 84% and 89% of dumpers were same-day sellers — a velocity that leaves no room for genuine change of mind.
of all airdrop recipients scored below 100 out of 1,000, and 79.5% scored below 200. These wallets have shallow onchain histories with little evidence of sustained DeFi engagement or protocol loyalty.
same-day exit rate was remarkably consistent across all score bands — from 84% in 0–100 to 88% in 200–300. Even mid-score wallets extracted at the same speed, indicating the extraction behavior is not score-correlated but pre-planned.
Wallet Outcomes by Score Range
Higher scores shift balance toward holding, but bad actors exist at every band
Same-Day Exit Velocity by zScore
Instant exits vs total bad wallets — the gap is near zero at every band
If zScore Was Used
zScore was not live during the Elixir airdrop. The analysis below simulates outcomes if a behavioral filter (zScore ≥ 200) had been applied to the observed dataset — a conservative threshold that excludes only the lowest-quality behavioral profiles while keeping all established DeFi participants.
The Bottom Line
One behavioral filter — applied before the distribution snapshot — would have blocked 78% of all bad wallets and preserved 5 million ELX from wallets that exited the same day they received them.
| Metric | Actual (No Filter) | With zScore ≥ 200 | Impact |
|---|---|---|---|
| Eligible wallets | 15,622 | 3,196 | −80% |
| Bad wallets | 5,470 (35.0%) | 1,202 (37.6%) | −78% |
| ELX tokens leaked | 8,098,658 | 3,090,156 | −62% |
| ELX tokens saved | — | 5,008,503 | — |
Score Before the Snapshot
Apply a zScore ≥ 200 baseline before locking any eligibility list. With 80% of Elixir wallets scoring below 200, standard eligibility criteria alone cannot distinguish extractors from genuine DeFi participants.
Flag Same-Day Exit Histories
85% same-day velocity is a definitive behavioral signal. Wallets with a documented history of instant liquidation across multiple protocols should be deprioritized or subject to time-weighted vesting — not blocked outright, but slowed.
Shadow → Enforce → Iterate
Run the behavioral filter in shadow mode for one full cycle. Compare actual token retention vs. projected outcomes. Enforce for the next distribution. Adjust thresholds based on measured false-positive rates and community feedback.
What Comes Next
For Protocols
- 01
Score before you distribute. An 85% same-day exit rate is not bad luck — it is the predicted outcome when eligibility is checked but behavior is not. Cross-protocol behavioral history reveals velocity extractors before they claim.
- 02
Treat same-day exit velocity as a disqualifying signal, not just a disappointment. Wallets with a documented history of instant liquidation across airdrops are operating a structured playbook — not making individual decisions.
- 03
Introduce time-weighted release schedules. Pair a behavioral gate at entry with a vesting curve post-claim. Genuine participants stay; extractors, facing delayed access, self-select out before the snapshot.
What ZeruAI Provides
zScore — a universal behavioral reputation score (0–1,000) for every EVM and non-EVM wallet, derived from onchain activity across 40+ chains. Queryable via API. Mintable as an onchain credential.
Protocols integrate zScore to filter airdrop recipients, identify instant-exit histories, underwrite credit risk, assess agent reliability, and allocate incentives based on real behavioral contribution — not eligibility checklists alone.
Every number in this report is derived from public onchain data. Download the raw dataset to verify the findings independently.