$2.28M in ETHFI Tokens
Extracted by Serial Offenders
ether.fi distributed tokens to 10,015 wallets. 25.5% sold within days — and nearly 3 in 4 of those sellers had done the same thing before. A behavioral filter could have prevented 47% of the leakage.
How value leaked
ether.fi
Protocol distributes 2.94M ETHFI tokens
Season 3 Airdrop
10,015 wallets receive tokens
25.5% Sell
2,553 repeat actors cash out within days
DEX / CEX
1.46M ETHFI liquidated within ~1 day
Loyalty Rewards for Restakers
Captured by a Professional Extraction Ring
ether.fi Season 3 was designed to reward genuine liquidity stakers — users who locked ETH, contributed to protocol security, and earned points over months of participation.
What actually happened: 77.5% of recipients (7,763 of 10,015) scored below 200 — wallets with little evidence of genuine DeFi contribution. Among those who sold, 72.9% were repeat offenders who had dumped previous protocol airdrops too — median time to sell: 1.1 days.
These weren't panic sellers. They were professionals — wallets that have done this exact playbook across multiple protocols.
In the Age of AI Agents, This Gets 100× Worse
- $20/month AI agents can simulate months of staking activity across dozens of wallets simultaneously — qualifying for loyalty-based airdrops at industrial scale.
- They mimic restaking patterns, game point systems and eligibility criteria, then sell within hours of receiving — leaving no trace of genuine intent.
- Without behavioral intelligence that reads cross-protocol history, the next wave of extraction will reach hundreds of millions.
Three Behavioral Patterns
Reveal a Calculated Extraction
Analysis of 10,015 wallet records exposes a structured, repeat pattern — not opportunistic selling, but coordinated extraction by seasoned actors.
of wallets that sold had already dumped at least one previous protocol airdrop. This is not accidental — it is an established playbook applied across protocols.
of all recipients scored below 200 out of 1,000 — wallets with shallow, transactional histories. Low scores correlated directly with higher dump rates across every score range.
median time to sell. Unlike opportunistic sellers who exit same-day, these wallets waited roughly a day — likely to avoid pattern detection — before liquidating positions.
Wallet Outcomes by Score Range
Higher scores correlate with better restraint
Repeat Behavior Signal by zScore
Historical bad wallets vs ether.fi Season 3 dumpers — wallet counts
If zScore Was Used
zScore was not live during ether.fi Season 3. The analysis below simulates outcomes if a behavioral filter (zScore ≥ 200) had been applied to the observed dataset — a conservative threshold excluding only the lowest-quality behavioral profiles.
The Bottom Line
One behavioral filter — applied before Season 3 distribution — would have stopped nearly half of all token leakage, preserving 686,000 ETHFI from immediate liquidation by known serial extractors.
| Metric | Actual (No Filter) | With zScore ≥ 200 | Impact |
|---|---|---|---|
| Eligible wallets | 10,015 | 2,252 | −78% |
| Bad wallets | 2,553 (25.5%) | 734 (32.6%) | −71% |
| ETHFI leaked | 1,464,293 | 778,211 | −47% |
| ETHFI saved | — | 686,082 | — |
Score Before You Distribute
Apply a zScore ≥ 200 baseline before publishing any eligibility snapshot. Wallets below this threshold have demonstrated cross-protocol extraction behavior that points data cannot reveal.
Flag Repeat Offender Clusters
Track wallets with historically bad behavior across previous airdrops. Presence in multiple prior dump cohorts is the single strongest predictor of future sell behavior.
Shadow → Enforce → Iterate
Run behavioral filters in shadow mode for one cycle. Compare actual vs filtered outcomes. Enforce in the next cycle. Iterate thresholds based on false positive rates and real outcomes.
What Comes Next
For Protocols
- 01
Score before you distribute. Cross-protocol behavioral history reveals extractors that point-farming and activity metrics alone cannot detect.
- 02
Treat repeat offenders as a first-class signal. A wallet that has dumped three airdrops will almost certainly dump a fourth.
- 03
Implement graduated vesting. Tie token release schedules to post-airdrop behavior, not just eligibility — reward those who stay.
What ZeruAI Provides
zScore — a universal behavioral reputation score (0–1,000) for every EVM and non-EVM wallet, derived from onchain activity across 40+ chains. Queryable via API. Mintable as an onchain credential.
Protocols integrate zScore to filter airdrop recipients, identify repeat extractors, underwrite credit risk, assess agent reliability, and allocate incentives based on real behavioral contribution — not just eligibility checklists.
Every number in this report is derived from public onchain data. Download the raw dataset to verify the findings independently.