Compression-Based Behavioral Similarity for Open-World Sybil Discovery on Ethereum

Source: arXiv:2607.27370 · Published 2026-07-29 · By Michał Bartnicki, Jarosław A. Chudziak

TL;DR

This paper tackles the problem of Sybil attacker detection in the Ethereum blockchain, where attackers control multiple pseudonymous wallets to exploit airdrops or governance. Existing methods rely on explicit financial graphs that require token transfers or supervised classifiers with labeled data, which are brittle to new attack strategies and indirect wallet linking. The authors propose a novel training-free, compression-based behavioral similarity approach using Normalized Compression Distance (NCD) on symbolic transaction grammars derived from Ethereum Virtual Machine (EVM) traces. They construct a behavioral graph that connects wallets by structural transaction similarity, enabling discovery of Sybil clusters without requiring direct financial links or retraining.

Their key innovation is encoding wallet transaction histories into token sequences capturing transaction rhythm, execution structure, and call intent. Using gzip-based NCD to compare sequences, they show Sybil accounts exhibit significantly higher behavioral similarity than organic users or MEV bots. They introduce the Blind-Spot protocol to filter out high-signal utility contracts that leak label information, improving robustness. Experiments on 14K labeled wallets demonstrate that NCD-based local neighborhood retrieval detects Sybil clusters with up to 75% purity and 92% recall, competitive with supervised baselines like XGBoost and BiLSTM. NCD also shows strong resilience under temporal drift and adversarial camouflage, dropping less than 2% recall under 50% synthetic noise, whereas supervised models degrade substantially.

The authors position their method as a local candidate expansion primitive for open-world blockchain audits, suitable for discovering orphan Sybil groups without labeled data or token transfer graphs. This work advances Sybil detection towards a leakage-aware, training-free framework that is robust to evolving attacker strategies and obfuscated funding flows.

Key findings

• Sybil wallets have significantly higher within-class behavioral similarity than Organic and MEV wallets, with synergy indicated by effect sizes up to Cliff’s δ = 0.674 in leakage-free settings (Table 3).
• Applying the Blind-Spot protocol to remove high-signal contracts increases the Sybil–Organic similarity gap nearly twofold (from +0.122 to +0.233 for rhythm+intent encoding), acting as a denoising step.
• NCD-based 1-nearest neighbor accuracy for Sybil candidate retrieval reaches 0.696 ± 0.030 with full_tokens encoding, outperforming TF-IDF cosine similarity by 5.1% in top-10 neighborhood purity (0.754 ± 0.019 vs 0.606 ± 0.030) (Table 5).
• Despite no training, NCD matches the performance of deep learning BiLSTM models in leakage-free full_tokens data (around 0.703 accuracy) and remains competitive with XGBoost (0.795 accuracy).
• NCD exhibits strong robustness to synthetic adversarial camouflage with recall staying above 0.981 at 50% noise injection, whereas XGBoost recall drops to 0.816 (Table 7).
• Temporal split experiments show candidate retrieval cross-period achieves 1-NN accuracy of 0.619 and top-10 recall of 0.782, indicating within-campaign stability but attenuation due to temporal drift (Table 6).
• Computing the NCD behavioral similarity matrix for 900 wallets requires about 90 seconds on a consumer laptop; approximate MinHash/LSH reduces neighbor search from 98s to 2s without accuracy loss.
• The Blind-Spot protocol removes 25.5% of transaction volume by filtering high-signal utility contracts like Uniswap, OpenSea Wyvern, and WETH9 to prevent shortcut labeling effects.

Threat model

The adversary consists of Sybil attackers who deploy multiple pseudonymous Ethereum wallets controlled by coordinated scripts to exploit airdrops or manipulate governance. They can obfuscate direct financial links by routing token transfers through exchanges, dispersers, or intermediaries. The adversary attempts to evade detection by mimicking organic transaction behavior or injecting camouflage. They do not have the ability to subvert the blockchain data but rely on shared structural transaction patterns across their wallet set. Detection methods do not assume explicit funding connections or supervised labeled training, reflecting a realistic open-world audit setting.

Methodology — deep read

The threat model assumes adversaries control many Ethereum wallets (Sybil bots) to coordinate attacks like airdrop farming or governance manipulation. Attackers may hide financial links by using exchanges and dispersers, and they adapt behavioral scripts to evade detection. No direct funding transfer or explicit graph connectivity can be assumed between Sybil wallets.

Data: The labeled dataset includes 14,604 Ethereum wallets comprising Organic users, Sybil attackers, and MEV arbitrage bots, sourced from the Hop Protocol airdrop list and Dune Analytics. Only wallets with at least 10 transactions are included. The Blind-Spot protocol is applied to remove high-signal counterparties prone to label leakage, reducing dataset size slightly. Transaction internal execution traces are fetched from Google BigQuery.

Architecture/Algorithm: Each wallet's transaction history is encoded as an ordered symbolic sequence called a Transaction Grammar. Each transaction is represented as three tokens: Rhythm (log-binned inter-arrival time), Structure (discretized EVM execution metrics such as call depth, branching, error rates), and Intent (function selectors limited to 100 common ones with unknown tokens). Token sequences thus capture multi-dimensional behavioral signatures.

Pairwise similarity between wallets is computed using the Normalized Compression Distance (NCD), based on gzip compression length of individual sequences versus concatenated sequences. Lower NCD indicates higher behavioral similarity due to shared algorithmic regularities in the execution scripts.

An implicit behavioral graph is constructed with wallets as nodes and edge weights as similarity scores (1 - NCD). This graph supports three use cases: local candidate expansion by k-nearest neighbors, global unsupervised clustering (spectral and agglomerative), and robustness analysis. The Blind-Spot protocol removes transactions involving popular high-signal DeFi contracts to prevent shortcut label leakage.

Training regime: No supervised training is performed for NCD; competitors include supervised XGBoost, TF-IDF + logistic regression, and BiLSTM models trained on the same data splits. NCD computations use a 2020 MacBook Pro with M1 and 16 GB RAM, taking ~90s for 900 wallets.

Evaluation: Metrics include 1-NN accuracy for neighbor retrieval, neighborhood purity and recall in top-5 and top-10 neighbors, Adjusted Rand Index and Normalized Mutual Information for clustering, effect size (Cliff’s delta) for within-class similarity comparison, cross-temporal retrieval accuracy, and synthetic noise perturbation stress tests. Multiple random seeds and data splits ensure statistical robustness.

Reproducibility: Code and exact weights are not mentioned as released; the dataset partially depends on proprietary queries (Dune Analytics, BigQuery). Methodology permits reproducibility in principle if data is accessible.

Technical innovations

• Encoding Ethereum wallet behavior as symbolic Transaction Grammars combining rhythmic, structural, and functional intent features derived from EVM traces.
• Applying Normalized Compression Distance (NCD) using gzip compression on transaction grammar sequences to measure behavioral similarity without supervised training or explicit financial links.
• Introducing the Blind-Spot protocol to filter out high-signal utility contracts that cause label leakage, enabling evaluation of authentic behavioral signatures.
• Constructing an implicit behavioral graph from NCD similarity scores to support local candidate expansion and community detection in an open-world Sybil discovery setup.

Datasets

• Hop Protocol and Dune Analytics combined wallets dataset — 14,604 wallets including Organic, Sybil, and MEV Bot classes — publicly aggregated from blockchain and analytics platform
• Filtered leakage-free version after Blind-Spot protocol — 14,161 wallets

Baselines vs proposed

• XGBoost on full_tokens encoding: Accuracy = 0.795 ± 0.007 vs NCD full_tokens: 0.713 ± 0.024 (Raw), 0.703 ± 0.013 (Leakage-Free)
• BiLSTM full_tokens: Accuracy = 0.708 ± 0.018 (Raw), 0.703 ± 0.019 (Leakage-Free) vs NCD full_tokens: 0.713 ± 0.024 (Raw), 0.703 ± 0.013 (Leakage-Free)
• TF-IDF + Logistic Regression cosine on full_tokens: Accuracy = 0.666 ± 0.012 (Raw), 0.663 ± 0.016 (Leakage-Free) vs NCD 1-NN full_tokens: 0.696 ± 0.030 (Leakage-Free)
• NCD full_tokens neighborhood purity (top-10): 0.754 ± 0.019 vs TF-IDF cosine: 0.606 ± 0.030
• NCD recall under 50% synthetic noise: 0.981 ± 0.011 vs XGBoost recall: 0.816 ± 0.062

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.27370.

Fig 1: Distribution of within-class behavioral similarity (1-NCD) for the Full Tokens

Limitations

• Blind-Spot protocol requires label knowledge to identify high-signal contracts and thus is not fully label-free for deployment.
• NCD global similarity computation scales quadratically (O(N^2)) making large-scale graph construction expensive; partial mitigation through approximate MinHash/LSH candidate generation was proposed but not fully validated.
• Temporal cross-campaign generalization beyond the single Hop Protocol airdrop dataset remains untested.
• Synthetic camouflage perturbations do not model real-world adversarial behavior exactly, so robustness results are indicative but not definitive against adaptive attackers.
• No closed-loop or online evaluation with human auditors to validate the practical utility of candidate expansions.
• Code and dataset availability for reproducibility is not confirmed.

Open questions / follow-ons

• How does the compression-based similarity method generalize to other blockchain systems or different Sybil attack campaigns beyond the Hop Protocol?
• What are the comparative effects of different compression algorithms (e.g., Brotli, Zstandard, LZMA) on NCD similarity quality and computational efficiency?
• Can NCD-based behavioral similarity be integrated or combined with graph neural networks over explicit financial graphs for improved hybrid detection?
• How well can the method distinguish between distinct Sybil campaigns and reject unknown or novel classes in a fully open-set recognition scenario?

Why it matters for bot defense

This work offers a novel, training-free approach to detecting coordinated Sybil wallets in Ethereum by measuring behavioral similarity through compression-based distances on symbolic execution traces. For bot-defense and CAPTCHA engineers, it provides a complementary strategy to traditional transaction graph analysis and supervised classification. The technique is particularly relevant in open-world settings where labeled examples are scarce and adversaries evolve tactics to avoid explicit financial links.

Practitioners interested in Sybil detection can apply the NCD behavioral graph for local candidate expansion starting from suspicious seeds without requiring token transfer data. The Blind-Spot protocol concept also reminds researchers of the importance of removing shortcut artifacts that leak label information, improving generalizable detection. However, scaling to very large wallet populations remains a challenge, suggesting this method is best suited as a candidate refinement or audit tool integrated with broader bot detection pipelines. Overall, the paper exemplifies how algorithmic information theory techniques can strengthen bot detection by revealing hidden coordination via transaction behavior patterns rather than relying only on direct interaction evidence.

Cite

@article{arxiv2607_27370,
  title={ Compression-Based Behavioral Similarity for Open-World Sybil Discovery on Ethereum },
  author={ Michał Bartnicki and Jarosław A. Chudziak },
  journal={arXiv preprint arXiv:2607.27370},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.27370}
}

Read the full paper

• arXiv:2607.27370 (abstract)
• arXiv:2607.27370 (PDF)