Solana

Bubblemaps

Edel

USDC

A Solana presale event encountered distribution issues after a bot farm reportedly used over 1,000 wallets to snipe nearly the entire Wet (WET) token sale in seconds.&nbsp;
Hosted through the decentralized exchange aggregator Jupiter, the presale <a href="https://x.com/JupiterExchange/status/1996605475849416863" rel="noopener noreferrer nofollow" target="_blank">sold</a> out almost instantly. But genuine buyers effectively had no chance to participate because a single actor dominated the presale, according to organizers.
Solana automated market maker (AMM) HumidiFi, the team behind the presale, <a href="https://x.com/humidifi/status/1996789248905650653" rel="noopener noreferrer nofollow" target="_blank">confirmed</a> the attack and scrapped the launch entirely. The team said it would create a new token and hold an airdrop to legitimate participants while explicitly excluding the sniper.&nbsp;
“We are creating a new token. All Wetlist and JUP staker buyers will receive a pro-rata airdrop. The sniper is not getting shit,” HumidiFi wrote. “We will do a new public sale on Monday.”&nbsp;
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-12/019aee71-e65f-7b6c-9915-1b22767db8e8" title="" alt="Solana WET presale hijacked by Sybil wallets as HumidiFi resets launch">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/JupiterExchange/status/1996605475849416863" rel="noopener noreferrer nofollow" target="https://x.com/JupiterExchange/status/1996605475849416863">Jupiter</a>
 </figcaption>
</figure>
<h2 id="bubblemaps-identifies-alleged-sniper-after-tracing-over-1-000-wallets">Bubblemaps identifies alleged sniper after tracing over 1,000 wallets</h2>
On Friday, the blockchain analytics platform Bubblemaps <a href="https://x.com/bubblemaps/status/1996891901207949786?s=20" rel="noopener noreferrer nofollow" target="_blank">announced</a> that it had identified the entity behind the presale attack, having observed unusual wallet clustering during the token sale.&nbsp;
In an X thread, the company reported that at least 1,100 out of the 1,530 participating wallets displayed identical funding and activity patterns, suggesting that a single actor controlled them.&nbsp;
Bubblemaps CEO Nick Vaiman told Cointelegraph that their team analyzed presale participants using their platform and saw patterns, including new wallets with no prior onchain activity, all being funded by a handful of wallets.
These also received funding in a tight time window with similar Solana (<a href="https://cointelegraph.com/solana-price-index" rel="noopener noreferrer nofollow">SOL</a>) token amounts.&nbsp;
“Despite some of the clusters not connected together onchain, the behavioral similarities in size, time, and funding all point to a single entity,” Vaiman told Cointelegraph.
Bubblemaps <a href="https://x.com/bubblemaps/status/1996892019592180073" rel="noopener noreferrer nofollow" target="_blank">said</a> that the sniper funded thousands of new wallets from exchanges, which had received 1,000 USDC (<a href="/usdc-price-index" rel="noopener noreferrer">USDC</a>) before the sale.
The analytics company said one of the clusters “slipped,” allowing them to link the attack to a Twitter handle, “Ramarxyz,”&nbsp;who also went on X to <a href="https://x.com/ramarxyz/status/1996790771656335616" rel="noopener noreferrer nofollow" target="_blank">ask</a> for a refund.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-12/019aee71-eb37-7d0a-b350-7f7421c543fc" title="" alt="Solana WET presale hijacked by Sybil wallets as HumidiFi resets launch">
 <figcaption style="text-align: center;">
 Bubblemaps demonstrated the wallets participating in the presale. Source: Bubblemaps
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/pepe-memecoin-site-hacked" rel="noopener noreferrer nofollow">Pepe memecoin website exploited, redirecting users to malware: Blockaid</a>
<h2 id="sybil-attacks-must-be-treated-as-a-critical-security-threat">Sybil attacks must be treated as a “critical” security threat</h2>
The attack follows other Sybil attack incidents in November, where clusters controlled by single entities sniped token supplies.&nbsp;
On Nov. 18, a single entity <a href="https://cointelegraph.com/news/pantera-web3-startup-apriori-silent-entity-claims-60-airdrop" rel="noopener noreferrer nofollow">claimed 60% of aPriori’s APR token airdrop</a>. On Nov. 26, Edel Finance-linked wallets allegedly <a href="https://cointelegraph.com/news/edel-finance-wallets-snipe-30-token-11m-bubblemaps" rel="noopener noreferrer nofollow">sniped 30% of their own EDEL tokens</a>. The team’s co-founder denied that they had sniped the supply and claimed they had put the tokens in a vesting contract.&nbsp;
Vaiman told Cointelegraph that Sybil attacks are becoming more common in token presales and airdrops. Still, he said the patterns are “different every time.” He said that for safety, teams should implement Know Your Customer (KYC) measures or use algorithms to detect sybils.
He said they could also manually review presale or airdrop participants before allocating tokens.&nbsp;
“Sybil activity needs to be treated as a critical security threat to token launches,” Vaiman told Cointelegraph. “Projects should have dedicated teams or outsource Sybil detection to professionals who can assist.”
Magazine: <a href="https://cointelegraph.com/magazine/inside-30000-phone-crypto-airdrop-bot-farm/" rel="noopener noreferrer nofollow">Inside a 30,000 phone bot farm stealing crypto airdrops from real users</a>

Solana WET presale hijacked by Sybil wallets as HumidiFi resets launch

Table of Contents

Cointelegraph

Other articles published on Dec 5, 2025

Join our free newsletter for daily crypto updates!