According to Bubblemaps, an entity coordinated a Sybil attack across over 300 addresses, siphoning off approximately $4 million from the AVNT airdrop. This Sybil activity was clearly orchestrated and carried out across over 300 addresses. Clear Sybil characteristics include:

Get initial funding through Coinbase;

Receive USDC from a small number of senders;

Perform redemption operations on Avantis;

Claim airdrop rewards;

Aggregate tokens into a few addresses;

Simultaneously transfer funds to centralized trading platforms such as Bybit/Gate.

Bubblemaps stated that similar to the MYX incident, these wallets were dormant before the AVNT airdrop, and the capital injection and claim patterns were highly consistent, indicating obvious coordinated manipulation.