A single entity exploited $4 million in AVNT airdrops through over 300 addresses.

According to Bubblemaps, a single entity coordinated a Sybil attack across over 300 addresses, siphoning off approximately $4 million from the AVNT airdrop. This Sybil attack, spread across over 300 addresses, clearly demonstrated coordinated planning. Significant Sybil characteristics included: initial funding through Coinbase; receiving USDC from a small number of senders; performing redemptions on Avantis; claiming airdrop rewards; pooling tokens into a small number of addresses; and simultaneously transferring funds to centralized exchanges such as Bybit and Gate. Bubblemaps notes that, similar to the MYX incident, these wallets were dormant prior to the AVNT airdrop, and the pattern of fund injection and claiming closely matched, demonstrating clear coordinated manipulation.