Analysts from the Bubble Maps project have uncovered a potential Sybil attack within the MYX Finance ecosystem, which could become the largest in cryptocurrency history. Researchers have linked the MYX Finance team to a cluster of 100 addresses that received assets worth $170 million during the MYX token airdrop. The project’s developers categorically deny any involvement in manipulation.
This is reported by Business • Media
Bubble Maps Investigation: Token Distribution Schemes
According to reports from experts, the MYX airdrop took place in early May 2025. A total of 14.7% of the total token supply (1 billion MYX) was allocated for distribution. On the day of the token generation event (TGE), participants could only receive 30% of their rewards, while the remainder was locked in vesting with gradual monthly unlocks.
On September 9, 2025, analysts discovered a unique cluster of 100 wallets that collectively received 9.8 million MYX worth $170 million. The day before the airdrop, on April 19, 2025, deposits in BNB were simultaneously made to all these addresses from the OKX exchange. This allowed them to qualify and participate in the token distribution. Notably, prior to the airdrop, these wallets had shown no activity, and the tokens were stamped on May 7, 2025.
Connection to the MYX Finance Team and Participant Reactions
During the Bubble Maps investigation, transfers from the wallet of the MYX Finance founder (0x8eEB) to the account 0x4a31, which was also among those who received tokens, were traced. This address operated under a similar scheme as the other 95 addresses in the cluster. Additionally, $2.8 million in tokens were transferred from it to the deposit address 0xeb5A, which also belongs to the project’s founder.
MYX Finance responded to the publication, denying the allegations of fraud. The developers stated that all rewards were distributed fairly, based on real user activity. They also reported that some large token holders had requested to change addresses before the airdrop.
Bubble Maps described this response as “vague.” They demanded that MYX Finance provide a clear explanation of why the accounts in the cluster acted similarly and how one of the addresses is connected to the project’s creator.
In the industry, there is an increasing discussion about combating Sybil attacks. In particular, the LayerZero protocol has already implemented a campaign encouraging users to help identify such schemes by offering a portion of the rewards from confiscated tokens.