One group took 87% of the ROBO airdrop and sent it all to Bitget

01 · Claim weekTwelve seconds apart

One Sunday morning in February, a wallet on Ethereum sent a little ETH to another wallet. That one passed it to a second, the second passed it to a third, and the third passed it to a fourth. Each hop took one block, about 12 seconds. The fourth wallet kept the ETH.

It was gas money. Six days later the fourth wallet used it to claim about 75,000 ROBO, the new token of Fabric Protocol. The wallet at the top of the line had set up a whole family of claimers the same way, and all of them claimed on the same day.

Four months later, all 36 claim wallets in that family sent their ROBO back to the wallet that had funded them, within minutes of each other. Half an hour after that, the whole batch, about a million ROBO, landed at Bitget. On the way it passed through 15 more single-use wallets.

That family was one of hundreds. Bitquery indexes every transfer on Ethereum, so we traced every wallet that claimed ROBO: where its ETH came from, and where its tokens went. One group, paid for with withdrawals from seven exchanges, claimed 87% of all the ROBO handed out. It sat on the tokens for four months, then moved every one of them to Bitget. In March the analytics firm Bubblemaps reported about 7,000 linked wallets. The group is bigger than that, and its exit came months after the report.

02 · The dropWhat was being farmed

An airdrop is a free handout of a new token, usually to people who used a project early. Free tokens draw farmers, people who run hundreds or thousands of wallets and pretend each one is a separate user. When one person poses as a crowd like that, it is called a sybil attack. Most airdrops try to filter it out. We have tracked farming before, in Binance Alpha points.

Fabric Protocol is building a network for robots, backed by the Fabric Foundation, a non-profit. It raised $20 million from investors including Coinbase and Pantera, according to press reports. Its token, ROBO, went live on February 27.

Before launch, users signed up the wallet they would claim with. Fabric said eligible wallets had been "filtered through strong anti-sybil analysis" (Fabric Foundation). Claims then ran for two weeks. Most claimers got somewhere between a few hundred and a few thousand ROBO.

About one in three of those 35,323 claim wallets belonged to a single group.

03 · The setupSeven exchanges in 54 hours

The group's money starts at seven exchanges. In the second week of January, hot wallets at HTX, LBank, Bitget, Poloniex, Backpack, Bybit and Ourbit paid ETH to 480 wallets. Most payments were about the same size, and the whole run took a little over two days.

A hot wallet is the one an exchange pays withdrawals from, and our address labels mark all seven senders as exactly that. So these were withdrawals by exchange customers, from seven exchanges, into 480 wallets that would go on to act as one. Seven unrelated people lining up like that by chance is hard to believe.

Bitget, where this story ends, was one of the seven. Six weeks after the withdrawals, the 480 funding wallets went to work.

04 · The claimThree hops to a claim wallet

In the last days before claims opened, each funding wallet sent ETH to two dozen or so new claim wallets. The ETH did not go straight across. Nearly every claim wallet got it through its own line of three in-between wallets, each used once. It moved block by block, like the line at the top of this story. Some 34,000 wallets were spent on these lines.

The hops hide the family. Look one step back from a claim wallet and all you find is another wallet that was used once. The funding wallet behind the whole family sits four steps up, where a quick check does not reach.

The claim wallets had just been funded, and they claimed big. The median claim in the group was more than ten times the median claim overall. Together the group took 87% of all the ROBO handed out, about two thirds of what Fabric had put in the claim contract.

Everyone outside the group, about 24,000 wallets, shared the other 13%.

Bubblemaps' 40% was a share of all the tokens Fabric set aside for its community; ours is a share of what was actually claimed. Both describe the same group. With every claim wallet traced, it is bigger than first reported, and it has an ending. That ending took four months to arrive.

05 · The waitFour months of doing nothing

Airdrop farmers usually sell fast. This group did the opposite. Almost none of its claim wallets moved a token until July, and over those months ROBO lost about 70% of its value. By late September it traded 79% below its first week.

On paper, waiting cost the group dearly. At the prices on the days it claimed, its tokens were worth about $12 million. On the days it moved them, they were worth $3.7 million. A sale that big would have pushed the price down either way, and the chain does not say why the group waited, or whether it hedged somewhere else.

The pink bars are the exit.

06 · The exitBack to where it started

The families moved one after another, the first on July 1 and the last on August 9. Each time, a family's claimers sent all their ROBO to one collector wallet, usually within minutes, and the collector passed the whole batch on the same day.

The families almost never mixed. Of the 482 collectors, 478 took ROBO only from claimers set up by one funding wallet. In 48 cases the collector was the funding wallet itself, the same address that had sent the ETH down the lines in February. The money fanned out from one address and came home to it.

From each collector the tokens passed through a median of 15 more wallets, each used once, and every chain ended at Bitget. All but three finished at what looks like a Bitget deposit address, the address an exchange gives each customer to send funds in. Each of those passed the ROBO straight on to Bitget's hot wallets. The other three went to a Bitget hot wallet directly. Half the chains reached Bitget within 12 hours of the collection.

Anyone can retrace these chains with the Bitquery MCP, which lets an AI assistant follow money on-chain. The list of all 482 collectors has each family's funding wallet, collector, last address before Bitget and timings.

That is where the public trail ends. Once the ROBO was inside Bitget, only the exchange can see whether it was sold or sent on. It is also the only one that can connect those deposit addresses to people.

07 · A second patternThe December wave

Bitget was also where a second, much bigger crowd of claimers sent its ROBO. In one week in December, a single OKX hot wallet sent ETH to about 21,000 wallets that would later claim. The payments came in bursts of an hour or two on four days, in almost identical amounts.

They claimed small, fixed amounts, often in bursts, with hundreds claiming inside the same minute. Within a day, most had sent their ROBO to Bitget.

That looks coordinated. But each wallet that went to Bitget used its own deposit address there, and exchanges usually give each customer account its own address. So the chain cannot tie them to one owner the way it ties the group above. They took 5% of the tokens, about $0.7 million, and we keep them out of the headline.

Count them anyway and the airdrop looks thinner still. Take out both patterns and about 3,200 wallets are left, sharing 8% of what was claimed.

08 · The projectWhat Fabric said, and what it took back

After the March report, Fabric said its screening had used location checks and a one-device limit. It also said it had paid tens of thousands of real users, according to the same press reports. By then the group's claims were done, and a claim on a blockchain cannot be undone.

What nobody claimed went back. In August the claim contract sent its last 115.9 million ROBO to an address that has not touched them since.

Farmers were not the only ones working the launch. Two fake tokens, one called Robo Token and one called Fabric Protocol, were pushed into wallets more than 150,000 times in the days around the claim. It is a close cousin of the spam we followed in our address poisoning investigation.

09 · The answerHow we checked, and what it means

We pulled every ROBO transfer from launch to September 29 from Bitquery's own archive, along with every claim from Fabric's claim contract. For each claim wallet we found where its first ETH came from and followed it back, hop by hop. Exchange names come from our address labels. An unlabelled address counts as an exchange deposit address only if it sends what it gets straight to that exchange's hot wallets. Prices are daily prices from our price data. Our guide to airdrop analysis and token holder data are a good place to start the same checks on another drop.

A claim wallet counts as part of the group only if its ROBO went to a collector that took tokens from nobody outside its family. That is a strict rule. A looser count, every claim wallet first paid in those five days in February, gives 11,430 wallets and 89% of the tokens. A wider method that also links claimers by shared funding bursts, as in the December wave, puts 95% of claimers in linked groups. We keep those out of the headline, because a funding pattern alone does not prove one owner.

So who got the ROBO airdrop? Mostly one group, working from seven exchanges and tens of thousands of throwaway wallets. The pattern was on-chain before a single token was claimed: 480 funding wallets paid from seven exchanges in 54 hours, then 11,000 new claim wallets three hops below them. The chain cannot say who runs the group. The one place that can connect it to people is Bitget, where all of its ROBO ended up.

FAQ

What happened with the ROBO airdrop?

Fabric Protocol's ROBO airdrop opened in February 2026. One group claimed 87% of all the tokens paid out, held them for four months, and in July and August sent them all to Bitget.

Was the ROBO airdrop hit by a sybil attack?

On-chain, yes. Almost all of the group's 11,204 claim wallets trace back to funding wallets paid by seven exchanges in January. Almost every claim wallet was funded through three single-use wallets, and each family sent its tokens back to one collector before they went to Bitget.

Which exchanges were involved?

HTX, LBank, Bitget, Poloniex, Backpack, Bybit and Ourbit paid the group's funding wallets, and all of its tokens ended at Bitget. That is where the money passed; it says nothing about whether any exchange took part.

Did Fabric take the tokens back?

No claimed tokens were taken back. In August the claim contract returned the tokens nobody had claimed.

How can I check these wallets myself?

Every address is public. The downloadable list of collectors gives each family's addresses and times, and the Bitquery MCP can follow any of them.