Airdrop and referral farming
One operator registers hundreds of accounts to claim a token distribution or a referral bonus. The accounts share devices, networks and timing more than real people do.
Secure the account. Before the withdrawal.
Crypto signup abuse and withdrawal fraud both run on devices. Fingerly gives an exchange or wallet a visitor ID for every signup and login, reports farms, emulators and anonymised networks, and leaves the decision to your own policy.
- One ID per deviceAcross signups and logins.
- Farm signalsDevice farms and emulators.
- Wallet appsiOS and Android SDKs.
- Network contextVPN, proxy and Tor, in proportion.
[ 01 / 06 ]Abuse patterns
How abuse reaches crypto platforms.
Exchanges and wallets reward early, repeated and automated behaviour, which makes them a target. These are the patterns that most often reach them.
Sybil signups
Fake accounts made to look unrelated, often with anti-detect browsers that change what each browser reports. Tampering and contradictions are reported together with the visitor ID.
Account takeover before a withdrawal
A stolen login is followed quickly by a new withdrawal address or a change of security settings. A device the account has never used is the first thing worth knowing.
Bots on signup and login
Automated registration and credential stuffing against exchange logins. Driven browsers, virtual machines and unusually busy devices are reported without a captcha.
Restricted-region access
Visitors from a region you do not serve can arrive through a VPN or proxy. A location mismatch and the network type are context for your own rules, not a verdict.
Tampered wallet apps
Cloned, instrumented or rooted environments around a mobile wallet. The native SDKs report them so a sensitive action can be treated with care.
[ 02 / 06 ]Pattern to decision
From pattern to decision.
Fingerly looks at the device and the network, not at wallets or on-chain activity. That is what lets it sit beside whatever else an exchange already runs.
01
Airdrop and referral farms
Review the cluster, not every user.
Identify at signup and again at the eligibility check or claim. Count claims per visitor ID and read device farm and emulator signals. The usual first decision is to hold eligibility for the cluster and review it together.
- Check at
- SignupEligibility checksReward claims
- Reads
- Visitor IDDevice farmHigh activity
02
Fake and linked accounts
Anti-detect browsers leave contradictions.
Anti-detect browsers exist to make one operator look like many. Tampering on a new account, with the visitor ID recurring across accounts, is a strong reason to delay what the account is given until more is known.
- Check at
- SignupVerificationFirst deposit
- Reads
- Anti-detect browserTamperingVisitor ID
03
Takeover before withdrawal
The device is new, and so is the destination.
Identify before a withdrawal address is added or a security setting changes. A new device, together with automation or a Tor exit node, is worth a second factor and a hold period you define.
- Check at
- LoginNew withdrawal addressSecurity changes
- Reads
- Visitor IDTor exit nodeAutomation
04
Wallet app environment
What the phone says about itself.
In iOS and Android apps, instrumentation, interception, rooted and jailbroken devices and cloned apps are reported with weights you control. In an app the device is recognised by a random install ID the SDK keeps for the app, never by its hardware.
- Check at
- App loginSigning a transfer
- Reads
- InstrumentationInterceptionCloned appRooted device
[ 03 / 06 ]Integration
Integrate at the right moments.
Four habits keep a policy for crypto platforms effective without turning it against genuine customers. A production identification is billed per request, from $0.0025, so it is worth placing where it earns its cost.
- 01 Identify at the moment
Call identify at signup, login, when a withdrawal address is added and at the airdrop or referral claim. Pass your own account reference as the tag so the result comes back with the account it describes.
await fingerly.identify({ tag: "withdrawal-address" }) - 02 Verify on your server
Send only the request ID to your backend, read the stored result with a secret key, and check that the tag matches the action. A browser or app can be patched to report anything, so the server decides.
- 03 Observe before you enforce
Start in monitoring mode. Record what each rule would have done to genuine users, many of whom use a VPN for good reasons, before any rule is enforced.
- 04 Act in proportion
Weight network signals lightly and device signals more. Hold eligibility or withdrawals for clusters and unusual devices, and keep a way for a real user to verify and proceed.
[ 04 / 06 ]Moments
Where to check, what to do.
Where an exchange or wallet usually places the check and what it reads there.
| Moment | Identify when | Read | Usual first decision |
|---|---|---|---|
| Signup | The account is created | Visitor ID, device farm, anti-detect browser | Delay referral credit for clusters |
| Login | Credentials are submitted | Visitor ID, automation, Tor exit node | Step up for new devices that carry other signals |
| Airdrop eligibility | Before eligibility is confirmed | Visitor ID, device farm, high activity | Hold the cluster for review |
| New withdrawal address | Before it is saved | Visitor ID, tampering, suspect score | Second factor and a hold period |
| Signing in the app | On opening the wallet | Instrumentation, interception, rooted or jailbroken device | Limit sensitive actions on a compromised device |
Every decision is yours. Fingerly returns the visitor ID, the signals and the suspect score, and never blocks a request by itself.
[ 05 / 06 ]Questions
Questions about crypto platforms.
What Fingerly offers a crypto product, and where its other controls still do the work.
Talk to the teamCan device fingerprinting stop airdrop farming?
Fingerly helps find it. It gives each signup a visitor ID, so many accounts on one device or one network cluster become visible, and it reports device farm and emulator signals that point to bulk operations. Your team decides what to do with the cluster, and no tool removes farming on its own.
Does Fingerly do KYC or AML screening for exchanges?
No. Fingerly does not verify identity documents, screen wallets or monitor transactions. It describes the device and network behind a request as one more input beside the checks an exchange already runs.
Is using a VPN or Tor suspicious for crypto users?
Not by itself. Many genuine crypto users value privacy, which is why Fingerly ships VPN and Tor findings as context with weights you set, and lets you set one to zero. They become meaningful alongside other signals such as automation, a new device or a farm.
Can it run inside a mobile wallet app?
Yes. Fingerly has native iOS and Android SDKs, with React Native, Flutter and Lynx bridges, that send the same identify request as the web SDK. They add app checks for emulators, rooted and jailbroken devices, instrumentation, interception and cloned apps.
Does it work on a decentralised app front end?
The web SDK runs in the page of any web front end and identifies the browser. To trust the result you still need a backend that reads it by request ID with a secret key, because a result the browser reports cannot be trusted on its own.
Less guessing. More knowing.
Make the next connection a trusted one.
Start with the signals, keep your own decisions, and pay as you go, only for what you identify. No credit card needed.