The founders of Solana’s leading cross-chain stablecoin exchange, Saber Protocol–Ian and Dylan Macalinao, have been revealed to have used a web of bogus identities to pump and fake TVL on the Solana blockchain, trying to launch a “Sybil attack”.
One person opening multiple social media accounts may not appear to be a sign of an impending attack. However, in the world of cryptocurrencies, Sybil attackers could be a security threat.
What is a Sybil attack, you ask? It is when someone creates multiple nodes, much like multiple fake social media accounts on a blockchain network, to organize an attack and out-vote the honest nodes on the network.
Ian had created the identities of 11 independent developers who appeared to be working on a variety of projects. In this way, he was able to create a vast web of interlocking DeFi protocols that projected billions of dollars of double-counted value onto the Saber ecosystem.
Ian is the ‘Surya Khosla’ of Sunny Aggregator and the ‘0xGhostchain’ of Cashio. The Macalinao brothers referred to their anonymous personas as “friends” or “friends of friends.”
Among the so-called 11 developers were Larry Jarry of mining rewards aggregator Quarry, Swaglioni, the “grandmaster” of governance platform TribecaDAO, and others.
Macalinao created the Saber protocol on Solana and used these personas to construct what appeared to be independent Saber projects.
By doing so, he was able to artificially inflate Solana’s apparent total value locked (TVL) by counting the same tokens twice.
Saber and Sunny were responsible for fake $7.5 billion of Solana’s $10.5 billion TVL at their peak popularity.
With the growing popularity of DeFi, TVL has become an important metric for investors, and as the TVL of a DeFi platform rises, so does its liquidity, popularity, and usability.
Ian Macalinao admitted to creating the lot in an unpublished blog.
“If an ecosystem is all built by a few people, it does not look as authentic,” Ian wrote.
“I wanted to make it look like a lot of people were building on our protocol, rather than ship 20+ disjoint[ed] programs as one person.”
The blog post was written in March, three days after Cashio, one of Ian’s secretly built protocols, lost $52 million in an ‘Infinite Mint Glitch’ hack.
Dylan wrote, “There’s only one way to build a strong moat in crypto: have so many other protocols/apps/layers depend on your protocol that its failure would lead to the entire system going down.”
The “army of anons” was used to lend credibility to Ian’s various personas to those who were skeptical about putting money into projects led by anonymous people.
