Setup guide: Rabby wallet stack for sybil ops in 2026
Setup guide: Rabby wallet stack for sybil ops in 2026
Running multiple wallets for airdrop farming is not what it was two years ago. Protocols have matured their sybil filters, on-chain analysts publish open-source clustering scripts, and teams like Nansen and Chainalysis now sell sybil-detection tooling directly to protocol treasuries. If your wallet stack shares IP fingerprints, gas top-up patterns, or transaction timing, it will get flagged before the snapshot. The days of spawning fifty MetaMask windows on one browser profile and calling it a stack are over.
This guide is for operators who are already doing multi-wallet airdrop work and want to rebuild their tooling around Rabby Wallet, the browser extension wallet built by DeBank. Rabby has features that make managing many addresses significantly cleaner than MetaMask: a built-in address book, per-address transaction history, multi-chain balance views, and a watchlist that lets you monitor addresses without importing private keys into the active session. None of this is magic, but the workflow it enables is tighter than the alternatives at this price point (free).
By the end of this guide you will have a working Rabby-based stack with properly isolated environments, a funding strategy, a tracking sheet, and a clear mental model for what changes as you scale. This is not legal or tax advice, and nothing here recommends identity fraud, KYC bypassing, or hacking.
what you need
software - Rabby Wallet browser extension (Chromium-based browser required; source on GitHub) - an antidetect browser, minimum viable options are AdsPower (starts ~$9/month for 10 profiles) or Dolphin Anty (free tier up to 10 profiles) - a spreadsheet app, Google Sheets or Notion database both work - Python 3.10+ if you want to script wallet generation (optional but useful at 50+ wallets)
infrastructure - residential or mobile proxies, one IP per wallet cluster. datacenter proxies are increasingly flagged by airdrop eligibility checkers - a hardware wallet (Ledger Nano X or similar) for your treasury address that funds all ops wallets
accounts and budget - a small ETH/USDC float on each chain you plan to farm. budget at minimum $5-10 per wallet per protocol for gas - seed phrase storage: encrypted USB drive or steel plate backup. not iCloud, not Google Drive
time cost: 3-5 hours for initial setup of a 20-wallet stack. plan for 30 minutes of maintenance per active campaign per day.
step by step
step 1: generate your wallet addresses
Do not generate wallets inside Rabby for sybil ops. Rabby stores keys in the browser extension’s local storage, which is fine for one or two wallets but becomes a liability at scale. generate wallets offline or via script, then import the private keys.
for a small batch (under 20 wallets), use an air-gapped laptop with Ian Coleman’s BIP39 tool (downloaded locally, not the web version). generate one mnemonic per wallet, record each on paper or steel.
for larger batches, a Python script using the eth_account library is faster:
from eth_account import Account
import secrets
import csv
Account.enable_unaudited_hdwallet_features()
wallets = []
for i in range(50):
mnemonic = Account.create().key.hex() # use proper HD derivation in production
acct = Account.from_key(secrets.token_bytes(32))
wallets.append({"address": acct.address, "private_key": acct.key.hex()})
with open("wallets_export.csv", "w", newline="") as f:
writer = csv.DictWriter(f, fieldnames=["address", "private_key"])
writer.writeheader()
writer.writerows(wallets)
run this on an offline machine, copy via USB. delete the CSV after importing. understand what you are doing before running any script that touches private keys.
if it breaks: if eth_account is not installed, run pip install eth-account. if you see key length errors, confirm you are using 32-byte entropy for each account.
step 2: set up antidetect browser profiles
Each wallet cluster (I typically group 3-5 wallets per profile for plausibility) gets its own antidetect browser profile with a unique fingerprint and proxy. the goal is that no two profiles share a canvas hash, WebGL renderer string, or exit IP.
in AdsPower or Dolphin Anty, create a profile and assign: - a residential proxy for that cluster’s geographic identity - a unique user agent matching the proxy region’s common browser version - timezone, language, and screen resolution consistent with the region
name the profile to match your tracking sheet. I use a format like ETH_cluster_04_SG so I know the chain, cluster number, and proxy region at a glance.
if it breaks: if Rabby does not load in a Dolphin Anty profile, check that the extension is whitelisted in the profile’s extension settings. some antidetect browsers require you to manually install extensions per profile rather than inheriting from a global list. the community at multiaccountops.com/blog/ has documented specific Dolphin + Rabby compatibility issues worth reading before you spend hours debugging.
step 3: import private keys into Rabby
Inside each antidetect browser profile, install Rabby fresh. do not sync to an existing session.
to import: 1. open Rabby, select “Add Address” 2. choose “Import Private Key” 3. paste the key for one of the wallets assigned to this cluster 4. repeat for the remaining wallets in this cluster (Rabby supports multiple addresses in one instance)
Rabby’s address switcher in the top-left lets you toggle between all imported addresses. the balance view is per-address and shows all chains simultaneously, which saves significant time compared to switching networks manually.
if it breaks: if Rabby shows zero balance after import, confirm the correct network is added. Rabby auto-detects most EVM chains but some newer L2s require manual RPC configuration under Settings > RPC.
step 4: fund wallets from treasury
Fund all wallets from a single treasury address using a funding contract or manual batching, but never fund them all in the same block or with a clear sequential pattern. on-chain clustering algorithms look for common funding sources. see the Ethereum account documentation for how account relationships are traced.
practical approach: use a disperse-style contract (disperse.app exists but verify the contract address yourself before use) or write a simple batch-send script. stagger funding transactions across different blocks and optionally different times of day.
# example using cast (Foundry toolchain) to send ETH to a list of addresses
cast send --rpc-url https://mainnet.infura.io/v3/YOUR_KEY \
--private-key $TREASURY_KEY \
--value 0.01ether \
0xWALLET_ADDRESS_1
for gas tokens on L2s, bridge from the treasury to an intermediary address first, then distribute from there.
if it breaks: if transactions revert, check gas price and nonce. Foundry’s cast command defaults to estimating gas but on congested networks you may need --gas-price set explicitly.
step 5: configure Rabby’s watchlist and address book
Rabby’s watchlist feature lets you monitor addresses without importing private keys. add your treasury address and any protocol deployer addresses you are tracking to the watchlist so you can see their activity without switching profiles.
the address book (Settings > Address Book) is useful for labeling your own wallets across clusters. I export this as a JSON and version-control it so I can restore labels after a reinstall.
if it breaks: Rabby’s address book does not sync across devices or profiles. back it up manually after any significant labeling session.
step 6: set up your tracking spreadsheet
A spreadsheet is not optional at scale. at minimum, track per wallet: - address - cluster ID and antidetect profile name - proxy assigned - funded date and amount - which protocols have been interacted with and on what date - estimated airdrop eligibility status
I use one Google Sheet per campaign with a summary tab that aggregates portfolio value from the DeBank API. DeBank’s portfolio tracker supports bulk address input via their API, which saves hours of manual checking.
if it breaks: DeBank rate-limits unauthenticated API requests. apply for a DeBank Pro API key if you are checking more than 20 addresses regularly.
step 7: run a dry-run interaction on each wallet
Before starting any campaign proper, run one small on-chain interaction per wallet to confirm the setup is working end-to-end. a simple token swap on a low-fee chain (Base, Arbitrum) costs under $0.10 and will surface any issues with RPC connections, proxy blocks, or key import errors.
check that the transaction appears in Rabby’s history view and in the protocol’s own activity tracker if it has one.
if it breaks: if the transaction is stuck pending, the RPC endpoint may be rate-limited. switch to a paid RPC provider (Alchemy, Infura, or QuickNode all have free tiers) and update the custom RPC in Rabby Settings.
step 8: establish an operational rhythm
Sybil detection increasingly includes behavioral signals: transaction time-of-day clustering, gas price similarity, and interaction intervals. vary these deliberately. set protocol interactions across different hours using a simple cron job or manually stagger them.
keep an ops log, even a simple text file, of what each cluster did and when. this becomes critical if you are disqualified and want to understand why.
common pitfalls
funding wallets in an obvious tree pattern. if wallet A funds wallets B through F in sequential blocks, any clustering script will catch this. add intermediary hops and timing variance.
reusing the same RPC endpoint across all profiles. paid RPC providers log your API key and IP. if all your clusters hit the same Alchemy app ID from different IPs, that is still a correlation point. use separate API keys per cluster or use public RPCs that do not require authentication (with the understanding that public RPCs have rate limits).
importing multiple clusters into one Rabby instance. Rabby is a browser extension. if your antidetect profile has wallets from cluster 1 and cluster 3, those clusters are correlated at the browser fingerprint level. one profile, one cluster.
ignoring gas token consistency. if every wallet in your stack has exactly 0.05 ETH left after funding, that is a signal. spend amounts should vary naturally.
not checking protocol eligibility criteria before starting. some protocols explicitly state in their docs that sybil filtering will remove addresses with common funding sources or behavioral patterns. read the criteria first. the Arbitrum Foundation governance forum publishes post-airdrop sybil analysis reports that are worth reading to understand what was actually caught.
scaling this
10 wallets: manual management in Rabby works. one antidetect browser instance, one spreadsheet tab, manual transactions.
100 wallets: you need scripted funding and interaction. the antidetect browser becomes your bottleneck. consider using a headless browser automation framework (Playwright) for read-only tasks like balance checks, while keeping signing in the antidetect profiles. proxy costs become meaningful, budget $30-80/month for residential proxies at this scale.
1000 wallets: the workflow shifts significantly. Rabby is no longer your primary interface for most operations. you are now managing private keys in a secure vault, signing transactions programmatically, and using Rabby only for spot-checking and manual interactions where protocol frontends require human-like behavior. infrastructure costs (proxies, RPCs, servers) can exceed $500/month. at this scale, read the antidetect browser comparison guides at antidetectreview.org/blog/ before committing to a single platform, as per-profile costs vary significantly between providers and the wrong choice locks you into expensive plans.
the operational discipline required at 1000x is qualitatively different from 10x. most operators do not fail because of tool choice. they fail because their operational security degrades as the operation grows.
where to go next
- EVM wallet rotation strategy for long-running campaigns covers how to retire and replace wallet clusters mid-campaign without losing continuity on protocols that track wallet age
- Airdrop tracking spreadsheet template and DeBank API integration walks through the exact sheet structure I use for campaigns with 50+ wallets, including automated balance pulls
- Multi-chain gas management for large wallet stacks explains how to maintain gas float across ETH mainnet, Arbitrum, Base, and OP simultaneously without over-funding individual wallets
Written by Xavier Fok
disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-05-19.