Active user count can be a misleading metric for measuring the state of a crypto ecosystem as a small group of users can generate a significant portion of activity across multiple wallets, argues the co-founder of a blockchain analytics provider.

0xScope’s co-founder and chief data scientist, Philip Torres, told Cointelegraph amid the Bitget EmpowerX Summit that between monopolistic founding entities, bots, exploiters and airdrop hunters — as much as 80% of blockchain activity can be generated by just a small number of entities — despite looking healthy on the outside.

“These projects make a claim such as ‘we have 10,000 active users’ — well, we find out using the entity model that you have about 10 to 20 different users that are controlling 10,000 different addresses,” he added.

Top 25 projects based on active users (daily). Source: Token Terminal

“The way they operate on-chain is that one single person can have 10,000 addresses or more, and then it would seem to the outside observer as if those were 10,000 different people,” Torres explained.

The phenomenon isn’t only present in small-scale ecosystems, Torres claimed — essentially all blockchain ecosystems see varying levels of the activity.

He found the average Ethereum user possesses at least 10 addresses, adding that “everything that happens on-chain is not what it seems.”

Ethereum Cumulative Unique Addresses. Source: YCharts

Torres noted there are legitimate reasons why a user would have multiple wallet addresses.

“One of them can be explained easily as ‘privacy concerns.’ People like to have different addresses just to not leave a big enough footprint out there,” he explained.

It could also be due to automated traders deploying multiple strategies on-chain.

“So when we see automatic trading on-chain, usually each address is very focused on a different protocol or different swap, or trading different coins or trading different coins using different strategies.”

However, it has also been used for malicious purposes such as inflating a project’s active user numbers to mislead potential investors, creating a Sybil attack also known as a 51% attack or users trying to game an upcoming token airdrop.

One example came from the anticipated Arbitrum (ARB) airdrop on March 23 which saw two wallets amass 2.7 million ARB from 1,496 wallets in a strategy known as “airdrop farming.” In contrast, the median airdrop size was only expected to be 1,250 ARB tokens, according to CoinMarketCap.

“On blockchain, it's very easy to control multiple public addresses,” Torres noted.