Coordinated Farming Benefiting Veducks Apps
This summary presents findings at the confidence level the evidence supports. A full technical analysis with methodology, raw data, and relevant information is available on Google Drive.
Core Findings
A network of 1133 wallets farms and votes exclusively for Veducks apps (Bettermode, Betterbag, Verecycle). The pattern is consistent with coordinated, automated self-farming. Since first recorded activity on 23rd of September 2025, the network has earned 571k B3tr in app and voting rewards without ever withdrawing the bounty.
Coordinated Behavior
- Systematic swaps: before Feb 23, 2026, 1006 wallets swapped B3TR to VTHO in tight clusters.
- Coordinated voting: 1133 wallets voted exclusively for Veducks apps; 1034 in tight clusters.
- Exclusive app usage: all 1133 wallets interacted only with Veducks apps.
- Reused proof images: multiple confirmed cases of the network submitting images stolen from unrelated legitimate users.
- No on-chain connections: no transfers between wallets, no exit wallet.
- Scale & retention: ~571600 B3TR collected (538200 app rewards + 33400 voting rewards) since Sep 23, 2025, held without a single withdrawal for 10 months.
3,3k USD at current value is a significant sum for a farmer to hold untouched. VBD has attracted opportunistic farmers, typically running a farm, centralizing rewards and sending to a CEX, keeping only enough for voting multipliers to boost farming rewards. No comparable farming case of 500k+ B3TR held without withdrawal is known in the ecosystem.
Visual Proof
Legitimate users submit photos of the same physical setup over time. The farming network submits random, unrelated images with no consistent setup - several confirmed by the original photographers as their own private submissions. This indicates the network acquires images from a stored image library rather than recording real activity.
Proof images in the farming network are consistent with single-pass blur, indicating the network is not re-using URLs of already existing on-chain proofs.
Behavioral Shift - February 23, 2026
On Feb 23, 2026: public discussion on Vechain`s Telegram group about farming on Veducks apps, some speculating direct involvement of the owners.
The same day, 75 identified wallets were reported privately to Veducks representative Kalle, who confirmed banning them.
| Before Feb 23 | After Feb 23 | |
|---|---|---|
| Wallets swapping tight clusters | 1,006 | 0 |
| Wallets voting in tight clusters | 1,034 | 1 |
Because a public and a private disclosure happened the same day, it’s not possible to say which triggered the shift. An external operator watching public channels could have reacted to the Telegram discussion alone.
Financial Dependency
Veducks withdraws ~50% of its allocation each round. In Round #109, the farming network cast 1041 of 2030 votes (51.2%) for Veducks apps. The farming network has boosted Veducks allocation.
Technical Findings
- Fresh, unique uploads: every reused image gets a new Cloudflare ID rather than reusing an old link - files are re-uploaded, not link-copied.
- Single-pass blur: reused images show one blur pass, consistent with an unblurred source file rather than a re-blurred public copy.
- Possible access route: Kalle (Veducks) stated in August 2026 that a bug in their submission-history API let anyone retrieve a wallet’s unblurred images without logging in. This is Veducks’ own explanation. Such an attack is possible, but no proof is available to confirm the legitimacy of this explanation.
- Pre-cutoff image reuse: Veducks claim they periodically delete images older than ~6 months (manual, irregular).
- Anomalies in deleted images: images exist older than 6 months; recently uploaded images in the farming netowork are missing.
Manual Review and User Growth
Veducks reviews submissions manually. Confirmed in round #109 by having a denied submission (intentionally uploading an image that does not fit the criteria).
Round #64 (the round before the network’s first activity) had 758 total users across the 3 apps; by Round #87 (week of Feb 23) that reached 1599 (67% farming network); user counts have since held near 1500 (1515 in Round #109, 70% farming network). Over the same period, VBD unique wallet activity fell sharply (204k unique wallets ecosystem-wide in Round #64 vs. 11k in Round #98).
Timeline
- Sep 23, 2025 - First network activity.
- Dec 19, 2025 - Clustered swaps first spotted.
- Feb 23, 2026 - Public Telegram callout; 75 wallets reported privately to Kalle same day.
- Feb 23, 2026 onward - 75 wallets banned; remaining network’s timing shifts sharply.
- May 11, 2026 - Banned wallets’ VePassport eligibility expires.
- Aug 2026 - Full 1133 wallet network identified; Kalle offers the API exploit explanation.
Summary/Final Thoughts
The evidence shows a large, coordinated, automated network farming and voting exclusively for Veducks apps - holding 571k B3TR for 10 months without a single withdrawal, reusing real users’ stolen images, and accounting for up to 70% of Veducks’ active users in recent rounds. Veducks have provided an explanation, it is technically possible, but can’t be proved with the available publlic data.
Regardless of who is behind this operation, these wallets should be signaled to prevent further distortion of allocation rounds.
Veducks should issue a public statement addressing: the farming network, the data breach, what caused this situation, and what has and will be done to mitigate the impact of 10 months of undetected farming.
Open questions
- Why have Veducks still not informed their users about the data breach?
- How Veducks have missed a significant increase in user count, despite the opposite trend in the ecosystem?
- Why have Veducks failed to identify 70% of their users are farmers, considering the manual review system is in place?
- Why are there anomalies in recent public proofs in the farming network?
- Why is the farming network holding farmed and voting rewards for 10 months without exiting them?
References
Google Drive with all related data and in-depth analysis (including screenshots from the communication with Veducks representative Kalle)
In-depth analysis
List of 1133 wallets in the farming network
List of 1133 wallets in the farming network and their associated Vedelegate wallets
Wallets swapping in clusters
Wallets voting in clusters
Legitimate user vs farming network proof comparison on Bettermode
Initially reported 75 wallets