The total number of users dropped from around 218 thousand to about 43 thousand users in one day! The 'paradigm shift' term was used for a reason, as can be seen in the chart below. It was not a one-day anomaly. While the number of daily users has fluctuated, since the 27th, levels have remained fairly constant.

On May 26th, 2022, (or 27th depending on your time zone),a dramatic paradigm shift occured in the Harmony blockchain ecosystem, regarding the daily count of active addresses. An "active" address, we define as, any wallet which either receives or sends a transaction on that given day.

By adjusting the period_start parameter, you can zoom out, all the way back to December first of 2021, and discover that the daily active users over the past two weeks is at consistent levels not seen before. Let's compare some aggregate data, dividing the period starting on Dec 1, 2021 through May 26th, 2022 to the period from May 27th to the present. See below.

The address and median are almost ten times as much for the period running from December of last year through May 26 and the period starting on May 27th through today, June 9, 2022. (The tables and charts will update themselves, if this article still has interest later on, but the writing won't. Sorry about that.)

The day with the most active wallets, from May 27th through June 9, 2022, is less than the day with the least active wallets, during the six month period before!

Put another way, there have now been 13 consecutive days below the previous low of the preceding 5 month period! Our task is twofold:

1. Detect the cause of the drop in active users
2. Detect changes in KPI (key performance indicators) (Does the drop indicate future loss of revenue and create selling pressure on ONE, Harmony's native token?)

Terms:

• Active User: Addresses with at least one transaction on a given day.
• Before or Then group: addresses that transacted for the period from May 1 to May 26.
• After or Now: addresses that have transacted from May 27 through the present.
• Singleton A from address that only transacted once on a given day — more on this later.

Key performance indicators before and after May 27

Before we panic, we as yet don't know whether this is impacting the bottom line or not! Is value still locked? Are these missing addresses no longer contributing to the ecosystem, or were they just doing transactions back and forth with limit effect on the ecosystem? We need to look at some meaningful financial metrics for two reasons:

1. To see if the price/ market cap of ONE either caused or was effected by the change
2. To see if we care. 

If the actual metrics, that are important to the protocol, are not overly affected, it remains an interesting excercise, and is important for Harmony so that they can better understand their users. However, it still will be useful to take a look at the KPI (key performance indicators) to see if there were any other changs.

Here's what I looked at:

• price action: The Harmony One token does begin to underperform the crypto market right around May 26th, according to the price chart on coingecko, comparing to the price of ETH. This is not very conclusive and plays no role as far as the cause of the drop.

• volume (including amount of ONE in the transaction so we arent just counting users but how much is being spent. We choose to measure in ONE instead of USD to filter out the Macro-economic conditions which we know are bad.

Preface

This analysis is a submission for a MetricsDAO bounty, that turned into a collaborative analysis amongst several top analysts and me, an aspiring top analyst who probably isn't quite there yet. This analysis is a continuation of work done by these masters.

In particular, I would like to single out @rplust, who previously submitted an insightful analysis about active users! He submitted this analysis before the time period, in which we are most interested in, but the code saved me a lot of time. Also @antonidas, @issui, @danner.eth and @jackguy contributed to this analysis.

Flipside has introduced a new parameter feature into their dashboard functionality. Unfortunately, right now, the parameter is tied to the entire dashboard instead of individual charts. You can see just above this paragraph a drop down menu, so you can zoom out or in for the proper perspective.

Unfortunately I am unable at this time to make access to this button more convenient so you will have to just scroll up to the top of the page to switch parameters. The default should be set to 5-27.

Introduction

Where Have All the Wallets Gone ??

How do we define a "bot"?

This problem presents itself farily often in the world of web3 analytics. The first step is always to look at addresses and count how frequently and how often they transact. Sometimes this bar is set as low as > 20 a week. This isn't an unreasonable assumption if the users are primarily engaged in swapping and trading (although a 10 tx a day cutoff is probably a more reasonable assumption).

In the world of the Harmony blockchain, however, a human may make 100 transactions a day. This is because of the (once?) popular "GameFi" game of "Defi Kingdoms". Without going into the nuances of the game, (since I don't know them), it involves combining all the basic elements of decentralized finance (DeFi): "staking, swapping, liquidity providing, etc. along with NFTs (which have actual utility beyond aesthetics). All of these features are then folded into a role playing game with heroes and such.

According to Defillama, over 25% of the Harmony protocols value is locked in the DFK protocol. This means that are usual methodology of counting transactions, at the very least must consider raising the bar on the number of transactions, when considering which addresses are and aren't "bots".

It is hard to imagine such a significant and semi-permanent drop to have happened organically. Usually such things can be explained by some kind of botting activity or automated process of some sort.

Above: The transactional volume makes a big dip, on May 28th but this is something that we have seen before. Also the volume increases markedly the next day. This suggests that the transactions do not involve a lot of ONE. We should note that high volume is not necessarily a good thing as, for example, there could be a mass exodus from Harmony to a central exchange. However, we see nothing like the huge decrease in transactions/ number of active addresses.

Above: This confirms that the drastic drop in user addresses only shows up when viewing the "from" transactions. It is perfectly natural for there to be more from addresses than to addresses. But still this is another puzzle piece. See how smooth the small blue bars move around. There is no large drop from which levels are never recovered. Also, the discrepancy between from and to addresses seems large.

Zooming in

Below we see an hourly version of the active users chart. We do this to see if we can pinpoint when the drop occured during the day.

The big drop comes between 8 and 9 pm. At the turn of the clock, it dropped from 11k (inside the normal range of daily transactions still) then falls down another 4k, to the new found daily range.

Next, keeping in mind that we need to think hard about how many transactions is the right cutoff in defining bots versus humans, we count transactions per address.

What a difference a day makes!

Because of the sheer volume of unique addresses in a day, I decided to first, break things down with just one day before and one day after. I start with may 25th and may 28th. These are full days before and after the "big drop" so searching for a dramatic difference makes sense to me.

This is exploring and is not definitive, but counting transactions per active user and comparing the two dates could give us some new insights...

I am not a big fan of using tables generally. I make an exception this time, because it is the simpplest way to isolate addresses that pique my interest. We see the same three addresses on the top of both days' lists with very similar numbers. These are probably contracts of some sort and it would be easy enough to figure out, but we can see that these three addresses are still around and not part of the problem. They cancel each other out.

Looking at the next few spots, there does seem to be the possibility of something here. We see the addresses ranked fourth through sixth logging over 10 thousand transactions in our before table, while the fourth highest address on the "then" table is 7000 or so and it is an address that appears on may 25th (increase from around 4k). These three addresses are worth investigating, but that is only a small portion of the difference in total transactions for the day! Remember we are talking about a drop from 176000 to 34000! This may or may not be a partial solution, but it is definitely not the entire solution.

Distribution of Addresses by transaction count

We've counted how many transactions per address, now lets count how many addresses per number of transactions. This will give us a better feel of what might be considered a "normal" number of transactions in a day. Also there were murmurings about single transaction addresses...

Hmm.. A drop of 137,000! This pretty much accounts for the entire discrepancy. Yes the actual drop was 142,000 but that is just splitting hairs. We already accepted that there is high variance on a daily basis in terms of transactions.

So, while we have been conditioned to think of bots as entities that transact a whole bunch, what seems to be happening here is that there is a coordinated assault of single transactions. Let's zoom back out a bit...

Sure enough! The chart looks just like the active users chart.

And when we look at transactions without counting singletons, it looks completely normal!

I am tempted to show another chart here with singletons as a percentage of total transactions per day, which would be even more dramatic, but as far as I am concerned, we know the issue is a weird preponderance of singleton transactions which stopped happening on May 27.

What Were These Wallets Up to? —

Above we see a table showing the top recipients of the singleton transactions for the date of May 25. I decided it would be best to see where the transfers were going, on a day by day basis. We only want to count transactions coming from an actual singleton addres for that day — so we want to be careful not to count transactions coming from a future singleton that is sending more than one transaction that day.

Using the new parameter feature, I was able to compare several different days in April and May. The top address completely dominates the receiver list in terms of most transactions received from singletons.

• Total value locked (TVL)

These transactions would not have impacted Harmony's Total Value Locked. Since Defi Kingdom TVL might show up, as a result of money being syphoned out of the ecosystem, it is worth checking their 's since they play a large role in the Harmony ecosystem. We see a decline, consistent with the market as a whole, but no major impact such as is observed with unique wallets/ transactions

Macroeconomic Summary

Clearly more users is better, but if fake users or bots, who do not contribute to value, and may be detrimental to the long term usage of actual humans on the network have decided to pack up and leave, 'Good Riddance' may be the appropriate response!

We can clearly surmise that this drop in users was not a response to macroeconomic conditions. It is too drastic and persistent. However, the overall effect does not seem to be immediately impacting the overall health of Harmony, though like most of the crypto space, conditions are not ideal.

Key Player:

0xdedb8ca3ae4707917e7b0fe55e99a6cd2892bc90

This address is the recipient of a vast majority of the transactions coming from singletons. This was verified over a sample of several days In April and May. By entering a date value into the day parameter field, this can be confirmed.

Conclusion

• After noticing a significant and permanent drop in the number of daily active users, we set out to investigate.

• We noted that to_addresses did not decline.

• We zoomed in hourly and noticed the same sharp decline observable in the daily chart.

• Using the usual bot detection approach, we looked at addresses with a large number of transactions, keeping in mind that a large number of transactions is normal on Harmony because of DFK. While there were some addresses on May 25th transacting in the 10000 range, the top 3 addresses were the same on both days and the difference in the total transactions was nominal.

• We then looked at "singleton wallets" which we defined as those wallets which only transact once on a day and noticed a huge discrepancy. The pattern of singleton transactions on a daily chart looked just like the chart, depicting the number of active wallets. When singleton wallets were removed from the equation, there was no longer a discrepancy in number of transactions.

• Therefore we concluded that there was a concerted operation, in which a large number of wallets (> 100k per day) would make just one transaction on a daily basis. The bulk of these transactions went to address

0xdedb8ca3ae4707917e7b0fe55e99a6cd2892bc90