What Is a Crypto Dusting Attack?

You open your wallet and notice a tiny, unfamiliar amount of cryptocurrency you never bought — a fraction of a cent, sitting there like a stray coin found in a pocket. It is easy to dismiss, and easier still to be curious about. That tiny deposit may be a dusting attack: a deliberate, low-cost technique that does not try to steal your funds directly, but to erode your privacy and mark you as a target. Understanding what dust is, and the single rule for handling it, protects both your anonymity and your future safety.

What “dust” means

In cryptocurrency, dust is an amount so small it is economically negligible — often worth a tiny fraction of a cent. On Bitcoin the concept is formalized: an output is considered dust when it holds fewer satoshis than it would cost in fees to spend it. The commonly cited threshold for the most common output type is 546 satoshis, below which nodes treat the output as non-standard because spending it would cost more than it is worth. Dust is a normal byproduct of ordinary activity, but attackers weaponize it by sending dust on purpose to many wallets at once.

How a dusting attack works

The attacker sends minuscule amounts to thousands, sometimes hundreds of thousands, of addresses. The dust itself is harmless. The attack begins only if the recipient spends it. Here is the mechanism, and it hinges on how blockchains handle funds:

On UTXO-based chains like Bitcoin, your balance is made up of separate chunks called unspent transaction outputs (UTXOs). When you send a payment, your wallet may combine several UTXOs as inputs to one transaction. If the attacker’s dust gets pulled in as one of those inputs, it is now combined with your other funds in a single transaction. That publicly links the dusted address to your other addresses, because they were all spent together by the same wallet. By watching for their dust to move and noting what it moves with, the attacker can cluster many addresses under one owner. To understand the underlying data they exploit, see what a blockchain actually is and how a transaction gets confirmed.

What the attacker is really after

A dusting attack is a privacy attack, not a theft. The dust cannot drain your wallet, and receiving it does not compromise your keys. What the attacker gains is intelligence: a map of which addresses belong to the same person, roughly how much they hold, and how they transact. This process of tying pseudonymous addresses to a single entity is address clustering. Once de-anonymized, a victim can face:

• Targeted phishing and extortion tailored to their holdings and history.
• Physical-safety risk if a real-world identity is linked to a large balance.
• Follow-on scams that reference real transactions to appear credible.

In short, dusting is reconnaissance. The theft, if it comes, arrives later through a scam that the attacker’s map made possible.

It is worth keeping the risk in proportion. For an ordinary user who never spends the dust, a single dusting transaction is close to harmless — a curiosity rather than an emergency. The danger scales with two things: how much value you hold and how easily your addresses can be linked to your real identity. A person managing large balances, or one whose on-chain activity is already tied to a public profile, has more to lose from de-anonymization than someone with a small, freshly created wallet. Match your caution to your exposure.

How dusting differs from address poisoning

Dusting is often confused with address poisoning, but the goals are opposite. Dusting is about privacy: the attacker wants you to spend the dust so they can trace and cluster your addresses. Address poisoning is about theft: the attacker plants a transaction from a lookalike address in your history, hoping you will later copy and reuse that wrong address and send funds to them. One wants you to move the tainted coin; the other wants you to copy a tainted address. The table clarifies the distinction.

How to respond to dust

The core rule is simple: do not interact with dust. Leaving it untouched neutralizes the attack, because the tracing only works if the dust is spent alongside your other funds. Practical steps:

• Do nothing with it. Do not send it, swap it, or forward it. Ignored dust cannot link your addresses.
• Never follow instructions attached to dust. Scam tokens sometimes arrive with a name or memo pointing to a website “to claim” more. That is bait leading to a phishing clone. Do not visit it or connect your wallet.
• Use coin control if your wallet offers it. Some wallets let you mark specific UTXOs as “do not spend,” so the dust is never selected as an input. This preserves your privacy while leaving the dust harmlessly in place.
• Improve your baseline privacy. Using a fresh receiving address for each incoming payment, as many wallets do by default, reduces how much a single dusting can reveal.

You can inspect a suspicious deposit safely by looking it up on a block explorer, which lets you see the transaction without touching your wallet. Note that account-based chains such as Ethereum do not use UTXOs, so the exact “spent-together” linkage differs; there, unsolicited tiny transfers and worthless “airdropped” tokens are more often vehicles for scam links or poisoning than for classic dust tracing — but the response is identical: do not interact.

Who runs dusting attacks, and why

Not every duster is a thief. The same technique is used by a spectrum of actors with different motives, which is worth understanding so you can gauge the real risk. Blockchain-analytics firms and researchers use dusting-style tracing as part of legitimate work such as tracking stolen funds or aiding investigations. Criminals use it to build target lists for phishing and extortion. Some dusting is essentially spam or advertising, sending tokens whose names carry a promotional or scam message. And occasionally, tiny transfers are used to test whether an address is active. Regardless of the sender’s intent, the same defensive rule holds: interacting with unsolicited dust only ever works in the sender’s favor, never yours, so don’t.

Privacy habits that blunt dusting

Dusting is one pressure on a broader surface: the fact that most blockchains are public and pseudonymous, not anonymous. Anyone can read the ledger, so linkages you create tend to be permanent. A few habits meaningfully raise the cost of clustering your activity:

• Use a new receiving address for every incoming payment. Modern wallets do this automatically for UTXO chains; reusing a single address makes clustering trivial and amplifies what any dusting reveals.
• Separate funds by purpose. Keeping savings, spending, and public-facing activity in distinct wallets limits how much one linkage exposes.
• Prefer wallets with coin control. Being able to choose or exclude specific inputs lets you keep dust permanently unspent.
• Avoid tying a real identity to a high-value address in public. Once name and balance are linked, de-anonymization has already largely succeeded.

These measures do not make you invisible — nothing on a public ledger does — but they shrink the map an attacker can draw and make a single dusting far less useful.

Token spam and fake airdrops

On chains that support arbitrary tokens, you may find worthless tokens or NFTs you never acquired sitting in your wallet. These are close cousins of dusting and are best handled the same way: do not interact. Many are engineered so that any attempt to sell, swap, or “claim” them routes you to a malicious contract or a phishing site. A token whose name is a web address or an instruction is a red flag by definition. Simply hiding or ignoring the item in your wallet interface is safe; trying to get rid of it by interacting with it is not. When you want to understand what an unfamiliar token actually is, inspect it on a block explorer rather than engaging with it in your wallet.

The bottom line

Dust is cheap for attackers to send and, by itself, harmless to receive. Its danger is entirely in what you do next. Treat any tiny, unexpected deposit or unknown token as something to observe and leave alone, never to spend, claim, or click. That single habit defeats dusting outright and closes one of the quieter doors that lead from your pseudonymous on-chain activity to a real-world target. For the wider picture on staying private and safe, the security hub pulls these practices together.

Sources

• What Is a Crypto Dusting Attack, and How to Avoid It? — Coinbase Learn
• Privacy — Bitcoin Wiki
• Transactions and the UTXO Model — Bitcoin Developer Guide
• Dusting Attack — Wikipedia