Crypto dusting attacks: what are they and how to avoid them?

What’s crypto dust?

Crypto dust is a very small balance or transfer. Some dust is ordinary residue; unsolicited transfers can also be used to connect addresses or draw someone into a scam. The relevant risk depends on the network and asset.

In Bitcoin, dust is an output whose value is small relative to the estimated cost of spending it. The threshold depends on the output type and node relay policy: 546 satoshis is a common legacy-output example, not a network-wide minimum.

Dust policy affects whether nodes relay a transaction; it is distinct from consensus rules. The word also describes small exchange-account balances left after trading. An exchange’s balance-conversion feature is not a privacy defence for Bitcoin outputs.

What’s a crypto dusting attack?

A dusting attack is when small amounts of cryptocurrency, called dust, are sent to multiple wallet addresses by malicious actors. This is done to track the movement of funds between addresses and invade the privacy of owners.

The immediate goal of UTXO dusting is to infer links between addresses. If those links are combined with identifying information, they can support targeted phishing or extortion. Receiving a small output does not itself expose private keys.

Dusting attacks can occur in public blockchains like Bitcoin, Litecoin, and Dogecoin.

Are all dusting attacks scams?

Not all cryptocurrency dust transferred to a crypto wallet is for scamming. Dusting can have other purposes besides hacking.

A small incoming transfer is not, by itself, evidence of malicious intent. Its purpose may be unclear, so avoid drawing conclusions solely from its size.

Developers may use dusting to stress test their software, which involves testing beyond normal limits to determine the software’s robustness, transaction processing speed, network scalability, and security protocols. This helps identify potential vulnerabilities in the software, allowing developers to improve its performance and security.

Crypto traders often receive dust resulting from trades, which is not an attack. Many exchanges offer customers the option to swap these small amounts of cryptocurrency for native tokens to use in future trades or another cryptocurrency with a low transaction fee.

How is it done?

Malicious actors exploit the fact that cryptocurrency users may not notice small amounts of cryptocurrency in their wallets in the same way you wouldn’t notice if a cent or penny was added to or went missing from your bank account.

If a wallet later spends an unsolicited output together with other outputs, an observer may infer common ownership. Blockchain data can reveal address links; connecting them to a named person requires additional information.

This does not infect the wallet with malware. The concern is information exposed through transaction patterns, which can be combined with data from other sources.

UTXO means unspent transaction output. Bitcoin wallets select outputs to spend and may create a change output. Coin selection and address reuse affect what observers can infer.

Crypto dust, like the change we get from a merchant when we spend money, can be used in other transactions later. But attackers can use advanced tools to trace a thread and determine the victim’s identity by detecting the origins of funds from the dust attack transaction.

Yeah, but can my crypto be stolen by dusting?

Not directly — but hackers can use sophisticated tools to trick wallet holders into accessing phishing sites and draining their funds, bypassing traditional dusting attacks.

A dusting attack identifies individuals or groups behind wallets to deanonymize them and break their privacy. These attacks cannot directly steal cryptocurrency but aim to detect victims’ social activities through the combination of different addresses, which can then be used for blackmail purposes.

Over time, attackers have become more sophisticated in disguising scam tokens as appealing free tokens, such as those claimed from popular NFT projects on phishing sites created by hackers that seem legitimate.

Unsolicited tokens and NFTs can advertise phishing links. The danger is following those links, exposing a recovery phrase or signing harmful permissions—not the mere appearance of a token.

Public addresses can receive unsolicited transfers regardless of whether their owner uses a mobile, browser or hardware wallet.

How to identify crypto dust attacks?

An unexplained small transfer is a reason to inspect the transaction, not proof of an attack. Check the network and transaction details without following links embedded in token names or descriptions.

Public address information can also be linked to identities through published addresses, data leaks or service records. A dust deposit alone does not disclose an exchange customer’s identity.

A separate scam uses transaction memos or token metadata to advertise a fake reward or claim site. Do not follow these links or sign requests from them.

After a dusting attack, cryptocurrency providers such as exchanges or wallets are usually encouraged to take strict measures to prevent future episodes.
In 2018, Samourai Wallet developers warned users of a dusting attack and asked them to mark UTXO as “Do Not Spend.” To help prevent future attacks, the developers added a real-time dust-tracking alert and an easy “Do Not Spend” feature to prevent future attacks.

Can I prevent being dusted?

Anyone with a public receiving address may receive unsolicited transfers. Focus on how the wallet handles them rather than trying to prevent every incoming deposit.

Attack costs depend on the network and fee conditions. High fees are not a reliable defence.

Leaving a suspicious UTXO unspent avoids creating a new spending link from that output. It does not erase existing address links or guarantee anonymity.

Simple measures like due diligence and education can go a long way in tackling wallet attacks. However, more elaborate and effective methods can be used to protect a wallet’s funds:

• Use network privacy tools carefully: Tor or a VPN may reduce exposure of your IP address, but they do not hide the public transaction graph.

• Distinguish the risks: UTXO dusting concerns address links; unsolicited tokens may carry phishing messages. Neither requires you to claim or move the deposit.

• Separate activity thoughtfully: Separate wallets do not guarantee privacy if later transfers connect them.

• Avoid address reuse: Use fresh Bitcoin receiving addresses where supported, while remembering that combined spending can still link outputs.

• Use coin control where supported: Mark suspicious UTXOs as unspendable or exclude them from coin selection. Converting or consolidating them may create the link you wanted to avoid.

• Be Cautious of Unknown Transactions: If you receive small amounts of cryptocurrency from unknown sources, be cautious. It could be a crypto dusting attack. Do not click on any links or respond to any messages.

• Treat screening as a signal: Address-risk tools may supply useful context, but a clean result is not proof that a token, website or signature request is safe.

To protect their funds, cryptocurrency users should guard against dusting and deanonymizing attacks. But they should also be aware of other cyber threats, such as ransomware, which is malware that prevents access to digital files until a ransom is paid.

Conclusion

Dusting is primarily a privacy concern; phishing messages attached to unsolicited tokens are a separate signing risk. Avoid spending suspicious outputs where coin control is available, and never disclose recovery phrases or sign unknown token permissions.

Sources: Bitcoin Core dust policy; Bitcoin privacy guidance; Wallet security guidance