Dusting Attack

A dusting attack is the practice of sending very small amounts of cryptocurrency, known as dust, to a large number of wallet addresses in order to learn something about their owners or to draw them into a scam. On Bitcoin (BTC) and similar coins, the aim is usually surveillance: if the recipient later spends the dust together with other coins, the sender can link those addresses to one wallet. On account-based chains, dust tokens and tiny transfers are more often bait for phishing.

The technique exploits the openness of a public blockchain, where every transfer is visible, and the pseudonymity of addresses, which are not labelled with names. It sits alongside other privacy threats discussed under blockchain's privacy paradox and is closely related to the wallet address poisoning scam. Sending dust steals nothing; the danger lies in how the recipient reacts.

Imagine someone slips a coin with a tiny scratch mark into the pockets of everyone at a party. Later, they stand by the shop counters in town and watch which marked coins are handed over, and who is paying with them alongside other money. Before long they can tell which coins belong to the same person.

A dusting attack does this with digital coins. The attacker sends near-worthless amounts to many addresses and then watches the public record. When a wallet bundles the marked coin with other coins in one payment, the attacker learns that those addresses share an owner. On some networks the "coin" is instead a strange token whose name contains a website address, hoping the curious owner visits a fake site.

Bitcoin-style coins are held as unspent transaction outputs (UTXOs). When a wallet makes a payment it chooses which outputs to spend, and if it combines several in one transaction, outside observers can reasonably assume they belong to the same person. This "common-input" assumption is one of the main methods used in blockchain analytics.

A dusting attacker tries to force that link. The steps are:

1. The attacker sends a tiny output to many addresses, often ones that have been used before.
2. Wallet software that does not distinguish dust later sweeps it into a normal payment along with the owner's other outputs.
3. The attacker follows the dust on a block explorer or analytics tool and groups the co-spent addresses into a cluster.
4. If any address in the cluster is linked to an identity, for example through a withdrawal from a centralized exchange (CEX) that holds Know Your Customer (KYC) records, the whole cluster may be tied to that person.

The word dust also has a technical meaning in Bitcoin Core: an output so small that spending it would cost more in fees than it is worth. The node software treats such outputs as non-standard and does not relay transactions that create them. At the default settings the threshold for an ordinary legacy output is 546 satoshis, which is why many dusting payments use amounts just above that level.

In late October 2018, the developers of Samourai Wallet, a privacy-focused Bitcoin wallet, warned users that some of them had received small unsolicited amounts in what it described as a dusting attack, and added features that flagged dust and let users mark it "do not spend". In August 2019, Binance's security team reported that about 50 Litecoin addresses on its platform had each received 0.00000546 LTC, and said it would stop such small amounts from being used in its future transactions.

On Ethereum and other account-based networks, a related pattern became widespread: attackers send worthless tokens or non-fungible tokens (NFTs) whose names advertise a claim website, or make zero-value transfers from lookalike addresses. These are designed less for tracing than for luring users into signing malicious approvals in their Web3 wallet.

Dust can be sent for several purposes, not all of them criminal:

• Deanonymisation. Criminal groups may cluster addresses to identify wealthy targets for extortion, phishing or SIM swapping.
• Advertising and spam. Some senders put messages or website addresses in token names or transaction data to promote services.
• Phishing bait. Tokens that link to fake sites lead to drainers or requests for a seed phrase.
• Network stress. Large volumes of tiny transactions can also be a form of spam that raises fees, overlapping with denial-of-service concerns.

The simplest response to unexpected dust is to leave it untouched. Wallets with coin control let users freeze or label specific outputs so they are never spent alongside other funds. Using a new address for each payment, which hierarchical deterministic crypto wallets do automatically, limits what any one address reveals. Privacy techniques such as CoinJoin break the common-input assumption, although they carry their own compliance questions for exchanges.

For unknown tokens, users should not visit websites named in the token, should not try to sell or swap them, and should hide them in the wallet interface. Exchanges and custodians can configure their systems to ignore incoming dust when building withdrawal transactions. Firms subject to anti-money laundering (AML) rules may also see dust from tainted addresses appear in their Know Your Transaction (KYT) screening and need a policy for handling it.

• Bitcoin.org: Protect your privacy