You open your crypto wallet to check your balance and notice something strange — small deposits, sometimes less than a cent, from addresses you’ve never seen before. You didn’t request them. Nobody you know sent them. They just appeared.
What you’re looking at is a crypto dusting attack. It sounds dramatic, and in one specific way it is: someone is deliberately trying to track you. The reassuring part is that receiving dust won’t drain your wallet. The important part is knowing what to do next — and what not to do.
What Is a Crypto Dusting Attack?
A crypto dusting attack is a privacy assault technique. An attacker sends tiny amounts of cryptocurrency — called “dust” — to thousands of wallet addresses simultaneously. These amounts are deliberately microscopic: sometimes 546 satoshis on Bitcoin (about half a cent), sometimes a handful of tokens worth less than the gas fee it would cost you to move them.
The dust itself isn’t the threat. The threat is what happens after you receive it.
On public blockchains like Bitcoin and Ethereum, every transaction is permanently visible to anyone. Blockchain analysts — whether legitimate firms like Chainalysis or bad actors running their own tools — can watch which coin inputs appear together in the same outgoing transaction. When multiple inputs flow into a single transaction, the standard assumption is that they all belong to the same person. This technique is called address clustering.
A dust attack exploits this. If you later move funds from your wallet and accidentally include that dust, the attacker links your addresses together. Repeat that across enough wallets, and they build a detailed map of who holds what. Their goal is de-anonymization — usually as a first step toward targeted phishing, extortion, or further attacks. The dust attack alone doesn’t steal anything. It’s surveillance.
How a Crypto Dust Transaction Actually Works
Understanding the mechanics requires a quick detour into how Bitcoin handles money — because this matters for what you should and shouldn’t do.
Bitcoin uses a system called UTXOs — Unspent Transaction Outputs. Think of each UTXO as a separate coin sitting in your wallet. You might have a UTXO worth 0.05 BTC from one deposit and another worth 0.02 BTC from a different one. When you send Bitcoin, your wallet software automatically combines UTXOs to cover the transaction amount — like grabbing a handful of coins from your pocket to pay for something.
Here’s how a dusting attack exploits this:
- An attacker sends 546 satoshis (Bitcoin’s dust limit — about $0.005) to your wallet address.
- That dust becomes a new UTXO sitting in your wallet alongside your real funds.
- The next time you send Bitcoin, your wallet may automatically include that dust UTXO to help cover the transaction amount.
- The attacker watches the blockchain. When they see the dust move in the same transaction as your other UTXOs, they know those addresses belong to the same owner.
- Done across thousands of wallets, this builds a detailed address ownership graph.
On Ethereum and EVM-compatible chains (Polygon, BNB Chain, etc.), the mechanism differs slightly — Ethereum uses an account-based model rather than UTXOs — but the intent is identical. Small token sends from unknown addresses should be treated with suspicion regardless of which chain you’re using.
Variants: Address Poisoning and Privacy Coin Attacks
Dusting attacks come in a few related flavors worth knowing about.
Address poisoning (related but distinct from a standard dust attack crypto technique): Instead of sending random dust to build a tracking graph, an attacker sends a tiny amount from an address with the same first and last characters as one you’ve paid before. The goal: next time you copy-paste a recipient from your transaction history, you grab the attacker’s lookalike address by mistake. I covered this scam in detail in the address poisoning attack post — if you’ve noticed suspiciously similar addresses in your transaction history, read that one too.
Privacy coin dusting: Attackers have attempted dusting on privacy-focused blockchains like Monero and Zcash-adjacent chains. These attacks are significantly less effective because privacy coins use cryptographic techniques — ring signatures, zero-knowledge proofs, stealth addresses — that make address clustering extremely difficult or close to impossible. On Monero, a dusting attack reveals very little useful information. If financial privacy is a serious concern for you, this is one of the concrete practical reasons people migrate to privacy coins.
Am I at Risk? Assessing Your Exposure After a Dusting Attack Bitcoin or Other Chain
If you’ve received dust, here’s how to think about your actual exposure honestly — no alarm-raising, no dismissal:
- You haven’t moved the dust yet. Lower risk. The dust is sitting there unspent. As long as you don’t consolidate it with your other UTXOs in a transaction, the attacker learns nothing new. This is the best-case scenario — act now before a routine transaction accidentally includes it.
- You’ve sent transactions since receiving the dust. Check your transaction history. If the dust UTXO moved in the same outgoing transaction as your other funds, some address linkage has already been established. This doesn’t mean an attack is imminent — it means your on-chain privacy has some exposure. Stay alert for follow-up phishing attempts in the coming weeks.
- You use a transparent blockchain (Bitcoin, Ethereum). Higher privacy exposure compared to users of privacy coins. Every transaction is public and permanent. Address clustering is a well-established technique used by both legitimate analytics firms and by attackers building target lists.
- You use a hardware wallet with CoinJoin or coin control features. Better protected. Tools like Sparrow Wallet and Wasabi Wallet let you see individual UTXOs and manually select which ones to include in transactions — meaning you can deliberately leave the dust unspent. This is the most practical protection available on Bitcoin.
- You’re holding a significant amount. High-value wallets are specifically targeted. A dusting attack is often the first step in a multi-stage campaign. If you hold meaningful funds in a wallet that’s publicly active on-chain, be especially alert to phishing attempts in the days after receiving dust.
What to Do If You Received Dust: Five Concrete Steps
This doesn’t require panic. It requires deliberate, calm action.
- Do not move the dust. This is the single most important step. If the dust UTXO stays unspent, the attacker gains no additional information from it. Most modern wallets allow you to mark specific UTXOs as “do not spend” — use this feature immediately. In Sparrow Wallet, right-click the UTXO and select “Freeze.” In Wasabi, UTXOs are visible in the coin list and can be excluded from transactions.
- Label the suspicious address. Tag it in your wallet software as “SUSPICIOUS DUST — DO NOT SPEND.” This prevents accidental inclusion months from now when you’ve forgotten about it.
- Consider upgrading to coin control tools if you’re on Bitcoin. Sparrow Wallet and Wasabi Wallet give you granular control over which UTXOs are included in each transaction. Wasabi also integrates CoinJoin, which breaks the address-clustering chain by mixing your transactions with others. If you hold meaningful Bitcoin, this isn’t overkill — it’s basic privacy hygiene on a transparent blockchain.
- Report the dust address. Chainalysis and MistTrack have community reporting tools where you can flag suspicious addresses. This contributes to the broader picture of malicious wallets and may protect others in your network from the same attacker.
- Don’t contact law enforcement unless the dust is followed by harassment or extortion. Receiving dust alone isn’t an actionable crime against you — it’s an information-gathering attempt. If someone follows up with threats to expose your holdings, demands for payment, or impersonates authorities, that escalates to extortion and is worth reporting. For guidance on what to do when things escalate into real theft or account compromise, see our step-by-step guide on what to do if your crypto wallet was drained.
The Honest Reality: This Is a Privacy Threat, Not an Immediate Theft Threat
Let me be direct: a crypto dusting attack cannot drain your wallet. Receiving dust does not expose your private keys. It gives no one the ability to move your funds. Your money is not at immediate risk of theft.
What’s at risk is your on-chain privacy — specifically, the ability to keep your wallet addresses from being linked to each other and potentially to your real identity. For most people using small amounts, this is a manageable concern. For people holding significant sums, for those in jurisdictions with hostile governments toward crypto holders, or for anyone who values financial privacy as a principle, it’s worth taking seriously.
The practical threat model works like this: dusting is step one in a potential multi-stage campaign. Step two is targeted phishing using the address map that was built. If you receive dust and then get suspicious emails, DMs, or wallet security alerts shortly after — treat them with heightened skepticism. They may be deliberately timed to follow the dust.
One thing people get wrong: creating a brand-new wallet and moving everything to it in a panic. If you do this immediately after receiving dust, you’ve created a clear on-chain link between your old wallet and your new one — the transaction shows the funds moving. In some cases, this gives the attacker more useful information than if you’d left the dust alone.
Stay calm. Don’t move the dust. Use coin control going forward. The people running these campaigns are counting on you to make a hasty move. Don’t.
Noticed mystery dust in your wallet? Don’t move it — read our guide to crypto wallet security to understand your full exposure. → What to Do If Your Crypto Wallet Was Drained