Crypto Dusting Attack: What Tiny Unknown Deposits Really Mean

You open your wallet and spot a deposit you never expected. It is tiny, worth a fraction of a cent, from an address you have never seen.

It feels like a glitch, or maybe a gift. More often it is neither. It is dust, and someone sent it on purpose.

A crypto dusting attack uses these tiny transfers to watch how you move your money. Here is how it works, what the sender is really after, and what to do when dust lands in your wallet.

What crypto dust is

In crypto, dust is an amount so small that it costs more in fees to spend than it is worth. Every chain has its own version, but the idea is the same everywhere.

On Bitcoin, the Bitcoin Core software treats very small outputs as dust and will not relay transactions that create them by default. For an ordinary legacy address, that line sits at 546 satoshis, and it is lower for newer SegWit addresses.

Not all dust is sinister. Exchanges and wallets leave small leftovers behind after trades and conversions, and many exchanges let you sweep those crumbs into a single coin. Dust only becomes a problem when someone deliberately sprinkles it across wallets to learn something.

How a crypto dusting attack works

The attacker sends a small amount of coin to a large batch of addresses, sometimes thousands at a time. The coins themselves are not the point. What matters is what happens to them next.

Bitcoin, Litecoin and similar chains track balances as separate pieces called unspent transaction outputs. If that term is new, our guide to the UTXO model explains it plainly.

When you send a payment, your wallet picks several of these pieces and combines them as inputs to one transaction. If the dust is among them, it gets spent alongside coins from your other addresses.

That moment links the addresses together on a public ledger. The attacker, or anyone else running the same analysis, can now see that those addresses probably belong to one person.

Do that across enough wallets and spending patterns, and a picture starts to form. If any of those linked addresses ever touched an exchange account with your name on it, the pseudonymous trail can lead back to you.

Who sends dust, and why

Criminals use dusting to find wallets worth targeting. Once they think they know who holds a large balance, they can follow up with phishing emails, extortion attempts or other personal pressure.

It is not only criminals, though. Blockchain analytics firms and investigators study dust patterns too, and the same public data is open to anyone with the tools and patience to read it.

Some dust is simply advertising. Senders attach messages or token names that point to websites, much like spam email. Those links are often the most dangerous part, because they lead to fake claim pages and wallet drainers.

Token dust and address poisoning

On Ethereum and other account-based chains, the trick looks a little different. There are no separate coin pieces to merge, so the attacker relies on what you see in your wallet instead.

One common version drops an unknown token into your wallet with a website in its name. If you visit the site and connect your wallet to "claim" or sell it, you may be asked to sign an approval that hands over your real assets.

Another version is address poisoning. The attacker sends a tiny or zero-value transfer from an address that starts and ends with the same characters as one you use often, so it sits in your transaction history looking familiar.

The hope is that you will copy that look-alike from your history next time you send funds. Learning to read and check a wallet address character by character is the best defense here.

How to spot dust in your wallet

The warning signs are simple once you know them. Watch for small, unexplained deposits from addresses you do not recognise, especially several at once.

Look out as well for tokens you never bought, often with names that include a web address or a promise of a reward. A legitimate project rarely announces itself by dropping coins on strangers.

If you want to see where a deposit came from, paste the transaction ID or sender into a block explorer. You can often see the same address sending identical amounts to hundreds of other wallets, which gives the game away.

What to do when you get dusted

The most important rule is the easiest one: do not touch it. Leaving dust unspent keeps it from linking your addresses, and the dust alone gives nobody control of your funds.

Many Bitcoin wallets with coin control let you freeze a specific output or mark it as do-not-spend. The privacy-focused Samourai Wallet popularised this idea back in 2018 after warning its users about a dusting campaign, and several wallets now offer something similar.

For unknown tokens on Ethereum-style chains, do not visit the website in the token name and do not try to sell or swap it. Many wallets let you hide such tokens so they stop cluttering your view.

Never copy a destination address from your transaction history. Use your address book, a saved contact or a fresh copy from the recipient, then check the full address before you confirm.

If you have already signed an approval for a suspicious token, revoke it with a reputable token-approval checker and move your remaining funds to a fresh wallet if you have any doubt.

Habits that make dusting less useful

Use a wallet that generates a new receiving address for each payment. Most modern hierarchical deterministic wallets do this automatically, which makes it harder to tie your history together.

Keep long-term savings separate from the addresses you use for exchanges and day-to-day spending. A wallet that never touches a named exchange account is much harder to link back to you.

For larger holdings, a hardware wallet with coin control gives you the most say over which pieces of your balance get spent. Be careful about sharing your addresses publicly, too, since a posted address is an easy target.

Common myths about crypto dust

One myth is that dust lets someone into your wallet. It does not. Receiving coins never requires your private key, so a deposit alone cannot move anything out.

Another is that you should send the dust back. Returning it means spending it, which is exactly the kind of transaction that can link your addresses, and the reply address may be watched.

A third is that only Bitcoin users get dusted. Any public chain can carry dust, including Litecoin, Bitcoin Cash, Dogecoin and Ethereum-style networks, even if the method changes from chain to chain.

Finally, some people assume a strange token must be valuable because it showed up for free. Real airdrops are announced through a project's own channels, not through a token named after a website you have never heard of.

Is a dusting attack dangerous?

For most people, dust is more of a nuisance than a real threat. It cannot take your coins on its own, and on Bitcoin rising fees have made large dusting campaigns costly to run.

The risk grows if you hold a lot, if your identity is public, or if you live somewhere personal safety is a concern. In those cases, being linked to a large balance is the real danger.

The token and address poisoning versions deserve more care, because they are built to trick you into doing something. Leave unexpected dust alone, never follow links attached to it, and always check where your money is going before you send it.