Dust Attack
A dust attack is a de-anonymisation technique: an attacker sends tiny amounts of cryptocurrency ("dust") to thousands of addresses at once, then tracks how those funds move to link wallet addresses to real identities. It's used by scammers and, in some cases, by state actors for surveillance.
How a Dust Attack Works
The technique exploits how many wallets automatically consolidate small incoming amounts with existing balances when you make a future transaction. If a dust deposit gets combined with your other funds in a single outgoing transaction, the attacker can observe that combination on-chain and infer that both addresses belong to the same wallet, chipping away at your anonymity.
Who runs dust attacks and why
Motives range from targeted phishing (once an attacker links your addresses, they can craft more convincing scam messages) to broader surveillance by state or quasi-state actors trying to de-anonymise activity on privacy-focused chains. Some dust transactions also carry malicious links in their transaction memo field, hoping the recipient clicks out of curiosity.
What to actually do about dust
The single safest response is to never spend or move dust you didn't request. Most modern wallets let you mark dust UTXOs (unspent transaction outputs) as "do not spend" so they never get bundled into a future transaction. If your wallet lacks that feature, simply avoid a manual transaction that would include the dust address's balance.
Why Dust Attacks Matter for Your Crypto Security
Dust attacks rarely cause immediate financial loss on their own, but they erode the privacy that makes it harder for attackers to target you specifically. Once your addresses are linked to a real identity, you become a more attractive target for phishing, SIM-swap attempts, or physical threats aimed at high-balance wallets.
A Worked Example of a Dust Attack
Imagine a user who keeps a modest balance on a single wallet and uses it for occasional payments. One morning a deposit worth a fraction of a cent appears from an address they have never seen. They ignore it. Weeks later they send a payment, and the wallet, trying to be efficient, pulls in several small outputs, including the dust, to cover the amount. On a UTXO-based chain, that one transaction now publicly lists the dust address and the user's other addresses as inputs together.
The sender of the dust only has to watch for exactly this. Once several of the user's addresses are tied into one cluster, the attacker can follow the cluster to an exchange deposit, a payment to a merchant, or a post where the user shared an address. At that point an anonymous balance has a name attached to it. Nothing was stolen, which is why many people never notice that the attack worked.
Common Misconceptions About Dust
A frequent worry is that the dust itself is malicious code. It is not: a small transfer of an ordinary coin cannot run anything on your device or empty your wallet. The danger is behavioural. Sending the dust onward, trying to swap it, or clicking a link or token name that came with it can lead you to a phishing page, so the safest handling is to leave it alone.
Another misunderstanding is that dust attacks only matter to people with large balances. Attackers cast a wide net precisely because they do not know in advance who holds what. Account-based networks and token airdrops can also be used to send unsolicited tokens that carry a lure rather than a tracking trick. If a token appears that you did not buy, treat the name, any website it advertises and any prompt to claim something as untrusted, and do not approve anything connected to it.
Frequently Asked Questions
Is a dust attack dangerous by itself?
Not directly — you can't lose funds just by receiving dust. The risk comes from what an attacker learns afterward: linking your addresses to a real identity, which then enables more targeted phishing or, in extreme cases, physical targeting.
How do I know if I've received dust?
Look for a tiny, unrequested deposit (often a fraction of a cent in value) that you don't recognise. Many wallets flag these automatically or let you inspect the transaction's origin.
Should I move or spend dust I received?
No. Leave it untouched, or mark it as "do not spend" if your wallet supports that. Combining it with your other funds in a transaction is exactly what lets the attacker link your addresses.
Can a dust attack lead to my account being frozen?
The dust itself is unlikely to cause a freeze, but there is one indirect risk. Dust is sometimes sent from addresses that already carry a poor risk history. If you later move it to an exchange together with your own funds, a compliance system may see exposure to that source. Leaving the dust untouched avoids the issue.
Do I need to report a dust attack?
Usually not, because no funds were taken and the sender is rarely identifiable. It is sensible to note the address and transaction ID, mark the output as do not spend, and be extra careful with unexpected messages. If a scam follows from it, keep those records for any later investigation.