In October 2018, Binance warned users that a “large scale” dusting attack was underway on the Bitcoin network. An attacker had sent 0.00000547 BTC — about 547 satoshis, worth roughly three cents at the time — to tens of thousands of Bitcoin addresses. The amounts were negligible, easy to miss, and completely harmless on their own. But the purpose was anything but harmless. The attacker was watching, waiting for recipients to move that dust alongside their other funds. Each time someone did, the attacker learned which addresses belonged to the same wallet. Multiply that across tens of thousands of addresses, and you can map entire clusters of wallets to specific individuals or entities — shattering the pseudonymity that many crypto users take for granted.
A dusting attack is not a hack. No private keys are compromised, no smart contracts are exploited, and no funds are stolen directly. It is a surveillance technique — one of the most effective and least understood privacy threats in the cryptocurrency ecosystem. Attackers, blockchain analytics firms, and law enforcement agencies all use variants of dusting to trace wallet activity across the blockchain. Understanding how it works is essential for anyone who values financial privacy on a public ledger.
This guide explains how dusting attacks work, why they are particularly effective on Bitcoin’s UTXO model, how they differ on Ethereum and other account-based chains, and the specific steps you can take to protect your wallets from being de-anonymized.
BLUF: A dusting attack sends microscopic amounts of cryptocurrency (“dust”) to thousands of wallet addresses, then monitors the blockchain to see when recipients combine that dust with their main balances. When a victim spends dust alongside regular funds, the transaction reveals that all those inputs belong to the same person — linking previously separate addresses. The attack is most effective on Bitcoin and other UTXO-based chains (Litecoin, Bitcoin Cash), because the UTXO model physically mixes inputs in each transaction. Account-based chains like Ethereum are less vulnerable to dusting but can still be tracked through token transfers and address poisoning variants. Protection is straightforward: (1) Don’t spend the dust — most wallets let you mark specific UTXOs as unspendable; (2) Use coin control — manually select which UTXOs go into each transaction; (3) Use separate wallets for different activities so a single cluster compromise doesn’t reveal your entire footprint; (4) Consider privacy wallets (Wasabi, Sparrow) or privacy coins (Monero, Zcash) if anonymity is critical. If you receive an unsolicited tiny deposit from an unknown address, ignore it — the dust itself is harmless unless you consolidate it.
How Dusting Attacks Work
The mechanics of a dusting attack follow a predictable pattern. An attacker — who could be a criminal group, a commercial analytics firm, or a government agency — selects a set of target addresses. These might be all addresses holding more than a certain balance, all addresses that recently interacted with a specific exchange, or addresses associated with a particular service or protocol.
Phase 1: Target Selection
- Attacker identifies target addresses (e.g., all wallets holding > 1 BTC)
- Targets are grouped by patterns (exchange users, DeFi participants, etc.)
- Attacker funds a wallet dedicated to dusting
Phase 2: Dust Distribution
- Attacker sends tiny amounts (e.g., 500 satoshis / 0.000005 BTC) to each target
- These amounts are below the "dust limit" — too small to spend economically
- Distribution happens across many transactions to avoid raising alarms
Phase 3: Monitoring
- Attacker watches the blockchain for when dust UTXOs are moved
- When a victim creates a transaction that includes the dust as an input
alongside other UTXOs, the attacker learns those inputs share an owner
Phase 4: Clustering
- Attacker builds a graph linking addresses that have been combined
- Cluster grows as more dust is consolidated
- Once a cluster is linked to a real-world identity (via an exchange KYC leak,
a public transaction, or a known address), the entire cluster is de-anonymizedThe genius of the attack is its cost asymmetry. Sending dust to 10,000 Bitcoin addresses costs roughly $50–200 in transaction fees. The intelligence gained — a mapped cluster of linked addresses — can be worth thousands of dollars to criminals, analytics firms, or state actors.
The UTXO Problem: Why Bitcoin Is Vulnerable
To understand why dusting works, you need to understand the UTXO (Unspent Transaction Output) model that Bitcoin uses.
In Bitcoin, your wallet doesn’t hold a “balance” — it holds a collection of UTXOs, which are discrete chunks of bitcoin received in previous transactions. Think of them as individual dollar bills in a physical wallet. When you send bitcoin, your wallet selects one or more UTXOs to use as inputs, creates an output for the recipient, and returns any change to a new address you control.
Here is the critical vulnerability: when multiple UTXOs are combined in a single transaction, the blockchain publicly reveals that all those inputs belong to the same entity. This is called the “common input ownership heuristic,” and it is the foundation of blockchain analysis.
Imagine you have:
- Address A: 1.5 BTC (your main savings)
- Address B: 0.3 BTC (your trading wallet)
An attacker sends 0.00000547 BTC (the dust) to Address A. Weeks later, you make a payment. Your wallet software automatically selects the most efficient UTXOs — and if it includes the dust along with your main balance, the transaction shows inputs from both the dust and your real funds. Now the attacker knows that Address A belongs to the same person who received the dust. If Address B later interacts with Address A, the attacker can link B to the same cluster.
Repeat this across dozens or hundreds of addresses, and you can map a user’s entire wallet footprint — even if they carefully used different addresses for every transaction.
The Dust Limit
Bitcoin defines a “dust limit” — the minimum output value that is considered economically spendable. Below this threshold, spending the output would cost more in transaction fees than the output is worth. On the Bitcoin network, the dust limit is calculated as:
dust_limit = fee_rate × input_serialized_size
For standard P2PKH outputs:
dust_limit ≈ 546 satoshis (at 1 sat/vB fee rate)
For SegWit outputs:
dust_limit ≈ 294 satoshisDusting attacks deliberately use amounts at or just above this limit — enough to be a valid output, but small enough that spending it costs the victim money. This creates a dilemma: the dust sits in your wallet, and if your wallet software auto-selects it during a future transaction, your privacy is compromised.
Dusting on Account-Based Chains
Ethereum and most modern blockchains use an account-based model instead of UTXO. In this model, each address has a single balance, and transactions simply debit one account and credit another. There are no discrete “inputs” to combine.
This makes dusting far less effective on Ethereum:
| Feature | UTXO (Bitcoin) | Account-based (Ethereum) |
|---|---|---|
| Input linking | Combining UTXOs reveals shared ownership | No input mixing — one source per transaction |
| Dust impact | Dust UTXO can be bundled with main balance | Dust just sits in account balance |
| Tracing method | Common input ownership heuristic | Transaction graph analysis (heuristic-based) |
| Vulnerability | High | Low |
However, Ethereum is not immune to privacy attacks. While dusting in the UTXO sense doesn’t work, attackers use related techniques:
- ERC-20 token dusting: Sending tiny amounts of tokens (often fake tokens or airdropped tokens) to addresses. These appear in transaction history and can be used for address poisoning attacks, where the fake token contract or transfer is designed to trick users into interacting with malicious contracts.
- Transaction graph analysis: Without input mixing, analysts still build transaction graphs by tracking which addresses transact with each other. Tools like Chainalysis and Arkham use machine learning to cluster Ethereum addresses based on behavioral patterns — timing, gas price preferences, interaction with specific DeFi protocols, and more.
- ENS and metadata leakage: Ethereum addresses linked to ENS names, Twitter profiles, or GitHub accounts are trivially de-anonymized without any dusting at all.
Privacy Coins Are Different
Privacy-focused cryptocurrencies are designed to resist all forms of transaction tracing, including dusting:
- Monero uses ring signatures, stealth addresses, and RingCT to hide the sender, receiver, and amount in every transaction. Dusting is completely ineffective because the attacker cannot determine which output in a ring belongs to the target.
- Zcash offers shielded transactions using zk-SNARKs. When both sender and receiver use shielded addresses, the transaction is invisible on the public ledger — no amount, no addresses, no metadata.
Notable Real-World Dusting Campaigns
Dusting attacks are not theoretical. Several large-scale campaigns have been documented:
Binance Dusting (2018): The exchange publicly warned users about a dusting attack that targeted Bitcoin addresses. The attacker sent 0.00000547 BTC to approximately 48,000 addresses. This remains one of the most widely reported dusting incidents and triggered widespread awareness of the attack vector.
Litecoin Dusting (2019): An attacker dusted roughly 300,000 Litecoin addresses, sending 0.000011 LTC to each. The scale suggested a commercial analytics operation or a state-sponsored surveillance program, though the perpetrator was never identified.
Ethereum Token Dusting (2020–2024): Thousands of Ethereum addresses received tiny amounts of unsolicited ERC-20 tokens. Many of these were phishing operations — the token contract included a fake “claim” mechanism that directed users to malicious websites designed to drain their wallets through blind signing or token approval scams.
BSC Dusting (2023): Binance Smart Chain’s low transaction fees made dusting nearly free. Researchers identified campaigns sending micro-amounts of BEP-20 tokens to over 100,000 addresses, primarily to build wallet clusters for subsequent phishing or rug pull operations.
Dusting vs Legitimate Micro-Transactions
Not every small transaction is an attack. The blockchain is full of legitimate micro-transactions, and distinguishing between them requires context:
| Signal | Likely Dusting Attack | Likely Legitimate |
|---|---|---|
| Sender | Unknown address, no prior history | Exchange, mining pool, known service |
| Recipients | Hundreds/thousands of addresses simultaneously | One or a few recipients |
| Amount | Below dust limit (546 sat) | Variable, often meaningful |
| Frequency | One-time, widespread | Recurring or event-driven |
| Token | Native chain token (BTC, LTC) | Could be ERC-20 airdrop, exchange withdrawal |
| Intent | No transaction following | Often paired with a message or claim mechanism |
Common legitimate sources of small transactions include:
- Exchange test withdrawals — Exchanges sometimes send a small test transaction before a large withdrawal to verify the destination address
- Mining pool payouts — Pools distribute mining rewards to thousands of workers, often in small amounts
- Token airdrops — Projects distribute tokens to many wallets as a marketing or governance mechanism
- Lightning Network activity — Opening and closing payment channels generates small on-chain outputs
If you receive a small deposit from a recognized exchange or mining pool, it is almost certainly legitimate. If it comes from an unidentified address and matches the amount sent to thousands of other addresses, treat it as dusting.
How to Detect If You’ve Been Dusted
Detecting dusting requires monitoring your wallet for unsolicited small deposits. Here is a practical detection workflow:
Step 1: Check Your Transaction History
Open your wallet in a block explorer like mempool.space (Bitcoin) or Etherscan (Ethereum). Look for incoming transactions with:
- Amounts below 0.0001 BTC or equivalent
- Senders you don’t recognize
- Transaction timestamps that coincide with known dusting campaigns
Step 2: Check the Sender’s Activity
Click on the sender address in the block explorer. If it shows outgoing transactions to hundreds or thousands of addresses with similar small amounts, you have been dusted.
Step 3: Monitor for Cluster Linking
Use a blockchain analytics tool (Arkham Intelligence, OXT Research for Bitcoin) to check whether your addresses have been grouped into a cluster. If your previously separate addresses now appear in the same cluster, a dusting attack may have succeeded.
Step 4: Review UTXO State
For Bitcoin wallets with coin control (Electrum, Sparrow), view your UTXO list. Dust will appear as a small UTXO from an unknown source. Mark it immediately to prevent accidental spending.
How to Protect Yourself
Protection against dusting falls into two categories: preventing the dust from being linked, and reducing your overall traceability.
1. Don’t Spend the Dust
The simplest and most effective defense. If you notice an unsolicited tiny deposit, do not include that UTXO in any future transaction. Most Bitcoin wallets support marking UTXOs as unspendable:
- Electrum: Right-click the UTXO → “Mark as spent” (it won’t be selected for future transactions)
- Sparrow Wallet: Go to UTXOs tab → select the dust → “Freeze” it
- Wasabi Wallet: The wallet automatically isolates dust inputs
As long as the dust UTXO is never combined with your main funds, the attacker cannot link your addresses through that transaction.
2. Use Coin Control
Coin control is a wallet feature that lets you manually select which UTXOs to include in each transaction. Instead of letting the wallet auto-select inputs (which may accidentally include dust), you explicitly choose only the UTXOs you intend to spend.
Wallets with coin control support:
| Wallet | Platform | Coin Control | Auto-Dust Protection |
|---|---|---|---|
| Sparrow Wallet | Desktop (Win/Mac/Linux) | Full | Yes |
| Electrum | Desktop (Win/Mac/Linux) | Full | Manual freeze |
| Wasabi Wallet | Desktop (Linux) | Full | Automatic (CoinJoin) |
| BlueWallet | Mobile (iOS/Android) | Limited | No |
| Ledger Live | Desktop + Hardware | Limited | No |
3. Use Separate Wallets
Maintain separate wallets for different purposes — one for savings, one for daily transactions, one for exchange interactions. If one wallet gets dusted and linked, the attacker only sees activity within that wallet, not your entire financial footprint.
For maximum separation, use a fresh address for every transaction. Most modern Bitcoin wallets generate a new address for each incoming payment by default. This is a Bitcoin best practice that limits the information an attacker can gain even if they successfully dust one address.
4. Use Privacy Wallets and Techniques
If financial privacy is critical, consider these tools:
- CoinJoin: A mixing technique where multiple users combine their transactions into a single collaborative transaction, breaking the link between inputs and outputs. Wasabi Wallet and Samourai Wallet implement CoinJoin for Bitcoin. The mixed UTXOs are untraceable to specific inputs.
- Mixers: Services like Tornado Cash (Ethereum) allow users to deposit funds and withdraw from a different address, breaking the on-chain link. Note that mixers face intense regulatory scrutiny — Tornado Cash was sanctioned by the US Treasury in 2022.
- Privacy coins: Monero and Zcash provide privacy at the protocol level, making all forms of tracing — including dusting — ineffective by design.
5. Use a Hardware Wallet for Cold Storage
Hardware wallets like Ledger and Trezor keep your private keys offline. While they don’t prevent dusting (anyone can send to your public address), they protect against the more dangerous follow-up attacks — phishing campaigns and wallet drainers — that often accompany dusting operations. Combined with proper address management, a cold wallet setup significantly reduces your attack surface.
Dusting in Law Enforcement and Compliance
It is important to understand that dusting-like techniques are not exclusively used by criminals. Blockchain analytics firms — including Chainalysis, Elliptic, and TRM Labs — perform sophisticated versions of transaction clustering for law enforcement and compliance purposes. Their tools go far beyond simple dusting:
- Heuristic clustering: Combining the common input ownership heuristic with temporal analysis, behavioral fingerprinting, and known-address databases to build comprehensive wallet maps.
- De-anonymization through off-chain data: Linking on-chain addresses to real-world identities via exchange KYC records, IP addresses from node connections, and public transaction disclosures.
- Real-time surveillance: Monitoring the blockchain in real-time for specific address patterns, flagging transactions involving sanctioned entities, and generating alerts for suspicious activity.
Law enforcement agencies use these tools to trace ransomware payments, identify money laundering networks, and map criminal wallet clusters. The same techniques that protect your privacy against a criminal dusting attack also protect criminals from law enforcement — creating an inherent tension between personal privacy and public security that the crypto community continues to debate.
For most legitimate users, the concern is not law enforcement but rather commercial surveillance. Companies build wallet profiles to sell to advertisers, insurers, and lenders. A dusting attack by a commercial analytics firm can result in your wallet activity being included in a dataset sold to third parties without your knowledge or consent.
Frequently Asked Questions
Q: I received a tiny deposit from an unknown address. Was I dusted?
A: Check the amount and sender. If it is below 0.0001 BTC (or equivalent on other chains) and the sender address has outgoing transactions to many other addresses with similar amounts, it is likely a dusting attack. If it is from a known exchange or mining pool, it is probably legitimate. Either way, do not spend that specific UTXO until you are certain.
Q: Can dusting attacks steal my funds?
A: No. Dusting is a privacy attack, not a theft attack. The dust sits in your wallet harmlessly. The risk is only that spending it alongside other funds reveals that those addresses belong to the same person. The actual danger comes from follow-up attacks — phishing campaigns targeting dusted addresses, or address poisoning attacks that exploit users who copy addresses from their transaction history.
Q: Does dusting work on Ethereum?
A: Minimally for ETH itself, because Ethereum’s account model doesn’t mix inputs the way Bitcoin’s UTXO model does. However, ERC-20 token dusting is common and is typically used for address poisoning or phishing rather than transaction tracing. If you receive unsolicited tokens, do not interact with any contract those tokens link to — see our guide on how to prevent wallet drainers.
Q: How much does a dusting attack cost the attacker?
A: Very little. Sending 546 satoshis to 10,000 Bitcoin addresses costs roughly 0.0546 BTC in dust ($35 at $65K/BTC) plus transaction fees of approximately 0.01–0.05 BTC ($650–$3,250). On low-fee chains like BSC or Polygon, the cost is under $10. The intelligence gained is worth far more.
Q: Can I report a dusting attack?
A: There is no central authority to report dusting to, since sending cryptocurrency to someone is not illegal. You can report it to your wallet provider or post about it on community forums to warn other users. If the dusting is accompanied by phishing links or malicious tokens, report those to the relevant blockchain security firms (e.g., Chainalysis, TRM Labs) and your wallet provider.
Q: If I’ve already spent dust by accident, is my privacy gone forever?
A: Not necessarily, but the affected addresses are now linked in any transaction graph built from that transaction. The best response is to move remaining funds to new addresses and treat the old addresses as compromised for privacy purposes. Going forward, use coin control to prevent accidental dust inclusion, and consider using a privacy wallet for sensitive transactions.
Key Takeaways
- Dusting attacks send tiny amounts of crypto to thousands of addresses, then monitor the blockchain to link wallets when the dust is consolidated with main balances.
- The UTXO model used by Bitcoin is the primary vulnerability — combining UTXOs in a single transaction publicly reveals shared ownership through the common input ownership heuristic.
- Account-based chains like Ethereum are less vulnerable to traditional dusting but face related threats like ERC-20 token dusting and address poisoning.
- Detection is straightforward: check transaction history for unsolicited micro-deposits from addresses that sent similar amounts to many recipients.
- Protection is primarily about not spending the dust: use coin control to manually exclude dust UTXOs, freeze them in wallets that support it, and use separate wallets for different activities.
- Privacy wallets (Wasabi, Sparrow) and privacy coins (Monero, Zcash) provide protocol-level protection against dusting and other tracing techniques.
- Law enforcement and analytics firms use dusting-like techniques for legitimate purposes — the same technology that catches criminals also compromises ordinary users’ financial privacy.
- The dust itself is harmless — the real danger is in follow-up attacks (phishing, address poisoning, wallet drainers) that target dusted addresses, and in the loss of pseudonymity that comes from wallet clustering.
For related reading on protecting your crypto from surveillance and scams, see our guides on address poisoning attacks explained, how to track stolen crypto, and how to prevent wallet drainers.