A dusting attack sends tiny amounts of crypto (dust) to many wallet addresses to track their activity and potentially identify the owners. The attacker sends fractions of a cent to thousands of wallets, then monitors when those dust amounts are spent (combined with other UTXOs or tokens), linking previously unconnected addresses together. It is a surveillance technique, not a direct theft mechanism.
What Is a Dusting Attack?
4 min read
The short version
Someone sprinkles breadcrumbs (tiny token amounts) across thousands of wallets. When you later spend those breadcrumbs together with your other funds, the attacker can see which wallets belong to the same person. It is like marking dollar bills with invisible ink and seeing where they end up. The dust itself is harmless. The danger is the privacy loss and potential targeted attacks that follow.
How It Works
How it works on Bitcoin: the attacker sends 546 satoshis (minimum non-dust amount, ~$0.30) to thousands of addresses. When you later create a transaction spending from that address, your wallet may combine the dust UTXO with other UTXOs you own (standard coin selection behavior). The attacker monitors the blockchain and sees: dust sent to address A was spent in the same transaction as funds from addresses B and C. Conclusion: A, B, and C all belong to the same person. How it works on Ethereum/EVM: the attacker sends tiny ERC-20 token amounts or fractions of ETH to your address. On EVM chains, the address-linking risk is lower (account model, not UTXO) but the dust can serve other purposes: making malicious token approvals appear in your wallet to trick you into interacting with them (airdrop phishing), or simply tagging your address for future targeted scams. What to do about it: on Bitcoin, use coin control features (manually select which UTXOs to spend, never spending dust alongside your main funds). On Ethereum/EVM, ignore dust tokens entirely. Do not try to sell or interact with unfamiliar tokens that appeared in your wallet without you buying them. Some wallets auto-hide dust below a threshold.
How a dusting attack de-anonymizes a Bitcoin user
You use three Bitcoin addresses for privacy: Address A (savings, 0.5 BTC), Address B (exchange withdrawals, 0.3 BTC), Address C (DeFi activity, 0.1 BTC). An attacker sends 546 sats to all three. Later, you send 0.85 BTC to buy something. Your wallet automatically selects UTXOs from A + B + the dust from C to construct the transaction. The attacker sees this transaction on-chain: inputs from A, B, and C in one transaction. They now know all three addresses are the same person. If any of those addresses is linked to your identity (exchange withdrawal with KYC), they know your complete Bitcoin activity across all three. Defense: never spend dust UTXOs. Use wallets with coin control (Sparrow, Bitcoin Core) and manually exclude dust inputs.
What People Get Wrong
Dusting attacks steal your crypto
The dust itself cannot steal anything. It is a tiny deposit TO your address (you received money, not lost it). The danger is the privacy implications of spending it alongside your real funds, not any loss of assets from the dust deposit itself.
You should send the dust back
Never interact with dust (do not send it back, do not try to sell it, do not move it). On Bitcoin: simply do not select it when spending. On EVM: ignore unfamiliar token airdrops. Interacting with malicious ERC-20 dust can trigger approval phishing (some tokens have malicious transfer hooks).
Dusting only affects Bitcoin
The UTXO-linking variant is Bitcoin-specific (because of how UTXOs combine in transactions). But EVM dusting exists too: airdropping scam tokens to thousands of addresses hoping some will try to sell them (leading to drainer sites or honeypots). Both chains have their own dusting variants.
Keep Reading
Sources & Further Reading
- Sparrow Wallet (Coin Control)
Bitcoin wallet with manual UTXO selection to prevent spending dust
Questions People Also Ask
- Should I be worried if I receive dust?
- Not immediately. The dust deposit does not harm you or give the attacker access to your funds. The risk only materializes if you spend it alongside your other funds (on Bitcoin) or interact with malicious token dust (on EVM). Best response: ignore it. On Bitcoin: label it as dust in your wallet and exclude from coin selection.
- How do I know if a token airdrop is dust vs legitimate?
- Legitimate airdrops: you can verify the project exists, the token is listed on CoinGecko, and the airdrop was announced publicly. Dust/scam tokens: appeared without announcement, have no CoinGecko listing, and often have names designed to look like something else. When in doubt: do not interact. Check the contract on Token Sniffer before trying to sell any unexpected token.
- Can dusting attacks lead to physical theft?
- In theory: if an attacker uses dusting to link your on-chain activity to your real identity (via a KYC exchange address) and calculates your total holdings, they could target you for physical robbery or coercion. This is a real threat model for high-net-worth individuals. Defense: use multiple wallets, never consolidate all funds in transactions, and maintain operational security around your holdings.