What is dusting attack?

Sending tiny amounts of crypto to many addresses so the sender can watch which of them later combine those amounts and reveal a shared owner.

It is a deanonymization technique rather than a theft. Leave the dust where it is instead of spending it, and never follow a link attached to an unexpected token. The people running these campaigns are usually analytics firms, researchers, or scammers building a target list, and the cost to them is trivial because the amounts are worth almost nothing.

The mistake is assuming that because nothing was taken, nothing happened. The payload is information. If your wallet later spends the dust alongside your real coins, you have told the sender that both addresses belong to you.

How it works

On a utxo chain, a transaction that spends several inputs is strong evidence that one party controlled all of them. This is the common-input-ownership heuristic that every chain analysis firm relies on.

1. The attacker sends a few hundred satoshis, or an equivalent trivial token amount, to thousands of addresses at once.
2. Your wallet sees a new balance and, on its next spend, may automatically select that dust as one of the inputs.
3. The transaction now links the dusted address to whatever other addresses were spent with it.
4. The attacker, watching the chain, adds those addresses to a single cluster.

On account-based chains the mechanism differs. There, dusting usually arrives as a worthless token whose name or transfer memo advertises a website. Interacting with it is the trap, because the site asks you to sign an approval that drains a real balance. That variant is closer to phishing than to clustering, and it is also how address poisoning campaigns seed lookalike entries into your transaction history.

Defending against it is mostly passive. Wallets with coin control let you mark an output as unspendable so automatic input selection never touches it. Watch-only labeling helps you spot which addresses were hit.

Example

Illustrative case. You hold funds across three addresses that no observer has connected. An attacker sends 800 satoshis to one of them. Weeks later you make a payment large enough that your wallet needs two inputs, and it picks the dusted output plus a real one. That single transaction merges the dusted address with the other, and any exchange withdrawal already tied to either address now attaches your verified identity to the whole cluster.

Why it matters when you buy

Coins withdrawn from an exchange are already linked to your verified identity through kyc, so anything later clustered with them inherits that link. If you care about keeping purchases from different venues separate, avoid consolidating outputs across them and never let unexpected dust join a spend. See the exchange pages for which venues you would be linking.

Related terms

dust — the tiny amounts involved, coin control — how to refuse to spend them, chain analysis — who builds the clusters, address poisoning — the lookalike-address variant, wallet drainer — what the token-based version leads to, utxo — why combining inputs reveals ownership.

Questions

Should I send the dust back to whoever sent it?

No. Returning it spends the output, which is exactly the link the sender wants, and the return address is usually not one they control anyway. Leaving it untouched costs you nothing.

Can a dusting attack drain my wallet?

Not by itself, because receiving funds cannot move funds. The danger is the follow-up: a linked website or a signature request that grants a contract permission over your real tokens.

How do I mark dust as unspendable?

Wallets that expose coin control let you freeze a specific output so it is never chosen automatically. The feature is named differently across wallets, so check the wallet's own documentation.