What Is a Dusting Attack and Why Does It Target Your Wallet?

23 October 2026

A dusting attack is a privacy-invasive technique in which an attacker sends tiny amounts of cryptocurrency - often called "dust" - to thousands or millions of wallet addresses, with the goal of de-anonymizing the owners of those wallets. The attacker does not want your funds; they want to track your identity, your other wallets, or your transaction history by linking the dust you receive to a pattern they can follow.

How dusting attacks work

Dust is the smallest unit of a cryptocurrency that a blockchain can record. On Bitcoin, that is one satoshi (0.00000001 BTC). On other networks, the amount may be similarly negligible - often worth less than a cent.

An attacker uses automated software to send these tiny amounts to a large batch of addresses. Because the amounts are so small, many wallet owners never notice them. Even if they do, the cost of moving the dust (in transaction fees) may exceed the dust's value, so the recipient leaves it untouched.

The attacker then monitors the blockchain for any transaction that spends that dust. If the dust moves, it reveals a link between the wallet that received it and whatever address the dust gets sent to. Over time, the attacker can build a cluster of addresses that belong to the same person or entity.

Why attackers target wallets with dust

The goal is not theft. The attacker wants to:

• De-anonymize you. If you have one public wallet for trading and another for holding long-term, a dusting attack can help the attacker connect those two addresses to the same person.
• Identify high-value targets. Dust sent to many wallets may later reveal which addresses hold large balances or receive frequent transfers from exchanges.
• Gather intelligence for scams or phishing. Once an attacker links your wallet to your identity or to other wallets you control, they may target you with personalized phishing messages, fake technical support, or social engineering.
• Sell your data. A compiled profile of your wallet history and linked addresses can be sold to blockchain analytics firms, advertisers, or other attackers.

How to Tell if You Have Been Dusted

You might have been dusted if:

• You see a transaction in your wallet for a very small, unfamiliar amount (e.g., 0.00000001 BTC or a fraction of a cent worth of an altcoin).
• The transaction has no memo or recognizable sender.
• The dust arrives from an address with no prior connection to your wallet.
• You see multiple similar tiny transactions from different senders within a short period.

Most wallets will display these transactions in your history. Some wallets and blockchain explorers allow you to flag or hide dust transactions automatically.

How to protect yourself

There is no way to prevent someone from sending dust to your public address. Your address is public by design. But you can reduce the risk:

1. Do not spend the dust. If you leave the dust untouched in the wallet where it arrived, the attacker gains no new link. Moving the dust is what gives the attacker information.

2. Mark or ignore the dust in your wallet. Many wallets let you hide small-value transactions or mark them as spam. This keeps your transaction list clean without moving the funds.

3. Use a new wallet address for each transaction. If you generate a fresh address every time you receive funds, a dusting attack on one address will not reveal your other addresses. This is standard practice with most non-custodial wallets.

4. Consolidate dust carefully. If you must move dust (for example, to sweep a wallet you are abandoning), batch it together with other larger transactions or use a privacy tool like CoinJoin. But the simplest approach is to leave it.

5. Avoid reusing addresses across exchanges and DeFi platforms. If you use the same address on multiple services, a dusting attack on that address can link your activity across those services.

Does a dusting attack threaten your funds?

No. The dust itself is not malicious code. It is just a normal transaction that contains a tiny amount of value. Your private keys remain secure, and the attacker cannot spend your other funds. The threat is to your privacy, not to your balance.

What to do if you receive dust

• Do nothing with the dust itself.
• Do not click any links or visit any websites mentioned in the transaction memo (if one exists). Attackers sometimes include phishing URLs or contact information in the memo field.
• If you use a crypto-news-literacy/hardware-wallet-seed-phrase-phishing/">hardware wallet, treat the dust like any other unknown transaction: do not approve any action involving it unless you fully understand the destination and purpose.
• Consider generating a new address for future transactions, especially if you suspect your existing address has been used for a long time across multiple services.

Dusting attacks vs. airdrops

Some legitimate airdrops send small amounts of tokens to many addresses. The difference is intent and context. A genuine airdrop typically comes from a known project, is announced publicly, and often includes a clear purpose (marketing, rewarding early users, distributing governance tokens). A dusting attack is covert, has no public explanation, and is aimed at surveillance.

If you receive an unsolicited token from an unknown project, treat it as suspicious. Never connect your wallet to an unfamiliar site to "claim" such tokens - that is a common phishing tactic, not a dusting attack.

Back to crypto news