Dust Attack

How It Works

In a dust attack, the attacker distributes minuscule amounts of cryptocurrency — often fractions of a cent — to thousands or millions of wallet addresses. The term "dust" refers to amounts so small they are below the practical spending threshold. On Bitcoin, dust is typically under 546 satoshis; on Ethereum, it might be a fraction of a token worth less than a cent.

The attack exploits the transparent nature of blockchain transactions. When a recipient unknowingly includes the dust in a future transaction — for example, when their wallet combines multiple inputs to make a payment — the attacker can analyze the transaction graph to link previously unrelated addresses. This process, called address clustering, can reveal which addresses belong to the same person or entity.

Advanced dust attacks may use tokens instead of native cryptocurrency, sometimes airdropping worthless tokens with names designed to lure victims into visiting phishing websites ("visit [scam-site] to claim rewards"). These token-based dust attacks serve a dual purpose: surveillance and phishing.

Why It Matters

While dust attacks do not directly steal funds, they compromise financial privacy on public blockchains. By de-anonymizing wallet owners, attackers can build profiles for targeted phishing attacks, assess net worth for extortion, or sell the intelligence to data brokers. In extreme cases, linking a high-value wallet to a real identity could make the owner a target for physical threats.

Protection strategies include using wallets that flag and isolate dust UTXOs (Bitcoin), never interacting with unknown airdropped tokens (EVM chains), using privacy-focused transaction methods, and maintaining separate wallets for different purposes so that dust sent to one address cannot be linked to your other holdings.

Real-World Example

An attacker sends 0.00000546 BTC (about $0.003) to 50,000 Bitcoin addresses. Over the following weeks, many recipients' wallets automatically include this dust as an input when they make normal Bitcoin transactions. The attacker's blockchain analytics software tracks these transactions, linking multiple addresses to the same wallet. They identify a cluster of addresses holding 500 BTC and attempt to correlate the cluster with exchange deposit addresses to identify the owner's real-world identity.