Dusting Attack

A dusting attack is a privacy-focused attack on cryptocurrency users where an attacker sends tiny, near-worthless amounts of a cryptocurrency (called “dust”) to a large number of wallet addresses. The goal is not to steal money directly — the amounts sent are so small they barely register. Instead, the attacker hopes victims will unknowingly move that dust as part of a later transaction, which allows the attacker to analyze patterns on the blockchain and potentially trace wallets back to real identities.

Blockchains are transparent by design: every transaction is recorded publicly, and while addresses are pseudonymous (not directly linked to names), transaction patterns can reveal a lot. When dust from multiple addresses ends up in the same transaction, it suggests those addresses are controlled by the same person or entity. By mapping these connections across many dust transactions, attackers can build a picture of how much crypto someone holds, which exchanges they use, and potentially connect their blockchain activity to real-world information like a KYC (Know Your Customer) identity submitted to an exchange.

The best defense against dusting attacks is awareness. Most modern wallets mark dust amounts and allow you to avoid spending them. Some privacy-focused wallets and techniques like coin mixing try to prevent transaction graph analysis altogether. In general, simply noticing small, unexpected deposits you did not initiate is a signal to investigate before including those funds in any outgoing transaction.

Example: Imagine receiving a strange unmarked letter at your house. The sender does not want anything from the letter itself — they just wanted to confirm your address is real and learn your location. If you then write a response and send it, they know even more about your habits. Dusting attacks use small crypto deposits the same way: the deposit itself is harmless, but your response to it can reveal information.