What Is a Dusting Attack? Privacy Risk Explained

A dusting attack is a technique where an attacker sends tiny, near-worthless amounts of cryptocurrency — "dust" — to a large number of wallet addresses, then analyzes how that dust moves when combined with other funds in subsequent transactions, attempting to link multiple addresses back to the same real-world owner. The goal is not to steal the dust itself, which is typically too small to be worth anything, but to deanonymize wallet holders for surveillance, targeted phishing, or extortion purposes.

Why "free" crypto sent to your wallet can be a privacy threat

Public blockchains record every transaction permanently and transparently — this transparency is a core feature of how they work, but it also means that any pattern in how funds move can be observed and analyzed by anyone, including attackers. Dusting exploits a specific behavior: many wallets, especially those using certain coin-selection algorithms or simple "sweep all" consolidation habits, will combine the dust with other unspent funds when constructing a future transaction. Once dust from a targeted address appears combined with other UTXOs (unspent transaction outputs) or funds in the same transaction, an attacker can reasonably infer that all the combined inputs belong to the same wallet owner, chipping away at the anonymity a fresh address would otherwise provide.

How the attack unfolds step by step

1. The attacker sends tiny amounts of cryptocurrency (fractions of a cent in value) to thousands or millions of addresses, often addresses that have shown some level of past activity or are otherwise of interest.
2. The attacker monitors the blockchain for any subsequent transaction where the dust is spent alongside other funds from the same wallet.
3. When this happens, the attacker links the dusted address to whatever other addresses were combined in that transaction, building a cluster of addresses likely controlled by the same person or entity.
4. With enough address clustering, combined with any off-chain data (an exchange KYC leak, a public donation address, a forum post), the attacker can potentially connect the entire cluster to a real-world identity.
5. That identity or address cluster can then be targeted with tailored phishing, extortion threats referencing known holdings, or sold to other parties interested in wallet-level intelligence.

Which chains are most affected

Dusting attacks are most associated with UTXO-based blockchains like Bitcoin, where the coin-selection mechanics make combining inputs from different sources a natural and common part of everyday transaction construction. Account-based chains (like Ethereum) work differently — balances aren't composed of discrete UTXOs in the same way — so the classic dusting mechanic doesn't transfer directly, though related address-clustering and transaction-graph analysis techniques still apply in different forms across most public blockchains.

Signs you may have received dust

Check your wallet's transaction history for unusually small, unsolicited incoming transactions you don't recognize — amounts too small to be a mistaken payment or meaningful transfer, arriving with no accompanying context. Many wallets and block explorers now flag suspected dust automatically, since the pattern has become well-documented enough for tooling to recognize it.

How to protect yourself

Practice	Why it helps
Never spend or "clean up" dust by combining it with other funds	Avoids linking the dusted address to your other addresses
Use a wallet that lets you exclude specific UTXOs from a transaction	Lets you avoid inadvertently combining dust with real funds
Use a new address for each transaction where practical	Limits the amount of address history any single dust deposit can link together
Consider privacy-focused wallet features or coin control tools	Gives you visibility and control over exactly which funds get combined
Avoid publicly associating any wallet address with your real identity	Reduces what a successful clustering attack can ultimately connect to

Why dust itself is rarely the real threat

The dust amount itself is deliberately worthless — the attacker isn't trying to profit from the tiny transfer. The actual risk is entirely downstream: deanonymization that enables targeted scams, extortion attempts referencing your actual holdings to appear credible, or sale of wallet-clustering data to other malicious parties. This is why the correct response to receiving dust isn't panic about the small amount itself, but caution about how you handle it going forward.

Broader privacy practices worth adopting

Dusting is one specific technique within the broader challenge of maintaining privacy on a fundamentally transparent, public ledger. Our companion guide on how to protect your privacy on a public blockchain covers address reuse avoidance, wallet separation strategies, and other techniques that reduce your exposure to dusting and related transaction-graph analysis techniques together.

Bottom line

A dusting attack sends worthless amounts of crypto to your wallet not to steal from you directly, but to trace how you move funds and ultimately link your addresses to a real-world identity. Avoid combining dust with your other funds, use coin control features if your wallet supports them, and treat unsolicited tiny deposits as a privacy signal to be cautious about rather than free money to spend or consolidate.