You check your wallet and find a deposit you never expected — a few rupees’ worth of coins, or a mystery token, from an address you’ve never seen. Free money? Almost certainly the opposite: you’ve likely been “dusted.” The dusting attack is one of crypto’s stranger threats — an attack that gives you money — and understanding it reveals a lot about blockchain privacy, tracking, and the right reflexes when anything unexpected lands in your wallet.
- Dust = crypto too small to matter, weaponised as a tracking tag.
- The attack works only when YOU move the dust with your funds.
- Goal: link addresses to each other and, eventually, to your identity.
- Mystery tokens are the dust attack’s scam-bait cousin — never interact.
- UTXO controls, address hygiene and ignoring dust defeat the tactic.
- Receiving dust means you’re catalogued, not compromised.
How Dusting Works, Step by Step
- Broadcast the tags: the attacker sprays minuscule amounts — hundreds of satoshis, trivial tokens — across a huge list of addresses harvested from the public chain.
- Wait for consolidation: wallets naturally sweep small balances together when building future transactions. The moment your wallet spends the dust alongside coins from your other addresses, those addresses are cryptographically co-signed — provably one owner.
- Cluster and correlate: analysis links your address constellation; combine with any identity leak — an exchange withdrawal, a public donation address, a forum post — and the whole cluster gets a name.
- Monetise the map: targeted phishing (“we see your 2.3 BTC at address X…”), extortion, burglary target selection, or bulk sale of enriched profiles.
The elegance, from the attacker’s side: the blockchain’s own transparency does the surveillance — they just plant the tracer and read the public record via any explorer.
Who Dusts, and Why
| Actor | Motive |
|---|---|
| Criminal crews | Deanonymise rich wallets for phishing/extortion |
| Scam promoters | Dust as advertising; token names bearing URLs |
| Analytics/researchers | Cluster mapping (same technique, different label) |
| Spam/stress actors | Network noise, UTXO bloat |
The token variant deserves its own alarm: unexpected tokens in smart-contract wallets are often bait — “swap” or “claim” them and the malicious contract you touch drains real assets. That’s less dusting than trap-setting, straight from our scams playbook — but it arrives the same way: uninvited.
Your Defence Manual
- The prime directive — don’t touch: dust that never moves never links anything. No sweeping, no “cleaning up,” no sending it back.
- Use coin control if available: advanced wallets let you freeze/blacklist specific UTXOs — mark dust do-not-spend and it’s permanently inert.
- Never interact with mystery tokens: no swaps, approvals or website visits from token names. Hide them in the UI if your wallet allows.
- Practise address hygiene: fresh receiving addresses per counterparty (HD wallets do this by default) shrink what any single link exposes.
- Assume catalogued, act accordingly: dust receipt often precedes targeted phishing — elevate scepticism toward “personalised” crypto messages that follow.
Dusting and the Privacy Big Picture
Dusting exploits crypto’s foundational trade-off: pseudonymity, not anonymity. Addresses hide names but expose relationships — and modern chain analysis is industrial-strength at reading them. Dust is just an attacker injecting a known data point into your graph. The broader lessons — minimise address reuse, compartmentalise wallets by purpose, treat on-chain activity as public record — belong to the same privacy discipline covered across our address guide.
A Common Misconception
“I’ve been dusted — my wallet is hacked / my funds are at risk!” Receiving dust threatens nothing by itself: no deposit, however sinister, can spend your coins, reveal your seed phrase, or touch your balance. The attack is entirely informational, and entirely dependent on your future actions — spend the dust and you feed the tracker; interact with bait tokens and you spring the trap; do neither and the attacker holds a worthless tag. Panic-moving all your funds in response is the one reaction that maximally helps the attacker, consolidating everything in one beautifully linked sweep. Stillness is the counter.
Frequently Asked Questions
How do I know a deposit is a dusting attempt vs a mistake?
You usually can’t — and operationally it doesn’t matter. Unexpected small deposits get identical treatment: ignore, freeze if possible, never interact.
Can I just donate or burn the dust?
Sending it anywhere is spending it — creating the linkage signature. If your wallet can’t freeze UTXOs, the safest “disposal” is eternal neglect.
Does dusting affect exchange accounts?
Custodial deposits enter pooled reserves — dusting logic barely applies; exchanges filter dust routinely. It’s a self-custody-relevant threat.
Are privacy coins immune?
Confidential-by-design chains blunt the linkage mechanics substantially — one of their core purposes, with their own trade-offs covered in our privacy coins piece.
Is dusting illegal?
The send itself is just a transaction; the downstream extortion/phishing is criminal. Jurisdictions mostly regulate the follow-on crimes, not the tracer.
Does dust have tax implications in India?
Technically received tokens are income at fair value — for genuine dust, negligible amounts; keep records proportionate to materiality and see our tax guide for principles.
Putting It Into Practice
- Audit for existing dust: scan your addresses on an explorer for tiny deposits you never expected — identify before you accidentally consolidate.
- Enable coin control if your wallet offers it: learn the freeze/do-not-spend feature and mark any dust today.
- Set the household rule: unexpected deposits and mystery tokens get zero interaction — screenshot, ignore, never “clean up.”
- Practise address hygiene: confirm your wallet generates fresh receiving addresses per transaction, and share accordingly.
- Elevate post-dust vigilance: if dusted, expect tailored phishing to follow — the checklist reflexes matter double for a while.
How much is typical “dust”?
Amounts near the network’s minimum — hundreds of satoshis, trivial token quantities — small enough to seem meaningless, which is the camouflage. Value isn’t the payload; linkability is.
Can exchanges be dusted?
Deposits to exchange addresses enter pooled custody where per-user linkage dissolves — dusting is a self-custody-relevant tactic. Your personal wallets, not your exchange account, are the target surface.
Is receiving dust reportable anywhere?
No obligation exists for the receipt itself; if follow-on extortion or phishing arrives, India’s cybercrime portal handles the actual offence. Keep the dust transaction hash with any report.
Why would analytics firms dust wallets?
Cluster-mapping research uses the same linkage techniques commercially — compliance tooling, exchange risk-scoring. Identical mechanics, institutional wrapper: one more reason address hygiene serves everyone, whoever’s watching.
Should I report dust to my exchange?
For self-custody dust there’s nothing to report — exchanges aren’t involved. If dust-linked phishing later targets your exchange account specifically, report that contact through the platform’s official abuse channel with the original dust transaction noted.
Final Thoughts
The dusting attack flips crypto’s usual threat model: nothing is stolen, something is given — a marked coin whose only power is the movement you grant it. It’s surveillance disguised as spare change, defeated not by sophistication but by restraint. Let unexpected deposits lie where they land, treat mystery tokens as landmines, rotate addresses, and remember the broader rule dust merely illustrates: on a public ledger, your transactions are your testimony. Say only what you mean to.
Disclaimer: This article is for educational purposes only and is not financial advice. Always do your own research.
