Dust Attack vs Address Poisoning: What’s the Difference?

What’s the difference between a dust attack and address poisoning? Both show up as an unexplained small deposit, so they are often confused, but their goals and methods are completely different. A dust attack sends a tiny amount and waits for you to spend it in order to work out who owns which addresses, threatening privacy. Address poisoning uses a lookalike address to plant a fake transfer record and lure you into copying the wrong address next time, threatening the funds themselves.

How Do Their Targets Differ?

A dust attacker wants to know which addresses belong to whom and how much they hold. Once you spend the dust together with other funds, the attacker can link multiple addresses to the same entity and use that for targeted phishing or extortion, but the process itself does not move a single coin out of your wallet. An address poisoning attacker goes straight for the money: they generate an address whose first and last characters match one of your regular counterparties, then send a small or even zero-value token transfer to your address so that the lookalike appears in your transaction history. If you ever copy it from that history, the funds you send end up with the attacker.

Which Chains Are They Common On?

Dust attacks mainly occur on UTXO-based chains such as Bitcoin, because when a wallet combines UTXOs from several addresses as inputs, it reveals that they belong to the same wallet. Address poisoning is more common on account-based chains such as Ethereum and Tron, especially against addresses that frequently send and receive stablecoins like USDT, since these addresses move large amounts, have long transaction histories, and their operators are more tempted to copy addresses from past records for convenience.

How Should Businesses Tell Them Apart and Respond?

When an unexplained small deposit arrives, look at the sender first. If it shares the first and last characters of one of your regular addresses but differs in the middle, it is almost certainly address poisoning; if it is a tiny output of unknown origin on Bitcoin, it is more likely dust. For dust, the key is to mark it as unspendable and never use it together with other funds. For address poisoning, the key is to never copy addresses from transaction history and to send funds only to verified whitelisted addresses; see how businesses can prevent address poisoning for details. In both cases, run KYT screening on incoming funds and remind finance and operations staff to ignore such deposits.

Conclusion

Dust attacks and address poisoning both start with a small deposit, but the former waits for you to spend the dust to work out who owns which addresses and is more common on UTXO chains, while the latter waits for you to copy a lookalike address to steal funds and is more common on account-based chains. Businesses should freeze dust, use whitelists instead of copying addresses, and screen incoming funds. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Want to keep your business out of small-deposit traps? Contact Safeheron’s Sales Team to Book a 1:1 Demo