What Is a Dust Attack in Crypto?

What is a dust attack in crypto? It is when an attacker sends tiny amounts of crypto, known as “dust,” to a large number of addresses and then tracks where that dust goes to work out which addresses belong to the same person or organization. Dust does not steal funds directly, but it exposes links between addresses and paves the way for later phishing, extortion or targeted attacks.

How Does a Dust Attack Work?

Dust attacks mainly occur on UTXO-based chains such as Bitcoin. The dust an attacker sends becomes a small UTXO on the receiving address. If the wallet later automatically uses it as an input together with UTXOs from other addresses, the attacker can infer that these addresses are controlled by the same wallet and continue tracing through change addresses. Once any of these addresses is linked to an exchange deposit or a public identity, the whole group of addresses and the size of its funds may be exposed. To limit such junk outputs, Bitcoin nodes by default do not relay outputs below a certain amount, but attackers simply set the amount just above that threshold.

What Is the Difference Between a Dust Attack and Address Poisoning?

Both send a small transfer to your address, but the difference between a dust attack and address poisoning lies in what they target: a dust attack targets privacy and only works once you spend the dust, while address poisoning tricks you into copying a lookalike address to steal funds directly.

How Should Businesses Respond to Dust Attacks?

The most effective response is to leave it alone. Business wallets should be able to identify tiny UTXOs of unknown origin and mark them as unspendable, so they are never mixed with other funds in transfers or consolidation. Running KYT screening on all incoming funds helps detect dust from risky addresses and prevents business addresses from being passively linked to risky funds. In addition, use separate addresses for different purposes, avoid reusing deposit addresses, and remind finance and operations staff that sudden small deposits are often a prelude to phishing, so they should ignore any contact or links that follow.

Conclusion

A dust attack sends tiny amounts to addresses and tracks how they are spent to work out who owns them. It threatens privacy and future security, unlike address poisoning, which tricks victims out of funds directly. Businesses should freeze unexplained dust UTXOs, screen incoming funds, and keep their addresses well separated. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Want more secure and private on-chain addresses for your business? Contact Safeheron’s Sales Team to Book a 1:1 Demo