A dusting attack is when someone sends a tiny, unsolicited amount of cryptocurrency to your wallet and then watches the blockchain to see what you do with it. The goal is to strip away the pseudonymity of your addresses: if your wallet later bundles that dust into an outgoing payment alongside your real funds, the sender can link those addresses together and, eventually, to you. The attack only succeeds if you spend the dust, so the defense is to leave it alone, and most self-custody wallets give you a way to lock it in place.
How a Dusting Attack Works
“Dust” is a balance so small it’s barely worth anything. On Bitcoin, that’s typically a few hundred satoshis, where a satoshi is one hundred-millionth of a bitcoin.1Ledger Support. Protecting Yourself From Dusting Attacks On other networks it might be a fraction of a token worth less than a penny. The amounts sit at the bottom of your balance, easy to miss.
An attacker picks target addresses from public block explorers, leaked exchange data, or by scanning the chain for wallets holding meaningful balances. Automated scripts then broadcast thousands of tiny transactions, each carrying a negligible amount to a different address. Every one of those transactions costs a network fee.2Fidelity Digital Assets. Bitcoin and Ethereum Fees Explained The attacker treats those fees as a cost of doing business; the information they hope to extract from thousands of targets is worth more than the total spend.
Once the dust lands, it does nothing on its own. The attack only advances when you send a payment. Wallet software assembling that payment automatically picks whichever unspent outputs it needs to cover the amount plus fees, and if the dust gets swept into that bundle alongside your legitimate funds, the attacker can see that all those inputs belong to the same person.
What the Attacker Actually Learns
Every Bitcoin transaction is public. Anyone can see which addresses sent funds, which received them, and how much moved. What the blockchain doesn’t reveal is who controls those addresses. A dusting attack tries to close that gap.
When your wallet combines the dust with other inputs, the on-chain link becomes visible. If the dusted address and your main-holdings address appear as inputs to the same transaction, they’re almost certainly controlled by the same person. Repeat that observation across several addresses and the attacker builds a cluster map of your wallet.
The chain of analysis often ends at a centralized exchange. Most major exchanges require identity verification through Know Your Customer procedures before you can trade or withdraw.3Chainalysis. Introduction to Cryptocurrency Exchange Compliance If your clustered addresses can be traced to a deposit at an exchange that holds your name and ID, the pseudonymity is gone. Real identity, real transaction history.
The consequences aren’t only digital. In a federal case prosecuted in 2024, a robbery crew identified cryptocurrency holders through online surveillance and then conducted violent home invasions across several states, in one incident forcing their way into a home, restraining the occupants at gunpoint, and transferring over $150,000 from the victim’s account.4Department of Justice. Man Convicted of Violent Home Invasion Robberies to Steal Cryptocurrency Even short of physical violence, de-anonymization opens the door to targeted phishing, extortion, and social engineering by someone who now knows your identity, your exchange, and your approximate balance.
Malicious Tokens on Smart-Contract Chains
On Ethereum, Solana, and BNB Smart Chain, dusting has grown into something worse than tracking. Attackers airdrop scam tokens or NFTs directly into your wallet. The assets look real and sometimes appear on popular marketplaces. The trap springs when you try to sell, transfer, or interact with them: doing so can trigger a malicious smart contract that drains your entire balance.5Trezor. Dusting Attacks and Airdrop Scam Tokens
Some scam tokens embed phishing URLs in the transaction memo field, hoping you’ll click through and enter credentials or approve a wallet connection. Others rely on token approval transactions: approving a contract to interact with a token can grant it unlimited access to your funds, and the approval prompt looks identical to legitimate ones from decentralized exchanges.
The rule is simple. Never interact with tokens or NFTs you didn’t expect. Don’t try to sell them, don’t send them to a burn address, don’t click links attached to them. Ignore them completely. To verify whether an airdrop is legitimate, check the project’s official channels independently rather than trusting anything embedded in the token itself.
How to Recognize Dust in Your Wallet
A dusting transaction shows up as a small incoming deposit from an address you don’t recognize. The amount is typically worth less than a few cents and bears no relation to anything you’ve done. Check the transaction details, copy the transaction hash, and look it up on a block explorer to see where it came from.
Legitimate airdrops usually come from projects you’ve previously interacted with, and the amounts tend to be large enough to actually use. Dust arrives unsolicited from an unknown source, and the fee the sender paid to deliver it often exceeds the value of what they sent. That disparity is the clearest indicator that the transfer exists to track you rather than reward you.
Some portfolio tools now flag dust automatically. CoinTracker can aggregate balances across multiple wallets and mark holdings below a threshold you set. Privacy-focused wallets like Wasabi and Samourai go further, analyzing deposit patterns and warning you when multiple small incoming transactions from unknown addresses arrive in a short window.
Freezing Dust With Coin Control
The most effective defense against a Bitcoin dusting attack is freezing the dust so your wallet never spends it. That requires coin control, a feature that lets you see and manage the individual unspent transaction outputs (UTXOs) in your wallet rather than just an aggregated balance.
Every bitcoin you hold is technically a collection of outputs from past transactions. When you send bitcoin, the wallet picks some combination of those outputs to cover the payment. Coin control lets you override that automatic selection and choose which specific outputs are included or excluded.
To freeze dust, you need to identify the specific UTXO tied to the suspicious deposit, using the transaction hash and output index shown in your wallet’s transaction list. In Sparrow Wallet, right-click the UTXO and select “Freeze UTXO,” which prevents it from being used as an input in any future transaction. In Electrum, right-click the address and select “Freeze.”6Trezor. Coin Control in Trezor Suite Trezor Suite and Ledger Live offer coin control interfaces where you can manually select which UTXOs to spend.7Ledger Support. Using Coin Control
Once frozen, the dust stays visible in your wallet but is excluded from your spendable balance. The fee calculator ignores it, and it will never be bundled into an outgoing transaction. The dust just sits there permanently, and the attacker never gets the on-chain link they were hoping for. Nothing moves on the blockchain, so you don’t pay any fees to accomplish this.
What to Do About Dust on a Centralized Exchange
If you hold cryptocurrency on a centralized exchange rather than a self-custody wallet, you generally don’t have access to coin control. Exchanges manage UTXOs internally, and you have no say in which inputs they use when processing withdrawals. The freezing strategy doesn’t apply.
What exchanges do offer is dust conversion. Binance lets you convert small balances into BNB. Bitget converts balances worth less than $10 into its native token, with optional automatic conversion on a daily, weekly, or monthly schedule. Coinbase handles dust differently by account type: institutional accounts get automated sweeping, while retail users receive notifications when balances fall below economically viable transfer amounts. Kraken lets you filter your asset list by balance size but requires you to trade each small holding individually at standard fees.
Converting exchange dust into a usable token is a reasonable cleanup step, but keep the risk in perspective. Exchange dust poses less of a de-anonymization threat than self-custody dust because the exchange already knows who you are. The privacy concern with dusting attacks is primarily about self-custody wallets where your identity isn’t supposed to be attached to your addresses.
Habits That Lower Your Exposure
Freezing dust handles the immediate threat. Better habits reduce how effective dusting is against you in the first place.
The single most impactful practice is avoiding address reuse. Every time you receive bitcoin to the same address, you make it easier for anyone to compile a history tied to that address. Most modern wallets generate a new receiving address for each incoming transaction automatically. Use that feature. If your wallet doesn’t do this by default, switch to one that does.
Think about how you move funds between your wallet and exchanges. Withdrawing to a fresh address each time and avoiding round-trip transactions between the same pair of addresses makes clustering analysis harder. If privacy is a high priority, wallets that support CoinJoin (a technique that mixes your inputs with other users’ inputs to obscure the trail) add another layer. Wasabi Wallet and JoinMarket are the best-known implementations.
Keeping large holdings in an offline hardware wallet and transferring only what you need to a hot wallet for active use also limits exposure. If an attacker dusts your hot wallet, the worst they can trace is a small portion of your total holdings rather than everything you own.
The Tax Question Nobody Asked For
The IRS treats all digital assets as property, and receiving crypto can create a tax obligation even if you didn’t ask for it.8Internal Revenue Service. Frequently Asked Questions on Digital Asset Transactions Under Revenue Ruling 2019-24, you have ordinary income when you receive cryptocurrency through an airdrop and you have “dominion and control” over the assets, meaning you can transfer, sell, or otherwise dispose of them.9Internal Revenue Service. Revenue Ruling 2019-24 The income amount equals fair market value at the time of receipt, and that value becomes your cost basis.
For dust worth a fraction of a cent, the practical tax impact is negligible. The IRS is clear, though, that income from digital asset transactions must be reported regardless of amount, with no minimum threshold.8Internal Revenue Service. Frequently Asked Questions on Digital Asset Transactions The Form 1040 digital asset question asks whether you received, sold, or otherwise disposed of digital assets during the tax year, and receiving unsolicited dust technically requires a “Yes.”10Internal Revenue Service. Determine How to Answer the Digital Asset Question Given the tiny amounts involved, the cost of tracking and reporting almost certainly exceeds any tax consequence, but a cryptocurrency-specialized CPA can tell you what makes sense for your situation.