Dusting Attack

What Is a Dusting Attack?

A dusting attack is a cryptocurrency privacy attack in which someone sends tiny amounts of crypto to one or more wallet addresses and then watches how those funds are later spent.

The attacker hopes the wallet will combine the tiny deposit with other funds in a future transaction.

Combining several transaction inputs can provide clues that the addresses involved may be controlled by the same person or organization.

The attacker can use these clues to build an address cluster, observe payment behavior, estimate holdings, or connect blockchain activity with information obtained outside the blockchain.

Dusting attacks are most strongly associated with cryptocurrencies that use the unspent transaction output, or UTXO, accounting model.

Bitcoin is the best-known example of a UTXO-based network.

A dusting attack does not normally steal private keys, take control of a wallet, or move existing funds merely because the tiny payment was received.

Its traditional purpose is blockchain surveillance and loss of privacy.

However, the term is also used more broadly for unsolicited token and NFT deposits that direct users toward phishing websites or malicious smart contracts.

Users should therefore distinguish a UTXO privacy attack from a token-based scam that attempts to obtain a dangerous signature.

What Does Dust Mean in Cryptocurrency?

Dust is a very small amount of cryptocurrency that may be uneconomical or inconvenient to spend.

In a UTXO system, every received output remains a separate unit until a later transaction spends it.

The official Bitcoin transaction documentation explains that wallet balances are formed from one or more unspent transaction outputs.

A small output still takes up transaction space when it is used as an input.

If the fee required to spend the output approaches or exceeds its value, the output is economically similar to dust.

Dust does not have one permanent numerical definition that applies to every cryptocurrency, script type, wallet, and fee environment.

The cost of spending an output depends partly on the size of the input needed to unlock it and the fee rate selected for the later transaction.

Bitcoin Core also uses a policy-based dust threshold when determining which newly created transaction outputs are standard for ordinary relay.

The current Bitcoin Core transaction policy source defines a dust relay fee used by its standardness calculations.

This policy is not the same as a universal consensus rule stating that every output below one fixed amount is invalid.

An attacker may send an amount that is above the relevant relay threshold but is still tiny enough to be described as dust in normal conversation.

How a Dusting Attack Works

A traditional dusting attack begins when the attacker selects public cryptocurrency addresses to monitor.

The addresses may come from public payment requests, donation pages, transaction history, leaked customer records, reused addresses, or previous blockchain analysis.

The attacker sends a small UTXO to each selected address.

The victim’s wallet records the output as part of its available or total balance.

At a later time, the wallet may select the dust output together with larger outputs when constructing a payment.

The resulting transaction publicly reveals that the selected inputs participated in the same spending operation.

The attacker can then add the newly observed inputs, change outputs, and recipient patterns to an address cluster.

Repeated observations may gradually expose more of the wallet’s activity.

The attacker may combine the blockchain cluster with identity records, public posts, payment invoices, delivery information, or activity at a regulated financial service.

The result can be a more detailed profile of the target’s cryptocurrency holdings and transaction relationships.

The UTXO Model

Understanding a dusting attack requires understanding the UTXO model.

A UTXO is a transaction output that has not yet been spent.

When a wallet receives several payments, it may hold several separate UTXOs rather than one continuously updated account balance.

Suppose a wallet receives outputs worth 0.01 BTC, 0.005 BTC, and a tiny dust amount.

The wallet interface may display one combined balance even though the blockchain tracks three independent outputs.

To send an amount larger than any single suitable output, the wallet can select several UTXOs as transaction inputs.

Every selected input becomes publicly visible in the completed transaction.

If the inputs exceed the payment and fee, the wallet normally creates a change output for the remaining value.

Blockchain analysts study these input and output relationships to estimate which addresses may belong to the same wallet.

The Common-Input Ownership Heuristic

A common-input ownership heuristic assumes that multiple inputs in an ordinary transaction are likely to be controlled by the same entity.

The assumption often works because every input normally needs a valid signature from the key controlling that input.

A wallet owner creating an ordinary payment commonly supplies all required signatures.

If a dust output is combined with another UTXO, the attacker may infer that both outputs belonged to the same wallet.

The attacker can repeat this process as the clustered funds participate in later transactions.

This method is a heuristic rather than mathematical proof.

Collaborative transactions can contain inputs supplied by several independent participants.

For example, the BIP-78 Payjoin specification describes a payment in which both the sender and receiver can contribute inputs.

Privacy tools and unusual wallet behavior can therefore cause simplistic ownership assumptions to be incorrect.

Professional analysis should express clustering conclusions as probabilities or evidence-based estimates rather than guaranteed identity claims.

Why Address Reuse Increases Dusting Risk

Address reuse means receiving more than one payment through the same cryptocurrency address.

A reused public address gives an attacker a stable target that can be monitored over time.

The attacker can send dust to that address after it has already been associated with a person, company, or earlier transaction.

If the wallet later spends the dust with funds from newer addresses, the spending transaction may connect those addresses.

The official Bitcoin payment-processing guide recommends creating a separate address for each incoming payment.

Hierarchical deterministic wallets make fresh-address generation practical because many addresses can be derived from one master seed.

The BIP-32 hierarchical deterministic wallet standard defines a tree structure for deriving many related keys.

Using a new receiving address does not make blockchain activity completely anonymous.

It does remove one simple and highly reliable connection created by repeated use of the same visible identifier.

What Information Can a Dusting Attacker Learn?

A successful dusting attack may help identify which addresses are probably controlled by one wallet.

It may reveal when the wallet becomes active and how frequently its owner makes payments.

It may help estimate the target’s broader balance when several clusters are connected.

It can reveal payments to merchants, personal contacts, custodial services, donation addresses, or other recognizable entities.

Transaction timing can provide clues about location, working hours, travel, or business activity.

Repeated payment amounts may reveal subscriptions, salaries, internal transfers, or operational patterns.

An attacker who already knows one address belongs to a company may use dust to search for treasury, payroll, supplier, or customer wallets.

The attacker can also use the resulting information for targeted phishing, extortion, impersonation, or physical-security threats.

The quality of these conclusions depends on the wallet’s coin-selection behavior and the accuracy of the attacker’s assumptions.

What a Dusting Attack Cannot Do by Itself

Receiving ordinary Bitcoin dust does not reveal the recipient’s private key.

It does not give the sender permission to sign transactions from the recipient’s wallet.

It does not install software on the recipient’s device.

It does not automatically transfer the recipient’s other assets.

It does not prove the wallet owner’s legal identity without additional evidence.

It does not guarantee that the dust will ever be spent.

It also does not guarantee that every input later combined with the dust belongs to one person.

The traditional attack succeeds by encouraging observable spending behavior rather than by breaking cryptography.

Is a Dusting Attack a Theft Attack?

A traditional UTXO dusting attack is primarily a privacy attack rather than a direct theft attack.

The victim may even retain the tiny amount sent by the attacker.

The financial value of the dust is normally less important than its role as a traceable marker.

The privacy loss can still lead to serious secondary threats.

An identified high-value wallet owner may receive tailored phishing messages or fraudulent support requests.

A business may expose supplier relationships or treasury practices.

A public individual may face extortion or physical-security risk after holdings are estimated.

Users should therefore take the attack seriously without assuming that the mere deposit means their keys have already been compromised.

Targeted Dusting Attacks

A targeted dusting attack focuses on addresses believed to belong to a particular person or organization.

The attacker may already have off-chain information connecting one address with the target.

The purpose is to expand that known point into a larger cluster.

Public donation addresses, published payment addresses, reused invoice addresses, and leaked withdrawal records can provide starting points.

A targeted attacker may use different dust amounts or transaction timings to distinguish several monitored targets.

The attacker can then watch for those specific outputs to be spent.

Targeted campaigns can be more dangerous than random dust because the attacker begins with an identity hypothesis.

Mass Dusting Campaigns

A mass dusting campaign distributes tiny amounts to a large number of addresses.

The sender may be testing wallet behavior, advertising a service, collecting address activity data, or attempting broad blockchain clustering.

Some mass transfers are promotional distributions rather than carefully targeted surveillance.

The recipient cannot determine intent from the small amount alone.

Transaction structure, sender history, repeated patterns, token metadata, and linked websites may provide additional clues.

The safest response is based on the technical risk of spending or interacting with the asset rather than guessing the sender’s motive.

Dusting Attacks on Account-Based Networks

Account-based blockchains do not manage ordinary balances as independent UTXOs.

A small native-asset transfer changes the recipient account’s balance without creating a separate input that must later be combined with other coins.

The classic UTXO clustering method therefore does not operate in exactly the same way.

However, every transaction from the account already uses the same public account address unless the user creates separate accounts.

An unsolicited payment can confirm that the account remains active or attract the user’s attention.

Attackers can also distribute spam tokens and NFTs whose names or metadata direct recipients to fraudulent websites.

This behavior is often called dusting even though its technical mechanism differs from Bitcoin-style dust analysis.

Unsolicited Tokens and NFTs

Anyone may be able to transfer a token or NFT to a public blockchain address without the recipient’s permission.

The asset may appear automatically in a wallet or blockchain explorer.

Its name may advertise a reward, refund, voucher, claim page, or urgent account action.

The recipient may be instructed to visit a website and connect a wallet.

The website may request a token approval, a deceptive transfer, a malicious message signature, or the wallet’s recovery phrase.

Ethereum’s security and scam-prevention guidance describes airdrop scams in which unsolicited assets direct users toward fraudulent claiming activity.

Receiving the unwanted asset normally does not mean the sender already controls the wallet.

Interacting with the linked application or signing its request may create the actual loss.

Malicious Token Approvals

A token approval gives a smart contract permission to transfer a defined type and amount of token from an account.

Approvals are necessary for many legitimate decentralized applications.

A malicious website can disguise an approval as a reward claim, account verification, token conversion, or security update.

An unlimited approval can permit the contract to transfer the entire approved token balance later.

Users should inspect the requesting contract, asset, amount, network, and permission before signing.

The Ethereum security guide recommends setting smart contract spending limits rather than granting unnecessary unlimited access.

A dust-like spam token is dangerous mainly when it convinces the recipient to authorize another operation.

Dusting Attack vs. Address Poisoning

Address poisoning is a different attack that is frequently confused with dusting.

In an address-poisoning attack, the attacker creates an address that visually resembles an address the victim previously used.

The attacker then sends a tiny transaction so that the lookalike address appears in the victim’s transaction history.

The attacker hopes the victim will later copy the fraudulent address from that history instead of using a trusted source.

Cryptocurrency addresses can be long, and users who compare only the first and last few characters may overlook differences in the middle.

A dusting attack aims mainly to collect information through later spending behavior.

Address poisoning aims to redirect a future payment.

Both can involve tiny transfers, but their objectives and defenses are different.

Dusting Attack vs. Phishing

Phishing attempts to trick a user into revealing credentials, visiting a fake website, installing malware, or authorizing a harmful transaction.

A dust transfer may be used as the first step of a phishing campaign.

For example, a token name or NFT description may contain a website promising that the recipient can claim a reward.

The blockchain deposit makes the message appear more credible because it is visible inside the wallet.

The user should never treat an unsolicited asset as proof that a website or promotion is legitimate.

No legitimate recovery process requires disclosure of a wallet seed phrase or private key.

How to Detect a Dusting Attack

A user may notice a very small unexpected deposit in the wallet’s transaction history.

The amount may be too small to have an obvious economic purpose.

The same sending transaction may distribute similar amounts to many unrelated addresses.

A blockchain explorer may show that the sender has repeatedly made mass low-value transfers.

The asset may have no recognized connection with the recipient’s normal activity.

On a token network, the token name or NFT metadata may contain promotional text or a suspicious website.

Wallet software may label the output, token, or collectible as suspicious.

None of these signs proves that the sender is conducting a formal surveillance operation.

They do justify cautious handling.

What to Do After Receiving Bitcoin Dust

The user should first avoid panic because receiving an ordinary UTXO does not expose the private key.

The transaction should be inspected through a reliable blockchain explorer or wallet interface.

The user should identify the output amount, receiving address, sending transaction, and whether the payment was expected.

A wallet with coin-control features can mark, freeze, lock, or exclude the suspicious UTXO from automatic spending.

The output should not be consolidated casually with valuable UTXOs because consolidation may create the exact address linkage the attacker wants.

The user should also avoid sending the dust back to the apparent sender without understanding the privacy effect.

Wallet-specific documentation should be followed because coin-control behavior differs between applications.

High-value or organizational wallets may benefit from advice from a qualified blockchain privacy and security specialist.

Coin Control

Coin control allows a user to select which UTXOs are included in a transaction.

Without coin control, wallet software chooses inputs automatically according to its coin-selection algorithm.

A privacy-aware user can exclude an unsolicited output from a payment.

Coin control can also prevent unrelated sources of funds from being combined.

Incorrect use can create excessive fees, unnecessary change, or new privacy problems.

Users should understand the wallet’s labels, freezing behavior, change-address handling, and fee calculation before constructing a manual transaction.

Simply selecting the largest output does not guarantee strong privacy.

Bitcoin Core’s Avoid-Reuse Controls

Bitcoin Core includes wallet controls intended to reduce spending from addresses that have already been used.

The setwalletflag documentation describes the

wallet flag.

When this feature is enabled, the wallet tracks outputs associated with addresses previously used in spending.

The current Bitcoin Core wallet information interface reports whether reuse avoidance is active.

This feature can help prevent certain privacy leaks caused by spending later payments sent to an already exposed address.

It is not a universal defense against every clustering technique or every alternative encoding of related public-key information.

Users should treat it as one privacy control within a broader wallet strategy.

Why Automatically Consolidating Dust Is Risky

UTXO consolidation combines several outputs into a smaller number of larger outputs.

Consolidation can reduce future transaction size and may be economical when fees are low.

It also places all selected inputs in one publicly visible transaction.

If a suspicious dust output is included, the transaction can connect it with the wallet’s other funds.

Combining UTXOs associated with separate customers, identities, businesses, or savings categories can reveal relationships even without an attacker’s dust.

Wallet owners should plan consolidations according to both fee and privacy considerations.

Low network fees do not automatically make every possible consolidation desirable.

Can Dust Be Safely Spent?

A dust output can be technically spendable when its script, key, transaction fee, and wallet policy allow it.

The privacy question is whether spending it reveals information about other funds.

Spending the output alone avoids combining it with other wallet inputs, but the output may be worth less than the required fee.

Adding external funds to pay the fee may create new links.

Collaborative disposal proposals and specialized wallet techniques can involve additional assumptions and complexity.

For most users, freezing or ignoring suspicious dust is simpler than attempting an improvised disposal transaction.

No universal response is optimal for every wallet and fee environment.

What to Do With an Unsolicited Token or NFT

An unsolicited token or NFT should normally be left alone or hidden through the wallet’s display controls.

The user should not visit a website printed in the asset’s name, symbol, image, or metadata.

The user should not approve a contract merely to sell, claim, burn, migrate, or remove the asset.

The recovery phrase should never be entered into a website.

Hiding an asset changes the wallet display but does not transfer or destroy the blockchain record.

If the user already signed a suspicious approval, the approval should be reviewed and revoked through a trusted method.

Remaining valuable assets may need to be moved to a newly secured wallet when the private key or recovery phrase was exposed.

A new wallet does not solve the problem when the same compromised seed phrase is reused.

Does Hiding Dust Remove It?

Hiding a transaction, token, or NFT changes what the wallet interface displays.

It does not erase the blockchain transaction.

A UTXO remains spendable until it is consumed by another transaction.

A token balance remains recorded according to its contract.

An NFT remains assigned to the address until it is transferred, burned under supported rules, or changed by its contract.

Hiding suspicious content is still useful because it reduces the chance of accidental interaction.

Privacy defenses must operate through address management, coin selection, account separation, and transaction construction rather than display settings alone.

How Fresh Addresses Reduce Risk

A fresh receiving address makes it harder to connect separate payments through direct address reuse.

Modern hierarchical deterministic wallets can derive many receiving addresses from one protected seed.

The user does not need a separate recovery phrase for every address when the wallet follows a compatible derivation standard.

Fresh addresses do not prevent an attacker from analyzing later transactions that combine their outputs.

They work best when paired with privacy-aware coin selection and accurate labels.

Businesses should generate a unique address for each invoice so customer payments are not mixed under one public identifier.

Publicly posting one permanent address creates an easy monitoring target even when doing so is operationally convenient.

Wallet Labeling and Account Separation

Wallet labels help record why an output was received and which identity or activity it relates to.

Accurate labels can prevent a user from combining business funds, personal funds, donations, and private savings accidentally.

Separate wallet accounts can provide stronger operational boundaries when they use distinct key branches and clear procedures.

Complete separation may require separate wallets, devices, network connections, or custody arrangements depending on the threat model.

Labels are usually local wallet data and may be lost if they are not included in the backup process.

A seed phrase may restore keys and funds without restoring every label or coin-control decision.

Users should confirm what their backup method preserves.

Custodial Accounts and Dusting Attacks

A person using a custodial account may not control individual deposit UTXOs or the platform’s coin-selection process.

The custodian may combine customer deposits within large operational wallets.

An external observer may identify the custodian’s wallet cluster without identifying which customer owns a particular internal balance.

The custodian itself may possess identity and account records that connect deposits and withdrawals with customers.

Users should not assume that custodial use provides complete blockchain privacy.

They should also avoid depositing an unsolicited token when a platform has not confirmed support for the exact asset and network.

Dusting Risks for Businesses

Businesses often publish addresses, process many customer payments, and consolidate funds regularly.

These practices can make them attractive targets for dusting and transaction clustering.

A business should generate unique invoice addresses and maintain accurate payment records.

Treasury, payroll, customer receipts, operating funds, and long-term reserves may require separate wallet structures.

Automated payment software should identify unexpected low-value outputs and apply a documented handling policy.

Employees should not improvise by returning dust or moving it through a personal wallet.

Security teams should consider how blockchain intelligence could reveal suppliers, customers, revenue patterns, and treasury holdings.

Dusting Risks for High-Value Wallets

A high-value wallet can attract surveillance even when its owner has not publicly disclosed an identity.

Transaction timing, counterparties, address reuse, and consolidation patterns can gradually reveal ownership clues.

A dusting attack adds another controlled signal to that analysis.

Large holders should separate public spending funds from long-term reserves.

They should minimize unnecessary public address disclosure and use wallet software that supports strong coin control.

Operational staff should understand that one careless consolidation can weaken years of address separation.

Physical security should also be considered when blockchain holdings can be connected with a real-world individual.

Dusting and Transaction Fees

Dust outputs can increase future transaction costs because every selected UTXO adds input data.

A wallet containing many tiny outputs may require a large transaction to consolidate or spend them.

During periods of high fee demand, some outputs may be temporarily uneconomical to use.

A wallet’s displayed total balance can therefore be greater than the amount that can be moved economically at a particular fee rate.

Attackers must also pay transaction fees and fund the distributed outputs, which limits the economics of mass campaigns.

Changes in relay fee policy and network fee conditions can change which tiny amounts are practical for attackers or wallets to spend.

Dust and the UTXO Set

Every unspent Bitcoin output must be recognized by validating nodes until it is spent.

A large number of tiny unspent outputs can increase the size of the UTXO set.

The UTXO set is important because nodes consult it when checking whether transaction inputs spend valid existing outputs.

Dust relay policies partly discourage the creation of outputs whose economic value is small compared with their future spending cost.

These policies balance open transaction creation against resource use and denial-of-service concerns.

They do not prevent every tiny output from appearing on-chain.

Limits of Dusting Analysis

Dusting analysis can produce false conclusions when wallet behavior differs from the attacker’s assumptions.

A collaborative transaction may contain inputs from several owners.

A custodian may combine funds belonging to many customers.

A user may transfer control of a wallet or address.

A shared organizational wallet may be operated by several people.

Change-detection methods can misidentify the recipient or change output.

Cross-chain bridges and wrapped assets can introduce additional entities and accounting layers.

Blockchain evidence should therefore be interpreted with uncertainty and supporting context.

How Wallet Developers Can Reduce Dusting Risk

Wallet developers can provide clear coin-control tools and warnings for unexpected low-value outputs.

Coin-selection algorithms can avoid combining suspicious or reused-address outputs automatically.

Wallets can generate a fresh address for each payment request.

They can preserve labels, reuse status, and frozen-output information in secure backups.

Interfaces can explain why a visible balance may contain outputs that are intentionally excluded from spending.

Token wallets can mark suspicious assets and hide untrusted metadata or external links.

Signing screens should describe approvals, asset amounts, contract addresses, and network information in human-readable form.

Privacy features should be tested against realistic transaction histories rather than only ordinary payments.

How Users Can Prevent Dusting Attacks

Users cannot prevent strangers from sending funds to a public address.

They can prevent the unsolicited output from creating useful links through careless spending.

A new receiving address should be used for each payment whenever the wallet supports that practice.

Coin-control and output-freezing features should be used for suspicious UTXOs.

Different identities and purposes should be separated into clearly managed wallet accounts.

Public addresses should not be connected with personal information unnecessarily.

Unexpected tokens and NFTs should be ignored rather than claimed through unverified websites.

Every transaction and approval should be reviewed on a trusted wallet display before signing.

Private keys and recovery phrases should never be shared.

Common Dusting Attack Mistakes

One common mistake is assuming that receiving dust means the private key has already been stolen.

Another mistake is spending the suspicious output with the wallet’s larger funds immediately.

A third mistake is returning the dust to the sender without considering the resulting transaction links.

A fourth mistake is consolidating every small UTXO automatically when network fees fall.

A fifth mistake is reusing one public address for many unrelated payments.

A sixth mistake is clicking a website displayed inside an unsolicited token or NFT.

A seventh mistake is granting a smart contract permission to remove an unwanted asset.

An eighth mistake is copying a destination address from transaction history without verifying the complete address.

A ninth mistake is treating blockchain clustering as certain proof that every input has one owner.

A tenth mistake is ignoring the attack because the amount received has almost no financial value.

FAQ

What is a dusting attack in crypto?

A dusting attack sends tiny amounts of cryptocurrency to addresses so the sender can monitor later transactions and attempt to connect those addresses.

What is crypto dust?

Crypto dust is a very small balance or transaction output that may be inconvenient or uneconomical to spend.

Are dust and a dusting attack the same thing?

No, dust is a small amount, while a dusting attack intentionally distributes small amounts for surveillance, phishing, manipulation, or another malicious purpose.

Can a dusting attack steal cryptocurrency?

Receiving ordinary UTXO dust does not steal funds, but related phishing or malicious approval activity can cause theft when the user signs a harmful request.

Can dust reveal a private key?

No, an ordinary dust transfer does not reveal the recipient’s private key.

Can the sender control my wallet after sending dust?

No, sending cryptocurrency to an address does not give the sender signing authority over that address.

Why do attackers send small crypto payments?

They may be tracing wallet activity, testing active addresses, advertising, poisoning transaction history, or directing users toward scams.

How does Bitcoin dusting track users?

The attacker watches whether the dust UTXO is later combined with other inputs that may belong to the same wallet.

What is the common-input ownership heuristic?

It is the assumption that inputs used together in an ordinary transaction are likely controlled by one entity.

Is the common-input heuristic always correct?

No, collaborative transactions, custodial wallets, shared wallets, and unusual transaction structures can produce inputs from different owners.

Does a dusting attack work on Ethereum?

The classic UTXO attack does not work in the same form, but unsolicited transfers can identify active accounts or lure users into phishing and malicious approvals.

What should I do with an unsolicited token?

The safest normal response is to ignore or hide it and avoid websites, approvals, or claim instructions associated with it.

Should I burn an unknown token?

Not automatically, because a burn or removal process may require interaction with a malicious contract or website.

Should I send Bitcoin dust back?

Not automatically, because returning it can reveal additional transaction relationships and cost more in fees than the dust is worth.

Should I spend a suspicious dust UTXO?

It should generally be excluded or frozen unless the user understands the wallet’s coin control and the privacy effects of the planned transaction.

What is coin control?

Coin control is a wallet feature that allows the user to choose which UTXOs are included or excluded from a transaction.

Can a hardware wallet stop dusting attacks?

A hardware wallet protects private keys but does not prevent public addresses from receiving dust or stop careless UTXO consolidation.

Does using a new address prevent dusting?

It reduces address-reuse risk, although later transactions can still create links when outputs are combined.

Can a wallet automatically ignore dust?

Some wallets can freeze, exclude, hide, or avoid suspicious outputs, but available controls and default behavior differ.

Why does dust increase transaction fees?

Each UTXO selected as an input adds transaction data that must be paid for through the transaction fee.

Is there one fixed Bitcoin dust amount?

No, the relevant threshold depends on output type, relay policy, spending size, and fee assumptions.

Is Bitcoin dust invalid?

Not necessarily, because consensus validity, relay standardness, wallet creation rules, and economic spendability are separate concepts.

What is address poisoning?

Address poisoning sends a tiny transaction from a lookalike address in the hope that the victim copies the fraudulent address from transaction history.

Is address poisoning the same as dusting?

No, address poisoning attempts to redirect a payment, while traditional dusting attempts to gather information from later spending behavior.

Can deleting a token from my wallet remove it from the blockchain?

No, hiding an asset only changes the interface because the blockchain record remains.

How can businesses defend against dusting attacks?

Businesses can use unique invoice addresses, separate wallet functions, preserve labels, monitor unexpected outputs, and apply documented coin-control policies.

Should I move all funds to a new wallet after receiving dust?

Not normally, because receiving dust alone does not compromise the keys and moving everything carelessly may create more public links.

When should funds be moved to a new wallet?

A secure migration may be necessary when a private key, recovery phrase, signing device, or dangerous smart contract permission has actually been compromised.

Conclusion

A dusting attack uses tiny cryptocurrency transfers to observe wallet behavior, reduce privacy, or attract users toward malicious activity.

On UTXO-based networks, the attacker hopes the victim will combine the dust with other outputs and reveal possible ownership relationships.

The attack relies on public transaction data and wallet behavior rather than breaking private-key cryptography.

Receiving ordinary dust does not by itself allow the sender to steal funds or control the wallet.

The main traditional risk is that later spending can connect addresses, balances, counterparties, and real-world identity information.

On account-based networks, unsolicited tokens and NFTs are more likely to function as phishing advertisements or prompts for dangerous smart contract approvals.

Users should avoid address reuse, use coin control, freeze suspicious UTXOs, separate wallet purposes, and verify complete destination addresses.

Unknown tokens and NFTs should normally be ignored or hidden rather than claimed, traded, or removed through an unverified application.

Blockchain clustering is useful but imperfect, so a dusting transaction does not provide certain proof that every later associated address has one owner.

Careful address management and transaction review can prevent a nearly worthless deposit from creating a valuable trail for an attacker.