Glossary / Privacy & security
Dusting attack
Also known as Dust attack.
- Definition
- A dusting attack sprays tiny payments across thousands of addresses so the sender can watch which ones later get spent together, linking separate addresses to a single owner.
The attacker is planting a tracking beacon, not stealing anything. One August 2019 campaign put 0.00000546 LTC into 294,582 Litecoin addresses in a single sweep, and the same technique runs on bitcoin for a few hundred satoshis per target. The dust only pays off if you spend it, which makes leaving it alone a complete defense.
How it works
The attack rests on one assumption that chain analysts make about every transaction: if two outputs are spent as inputs to the same transaction, one person controls both keys.
That assumption is usually correct, and it is what turns a pile of unrelated addresses into a wallet cluster. A dusting attack weaponizes it. Instead of waiting for you to reveal a link on your own, the sender plants an output at an address of their choosing and waits for your wallet to sweep it up alongside coins they could not otherwise connect to you.
The sequence is short:
- The sender picks targets. Withdrawal addresses seen leaving an exchange, addresses posted in public, or entire ranges scraped from a block explorer.
- The sender pays each one a few hundred satoshis, just above the amount the network will relay.
- Nothing happens for weeks or months.
- Your wallet builds a payment, its coin selection algorithm grabs the small output because small outputs are cheap to include, and every other input in that transaction is now provably related to the dusted address.
Cost is what makes this practical. An extra output adds about 31 virtual bytes to the attacker's transaction, so at 5 sat/vB a thousand targets costs roughly 155,000 satoshis in fees plus the dust itself. Batching thousands of outputs into a handful of transactions brings the price of watching an entire population of addresses down to the cost of a meal.
Not every unexplained small payment is surveillance. Much of what lands in wallets today is advertising, with a URL stuffed into a transaction label or an accompanying message, or bait for a lookalike-address scam. The response is identical in all three cases.
Why this matters when you buy bitcoin
Buying bitcoin from an exchange is the moment your identity and an on-chain address get written down in the same place.
Every large venue we review, from Kraken and Coinbase to Bitpanda and Luno, verifies identity before it lets you withdraw. That is the law in most of the 231 countries covered here, not a quirk of any one company. It means the hard part of deanonymization, connecting a legal name to an address, is already done and sitting in a compliance database. What is left is the mapping between that first address and everything you do afterwards, and that is exactly what a dusting attack tries to build.
The practical defense is a wallet feature, not a mindset. Use coin control, which lets you see and choose individual outputs rather than letting the software pick for you. Sparrow, Electrum, and BlueWallet go further and let you freeze an output so that automatic coin selection can never touch it, and Trezor Suite lets you pick inputs by hand on every send. Label the dust the day it arrives, freeze it, and it becomes a permanent zero in your balance.
Two habits matter more than any tool. Do not consolidate outputs from different sources into one transaction unless you are happy for them to be publicly joined, and take a fresh receive address every time rather than reusing one, because a reused address is a target that never expires.
The August 2019 Litecoin sweep
The clearest public example of mass dusting was not on bitcoin, and its arithmetic is worth reading.
In August 2019, Binance's security team reported that 294,582 Litecoin addresses had each received 0.00000546 LTC in a coordinated sweep. Multiply it out: the entire campaign moved about 1.6 LTC, and Litecoin traded near 80 dollars that month, so the dust cost the sender under 150 dollars before fees. For that, they got a tripwire on nearly 300,000 addresses at once, each one silently waiting for its owner to make a single careless spend.
The 546 figure is not a coincidence, and it explains why bitcoin dusting looks the way it does. It is Bitcoin Core's relay threshold for a legacy output, copied into Litecoin, and attackers denominate at the floor because every satoshi above it is waste.
Dusting attack vs dust limit
A dusting attack is an action; the dust limit is the rule that action is calibrated against. The limit sets the smallest output the network will forward, and dusting sends exactly that amount, no more. Reading a 546 satoshi deposit as evidence of an attack is a mistake, though: change outputs, failed test payments, and Lightning channel closures all produce small amounts honestly.
Dusting attack vs address poisoning
Both arrive as an unexplained tiny payment, and they want opposite things from you. A dusting attack wants you to spend the coin, so that your other coins are dragged into the same transaction. Address poisoning wants you to look at the sender, mistake their lookalike address for one of yours, and copy it into a future payment. Dusting is surveillance and costs you privacy; poisoning is theft and costs you the balance.