What is a dusting attack and how does it track you?
A dusting attack sends tiny crypto amounts to many wallets so an attacker can trace owners by watching where the dust moves. It cannot steal funds.
Vahe HakobyanEditor-in-chief
Updated Oct 6, 20263 min readFact-checked
On this page
- Dust is a tiny payment that marks a wallet for tracking.
- The attacker traces the dust when you later move it.
- Spending dust can connect your addresses to one person.
- Dust can be a mistaken send or airdrop, not always an attack.
Dust is a crypto payment so small that it is easy to overlook. It can arrive through a plain transaction or an airdrop, and a mistaken send from a stranger can look the same at first. The attack itself does not take control of your wallet or your keys; it gathers information.
How does a dusting attack work?
The attacker chooses many wallets that hold crypto and sends a tiny amount to each one. Each payment sits on a public ledger like a marker. If you spend the dust later, the transaction can show which addresses you control and what you hold elsewhere.
What happens if you spend the dust?
A transaction can tie the dust to the wallet that paid the fee and to the addresses that received funds. Those connections can join many addresses into one profile. The goal is to deanonymize you, which means working out which addresses belong to one person.
- It can link the dust to your main wallet.
- It can show other addresses you control.
- It can tie your payment history to one profile.
- It can supply details for a phishing message.
How is it different from a phishing attack?
A phishing attack usually asks you to do something, such as open a link or type a password, and waits for you to act. A dusting attack sends funds first and watches what you do with them. Tracking data can then feed a later phishing message.
Frequently asked questions
Not by itself. Dust does not give the attacker access to your keys, but the tracking data can help set up a phishing message.
Legality depends on the jurisdiction and the attacker's intent. Sending dust is not automatically a crime, but using tracking data to defraud or phish can be illegal.
They work best on public blockchains that anyone can read. Chains with strong privacy features can make the tracking harder.
Leave it alone. Do not spend it, combine it with other funds, or open any link that came with it.
