Crypto dusting: a quiet threat to your wallet

How a dusting attack works

Every transaction is recorded on a public ledger. Addresses look like random strings, but movement between them creates patterns that can be analysed.

• Scattering: dust is sent to a large number of addresses at once
• Tracking: the attacker watches for any wallet that spends or consolidates the dust
• Linking: transaction flows are combined to connect addresses to one owner, and eventually to a real identity
• The sting: targeted phishing, extortion or a tailored investment approach follows

Why de-anonymisation is the goal

Blockchains offer pseudonymity, not anonymity. Once an attacker can plausibly connect a cluster of addresses to a person, everything else becomes easier: convincing phishing messages, threats to expose holdings, or a fake opportunity sized precisely to what they believe you hold.

Signs your wallet has been dusted

Dusting is easy to miss, but there are consistent indicators.

• An unexpected micro-deposit worth a fraction of a cent
• An unfamiliar sending address with no relationship to you
• Several different tokens arriving at once to test which you interact with
• A memo or token name containing a link or a promotional message

What to do about it

Do not spend, swap or consolidate the dust — leaving it untouched breaks the tracking chain. Never interact with a link or claim page attached to an unknown token. Where your wallet supports it, mark the dust as spam or use coin control to exclude it from future transactions, and avoid reusing a single address for everything you do.

If a dusting attack led to a loss

Dusting is usually the reconnaissance stage, not the theft itself. If it was followed by a phishing message, a drained wallet or an extortion demand, preserve every transaction hash, address and message before anything is deleted. That record is what makes tracing possible.