What is a dusting attack in crypto?

A dusting attack is when someone sends tiny amounts of crypto, called dust, to many wallet addresses in order to track them. The goal is usually to link addresses together and work out who owns them, so the owners can be targeted later with phishing or extortion. The dust itself cannot take anything from your wallet.

What is crypto dust?

The Bitcoin Wiki defines dust as an output worth so little that spending it would cost more in fees than it is worth. Bitcoin Core software applies a dust limit as relay policy. At the default fee setting, that works out to 546 satoshis for older-style addresses and 294 satoshis for native SegWit addresses. Nodes do not pass on transactions that create outputs below the limit by default, though a miner can still include one in a block.

How does a bitcoin dust attack work?

On Bitcoin and similar chains, a wallet balance is made of separate pieces, and a payment often combines several of them. Binance Academy explains the trick: the attacker sends dust to many addresses, then waits. If the owner later spends the dust together with other coins, the public transaction shows that those addresses belong to the same wallet. Combined with other data, such as an exchange deposit, that can point to a real person.

Coinbase lists several reasons someone might do this. Criminals look for large holders to target with phishing or extortion. Coinbase notes that dusting has become less common on chains where fees have risen, because sending dust to thousands of addresses gets expensive.

Address reuse makes tracing easier, which is one reason some wallets change your bitcoin address after each payment.

What does a dust attack look like in MetaMask?

On Ethereum and similar networks, unwanted deposits more often arrive as unknown tokens or tiny transfers designed to sit in your history. MetaMask says an unsolicited token does not by itself give anyone access to your funds. The danger is trying to sell or swap it, which can lead to a fake site that asks you to approve transactions or enter your recovery phrase. MetaMask only shows established tokens when token detection is on, so many spam tokens never appear at all.

Tiny transfers from look-alike addresses are a related trick, covered in what is address poisoning. The broader risk of being singled out after sharing an address is discussed in is it safe to share your wallet address.

What should you do with dust in your wallet?

Coinbase and Binance Academy both describe the same approach: leave it unspent. Some bitcoin wallets offer coin control or a "do not spend" flag, which keeps the dust out of future payments so it cannot link your addresses.

For unknown tokens, do not visit websites named in the token's name or memo, and do not approve anything to move it. For most people, Coinbase says, dust is more of an annoyance than a serious threat. The real danger comes from the phishing sites and wallet drainers that dust is sometimes used to promote.