A dust attack sends a tiny amount to many addresses so the sender can observe how those outputs later move and attempt to link wallet activity. The dust does not reveal your private key; the main risks are privacy analysis and scam messages attached to unsolicited tokens.
Execution checklist#
- Do not visit URLs embedded in token names or transaction notes. For crypto dust attack, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Use wallet coin-control features to avoid spending suspicious UTXOs. Complete this through the verified product interface, then test the control instead of assuming it is active.
- Hide spam assets instead of approving or selling them. Write the boundary down first so urgency cannot quietly expand what the wallet or account is allowed to expose.
- Maintain address separation and avoid public reuse. Complete this through the verified product interface, then test the control instead of assuming it is active.
- Report malicious tokens through wallet or explorer tools. For crypto dust attack, complete this before value or signing authority changes hands and verify the resulting state afterward.
Before you take action#
On UTXO networks, combining dust with other inputs can help cluster addresses. On account-based chains, spam tokens often advertise malicious URLs and rely on the recipient to interact.
For crypto dust attack, separate what can be verified before acting from what can only be monitored afterward. Put hard limits around the second category.
A safer default#
Treat dust as an observation and social-engineering problem, not an emergency key rotation. Move funds only if there is separate evidence of key compromise.
What can still go wrong#
- Trying to return the dust to the sender. This weakens a control that should limit the blast radius of crypto dust attack.
- Signing a swap to “remove” a spam token. A label can look correct while the underlying destination differs, and a confirmed onchain action may be irreversible.
- Assuming receipt means the wallet is hacked. This removes a required input from the crypto dust attack decision and makes the apparent result unreliable.
- Consolidating every UTXO without considering privacy. This weakens a control that should limit the blast radius of crypto dust attack.
Evidence to keep#
Do not judge the outcome of crypto dust attack only by whether the interface shows a success message. Use evidence that can still be checked after the page is closed.
| Checkpoint | Evidence | Stop condition |
|---|---|---|
| Do not visit URLs embedded in token names or transaction notes | Transaction or withdrawal ID plus the matching explorer or account record | Trying to return the dust to the sender |
| Use wallet coin-control features to avoid spending suspicious UTXOs | Dated control check, recovery test or authenticated settings record with secrets removed | Signing a swap to “remove” a spam token |
| Hide spam assets instead of approving or selling them | Exact URL or contract address matched to official documentation | Assuming receipt means the wallet is hacked |
Keep transaction hashes, official case numbers or dated screenshots when they help document crypto dust attack, but exclude seed phrases, private keys and authentication codes.
Frequently asked questions#
Can dust steal my coins automatically?
No. Receiving a tiny transfer does not grant spending authority. Interaction with malicious links or contracts creates additional risk.
Should I send dust to a burn address?
That spends the output and may reveal linkage. Prefer wallet-supported hiding or coin control.
Why does the token name contain a website?
Spam tokens use the ledger as advertising. Do not follow the link.
Related guides#
Sources#
- Bitcoin.org: Protect Your Privacy
- FATF: Targeted Update on Virtual Assets and VASPs
- OFAC: Sanctions Compliance Guidance for Virtual Currency
Risk notice: Crypto actions can be irreversible. Never share a seed phrase, private key, password or authentication code, and verify every domain and wallet prompt independently.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
