What Is a Bitcoin Dusting Attack? Why You Received Unsolicited BTC, and What to Do

Bottom line

A Bitcoin dusting attack is when an attacker sends tiny amounts of BTC — a few hundred satoshis, called "dust" — to a huge number of wallet addresses, then, the moment a recipient spends that dust together with other funds, links multiple addresses together as belonging to the same person, stripping away their anonymity. The important thing to understand is that receiving dust alone does not compromise your wallet or drain your funds. The attack's purpose is purely tracking and analysis, and the most reliable defense is to leave the dust untouched and never include it in a transaction. This article covers what counts as dust and the relevant thresholds, how the linking mechanism works, and concrete steps for defending yourself using coin control.

What "dust" actually is

"Dust" refers to a bitcoin balance (a UTXO) so small that the fee required to spend it would exceed its value — effectively useless. Most Bitcoin software has a minimum threshold below which an amount is treated as "unspendable," known as the dust limit.

The threshold varies by transaction format. Below are general reference figures (they can shift with network congestion or settings — check current values with your wallet or official documentation):

(1 satoshi = one hundred-millionth of a BTC. 546 satoshis amounts to just a few cents at typical prices, varying with the market.)

For why the dust threshold differs by address format, see our explainer on Bitcoin address types.

Why unsolicited small amounts of BTC show up

One day you open your wallet and find a tiny, unsolicited amount of BTC has arrived — that's the entry point of a dusting attack. The attacker — an exchange, an analytics firm, or a malicious third party — blasts dust out to thousands or tens of thousands of addresses at once. At this stage, you're simply one of many recipients, and no actual harm has occurred yet.

The attacker's real goal is to watch, on the public blockchain, what happens to the addresses that received the dust afterward.

How the attack works: de-anonymizing via "clustering"

Bitcoin tracks balances using a model called UTXOs (unspent transaction outputs). When you make a payment, your wallet typically combines several UTXOs (fragments of money you've received in the past) to construct that payment.

Here's the trap: suppose you regularly use several addresses independently, and each has received some dust. If, at some point, your wallet automatically combines multiple UTXOs — including the dust — into a single payment (a "co-spend"), the blockchain now shows strong evidence that "these addresses paid from the same wallet, i.e. the same person." This is called address clustering.

Using the assumption that inputs spent together in a single transaction very likely belong to the same owner (the "common-input-ownership heuristic"), an attacker links together what were previously separate addresses into a single cluster, and works to tie that cluster to a real name or identity — for instance, via deposits made to an exchange. As clustering progresses, an attacker can estimate the size of your holdings, opening the door to phishing, extortion, or targeted scams.

Reusing the same address in the first place makes this kind of tracking easier. See our explainer on address reuse and privacy for more.

Why you shouldn't touch received dust, and what to do instead

1. Don't touch it (don't co-spend it)

The simplest, most reliable defense. If you never use the dust in a transaction or exchange, an attacker cannot link your address to any other. Leaving it alone costs you nothing.

2. Exclude it from spending with coin control / UTXO locking

Bitcoin Core, Sparrow Wallet, Electrum, and some hardware-wallet companion apps offer a coin control feature that lets you manually choose which UTXOs to include in a transaction. Marking a dust UTXO as "do not spend / freeze / locked" prevents it from accidentally getting mixed into a future automatic transaction.

3. Don't reuse addresses

Using a fresh address for every incoming payment (the standard behavior of HD wallets) reduces the material available for clustering in the first place.

4. Separate your wallet setup by purpose

Keeping separate wallets for different purposes limits the blast radius if dust ever does get mixed in accidentally. For more on secure storage, see how to store bitcoin.

Dusting attacks vs. other threats

In short, a dusting attack isn't the "your funds disappear" type of attack — it's a privacy-violation type of attack. That's exactly why the seemingly passive response of "don't hastily move anything" is actually the best move.

Frequently asked questions

Q. Is receiving dust a sign it's about to be stolen? Should I move it quickly? A. No. Receiving dust alone does not expose your private key or drain your funds. In fact, moving it hastily together with your other funds is exactly what enables address linking, which is a win for the attacker. Leaving it alone is the default.

Q. Is it fine to send the dust to an exchange to cash it out? A. Not recommended. Sending it to an exchange links the dust with the rest of your funds and your verified account, substantially weakening your privacy. If you must, use coin control to exclude the dust from that transaction.

Q. Is there a way to fully delete the dust? A. Blockchain records can't be deleted. The practical approach is to mark the dust's UTXO as "locked" or "do not spend" within your wallet, so it's effectively neutralized by never being included in a transaction.

Sources

• Binance Academy — What Is a Dusting Attack?
• Bitcoin.org GitHub Issue #592 — Dust limit is listed as 546 satoshis
• Gemini Cryptopedia — Crypto Dust and Dusting Attacks Explained
• Halborn — What Is a Dusting Attack?
• 99Bitcoins — What is a Crypto Dusting Attack? Guide