You open your wallet and notice a tiny deposit you do not recognise, worth a fraction of a cent. It looks harmless, and in money terms it is. But that speck of crypto, known as dust, may be a tracking device. A dust attack is a privacy attack, not a theft, and understanding it is the difference between ignoring a nuisance and handing an attacker a map of your wallet activity.

Dust is an amount of cryptocurrency so small that spending it would cost more in transaction fees than the amount itself is worth. On Bitcoin, dust is generally anything below a few hundred satoshis. Dust appears naturally too: change from old transactions, leftover fractions, and promotional airdrops can all leave tiny outputs sitting in a wallet. Not every small deposit is an attack, but an unsolicited one from an unknown sender deserves suspicion.

Bitcoin works on unspent transaction outputs, or UTXOs, which behave a little like individual bills in a cash wallet. An attacker sends dust to thousands of addresses at once, seeding the blockchain with traceable markers. Nothing happens until the victim spends. The moment your wallet combines that dust with your other funds in a single transaction, the attacker can follow the trail: the dust links the addresses involved, and the change from that transaction can link your future activity as well. Over time, the attacker builds a picture of which addresses belong to one person, and that picture can feed phishing attempts, targeted scams, or extortion.

Dust itself cannot move your coins or touch your private keys. The risk is what comes after de-anonymisation. Once an attacker connects your addresses to an identity, perhaps through an exchange withdrawal, a public donation address, or a social media post, they know roughly how much you hold and how you transact. That knowledge makes phishing messages far more convincing and social engineering attacks far more personal. On some chains, dust can also arrive with malicious links embedded in transaction memos, which are pure scams designed to get you to click.

The golden rule is simple: do not spend it. Do not consolidate it, do not send it to an exchange, and do not interact with unknown tokens or links that arrive with it. If your wallet supports coin control, mark the dust output as do-not-spend or freeze it so future transactions never select it. Some wallets offer dust detection alerts or a built-in do-not-spend label for exactly this purpose. If your wallet lacks these tools, moving your main funds to a fresh address leaves the dust behind, though you should weigh the transaction fees first. You can also report the incident to your wallet provider or exchange, which may flag the sending address.

Although the term comes from Bitcoin, the same trick works on other chains. On networks with smart contracts, dust can arrive as worthless tokens whose names or memos advertise scam websites, or as tiny amounts designed to trick you into approving a malicious contract. The defence is the same: do not interact, do not approve, and do not trade tokens you did not ask for. On EVM chains, periodically reviewing and revoking token approvals is the equivalent of coin control, and it closes the door on the most common follow-up attack.

Good address hygiene is the long-term defence. Use a fresh receiving address for each payment where your wallet supports it, so your activity is not trivially linked. Keep a separate wallet for small, public-facing transactions and another for larger holdings. Enable two-factor authentication on any custodial account, turn on withdrawal address whitelisting, and treat every unsolicited token, NFT, or tiny deposit as guilty until proven innocent. Privacy on a public blockchain is not automatic; it is something you maintain, one unspent output at a time.