A dusting attack is an attempt to weaken transaction privacy by sending tiny Bitcoin outputs to many addresses and waiting for recipients to spend them alongside other funds. If that happens, the public transaction can give analysts a reason to infer that the input addresses may share a controller; this is a heuristic, not proof of a person’s identity.
How the attack works
Bitcoin uses a UTXO model: each spendable output is tracked separately until a later transaction uses it as an input. In a dusting attempt, someone sends small outputs to addresses they want to observe. If a recipient later combines one of those outputs with an output from another address, the transaction’s inputs become visible together on the Bitcoin blockchain.
Blockchain analysts may then apply the common-input heuristic: addresses used together as inputs are often controlled by the same wallet owner. The clue is probabilistic. Shared-input transactions can have exceptions, and the transaction alone does not reveal a name. Connecting an address cluster to a real person requires separate information, such as a voluntarily disclosed address or records held by an exchange.
What counts as dust?
“Dust” is a practical description for an output whose value is too small to spend economically, but Bitcoin does not have one universal amount that defines dust in every situation. Bitcoin Core calculates a node’s dust threshold from the output script and the configured dust relay fee. In the current source code’s default examples, the threshold is 546 satoshis for a typical non-SegWit P2PKH output and 294 satoshis for a typical SegWit P2WPKH output. Those are policy examples, not a consensus rule; different scripts or node settings can produce different thresholds.
People also use “dust” informally for tiny unsolicited token or NFT transfers on account-based networks. Those transfers do not work like Bitcoin UTXO consolidation, so the term can describe different mechanisms. A suspicious token or NFT may be a lure: the more direct risk is following an embedded link, connecting to a site, or signing a malicious transaction—not the mere fact that an unfamiliar asset appeared in a wallet.
What a dusting attack can and cannot reveal
Receiving an unexpected Bitcoin output does not give its sender control of the recipient’s funds, reveal a private key, or automatically identify who controls the receiving address. The privacy link becomes more plausible if the output is later spent together with funds from other addresses. Even then, an analyst is making an inference that can be strengthened or weakened by other evidence.
A 2023 peer-reviewed study examined Bitcoin dust transactions and classified possible dust attacks from on-chain patterns. It found that suspected attack transactions were a minority of dust-creating transactions in its dataset, while still having a disproportionate effect on the authors’ address-clustering analysis. The identification is pattern-based, so the finding does not mean every small transfer is an attack or that a recipient has been identified.
How to respond
- If privacy matters, avoid combining an unfamiliar small UTXO with unrelated funds. Use coin control or a “do not spend” option if your wallet supports it.
- Receiving dust alone is not a reason to panic or assume your wallet has been compromised. Check the transaction in a reputable block explorer and keep the output separate if you are unsure.
- For an unsolicited token or NFT that contains a link or an offer, do not follow its instructions. Verify assets through a trusted source, and do not connect your wallet or sign a transaction just to inspect or claim it.
Wallet controls differ, and leaving a small output untouched may be simpler than spending it when its value is below the transaction fee. If you already followed a suspicious link or signed something, treat that as a separate security incident and review the permissions or transaction you approved.
Social Media Sentiment
Reddit / r/Bitcoin: A single thread from April 2025 asks how a dust UTXO can affect privacy. Replies include advice to isolate the output and questions about how much new information dust adds; the opening post showed 17 votes in the indexed snapshot reviewed on 2026-10-21. This is a small discussion, not a measure of broader Bitcoin or crypto opinion. Read the discussion.
Last updated: 2026-10
Related Terms
See Also
- Why Calling It a ‘Wallet’ May Have Been Crypto’s Biggest Mistake
- How Do Crypto Bridges Work — And Why Are They Such a Hack Target?
- Why Smart Contract Audits Fail: What Post-Mortems Reveal About the Limits of Security Reviews
- Swap crypto with ChangeNOW
Sources
- Loporchio et al., Applied Network Science (2023) — “Is Bitcoin gathering dust?” — Open-access research defines dust attacks as a forced-address-reuse strategy and evaluates their effect on heuristic address clustering.
- Bitcoin Core — GetDustThreshold policy source — The code calculates dust from output size and the configured relay fee, with different examples for common output types.
- Kraken Support — What is a dusting attack? — An exchange support explainer describes the monitoring pattern and distinguishes receiving a small output from spending it with other funds.
- MetaMask Support — NFT airdrop scams — Wallet guidance explains how unsolicited NFT links can lead to phishing or malicious signing, a related but distinct risk from UTXO dusting.