What Is a Crypto Dusting Attack?

Who Would Perform a Dusting Attack?

There are a number of groups that perform dusting attacks. Criminals have used dusting attacks to de-anonymize those with large cryptocurrency holdings. Those with large holdings can be targeted in a number of ways, including through phishing scams and cyber-extortion. Users with large crypto holdings in high-risk areas could also be physically targeted, or even have a family member kidnapped for a cryptocurrency ransom.

A branch of the government such as a tax or law enforcement agency may also perform a dusting attack in order to connect a person or group to an address. Specifically, they may target gangs that deal in contraband, large criminal networks, money launderers, or tax evaders. Mass dusting is also used by blockchain analytics firms, who study crypto dust for academic purposes or have contracts with government agencies.

Importantly, the person or group that executes the dusting attack and the party that analyzes the results don’t need to be the same. Because it’s on the blockchain, anyone with the skills, tools, and time can analyze the crypto dust after an attack. A criminal organization could study a government’s dusting, or a blockchain analytics firm could study a malicious actor's dusting.

For this reason, not all dust attacks are considered “attacks.” The mass spreading of dust has also been used to advertise to cryptocurrency users, primarily by sending out messages included in the crypto dust, comparable to an email blast. You may know that the genesis block of Bitcoin (the first block of bitcoin ever mined) included a message.

These mass dustings may also be used as stress tests, where a large amount of crypto dust is sent in a short amount of time to test the throughput, or bandwidth, of a network. Dustings are also sometimes used as a way to spam a network, by sending huge batches of worthless transactions that clog and slow it down considerably. Whatever the intended purpose, mass dustings can be analyzed for various purposes, both good or bad.

Dusting can also be used as a defensive tool. Let’s say that a large criminal enterprise receives a tip that the authorities are closing in on them. The cyber criminals could dust numerous random wallets to spread the dirty money around in an attempt to throw the authorities off their trail.

There is some debate about how traceable addresses are in dusting attacks. As blockchain analytics improve, better countermeasures emerge. Many governments and firms consider their technology as proprietary and keep it closely guarded. Can you still be traced through dusting despite the various precautions available? We really don’t know yet.

Costs Associated With Dusting

The fees associated with dust attacks are often more than the amount of dust spent. Even though the crypto dust of thousands of wallets may not be significant, attackers still have to pay network fees to deploy a dusting attack. As fees have gone up on the Bitcoin blockchain, bitcoin dust attacks seem to have waned in popularity.

How Can You Avoid Dusting Attacks?

Using a hierarchical-deterministic (HD) wallet, which creates new addresses each time you transact, makes it harder to trace you. Some wallets also show dust UTXOs (unspent transaction outputs), which you can mark “do not spend.” These small amounts are then left in your wallet, and if you never use them, no one can track where they go. Others wallets only go online using the Tor Network or a VPN.

Should You Be Worried About Getting Dusted?

Unless you’re a whale (a person with large holdings) or live in an area where personal safety, security or political instability is a common problem, dust attacks are more of an annoyance than a real concern. Crypto dust in your wallet doesn’t give anyone control of your funds. The privacy measures new wallets and exchanges have implemented have greatly reduced common concerns around dusting. If you see tiny random transactions in your wallet, you’re not imagining things — it’s just a little “dust.”