Attackers execute dusting attacks by sending tiny cryptocurrency amounts to thousands of wallet addresses simultaneously to track spending patterns and link anonymous wallets to real-world identities. The August 2019 Litecoin dusting incident affected 294,582 addresses according to Glassnode, with attackers sending exactly 0.00000546 LTC per wallet. A 2025 analysis built on Flipside Crypto data identified over 3.4 million Solana addresses that received dust transactions, with estimated address poisoning losses exceeding $5.2 million. Attackers invested roughly 780 SOL to execute large-scale dusting campaigns on Solana, with successful operations reportedly returning over 1,200 percent of initial investment. The goal is surveillance rather than direct theft — once recipients spend the dust alongside legitimate funds, blockchain analysis tools cluster those addresses to reveal ownership.
Attackers Use UTXO Clustering to Track Wallet Activity
A dusting attack begins when an attacker sends tiny crypto amounts, often as small as 0.00000546 BTC per wallet. The attacker distributes dust to hundreds or thousands of addresses simultaneously. The dust itself does not steal funds from the receiving wallet directly. Instead, it plants a traceable marker on the blockchain's public ledger. Every subsequent transaction involving that dust becomes a data point to analyze.
When wallet holders spend the dust with their own legitimate funds, attackers use blockchain forensics to cluster those addresses together under one identity. This process exploits a fundamental feature of the unspent transaction output model.
James Jager of Binance Academy identified the 2019 Litecoin dusting attack early. Jager described the attack as network-wide and claimed it affected every active Litecoin address at the time. However, this characterization was disputed, and Glassnode's reported count was 294,582 addresses.
Dusting attacks differ from address poisoning schemes that plant lookalike addresses instead. Poisoning tricks victims into sending funds to the wrong address entirely. Dusting focuses on deanonymization rather than direct theft of crypto assets.
Litecoin 2019 and Solana 2025 Dusting Campaigns Affected Millions
A widely reported dusting attack targeted Litecoin in August 2019. Glassnode co-founder Jan Happel estimated nearly 300,000 addresses showed dusting signs. The attacker sent exactly 0.00000546 LTC to each affected wallet address.
Investigators traced the sender to a Russia-based mining pool called EMCD. The operator claimed the campaign was a marketing effort for the pool. Jager noted that alternative motives could not be fully ruled out at all.
Solana faced a much larger dusting problem according to 2025 research data. A 2025 analysis built on Flipside Crypto data identified over 3.4 million addresses that received dust deposits. Approximately 124,000 of those addresses showed strong signals of address poisoning activity.
The average dust amount on Solana measured just 0.00058 SOL per transaction. Estimated losses from address poisoning alone exceeded $5.2 million. The attackers invested roughly 780 SOL and reportedly earned over 1,200 percent returns.
These organized campaigns targeted addresses that recently used DeFi protocols or marketplaces. Evidence also pointed to coordinated cross-chain attacks spanning multiple blockchain networks.
Wallet Providers Offer Coin Control and Do-Not-Spend Labels
The primary defense against dusting attacks is simply not spending the dust. Leaving the tiny deposit untouched prevents attackers from linking wallet addresses together. Most wallet software now includes features that help users flag suspicious deposits.
Coin control lets users manually select which inputs to include in transactions. This feature exists in wallets like Bitcoin Core and several popular alternatives. Users can exclude specific unspent outputs that appear to be dust deposits.
Some wallets offer a do-not-spend label for suspicious incoming transactions. Trust Wallet added address screening tools that warn users about potential poisoning attempts. These automated alerts reduce the risk of accidentally interacting with dust inputs.
Truncated address displays on mobile wallets make poisoning attacks more effective, unfortunately. Users should verify the full address before confirming any transaction on any device. Comparing the complete address string prevents sending funds to a lookalike destination.
Binance noted that all blockchain transactions are public and permanently visible to anyone. Sharing wallet addresses publicly increases exposure to dusting and related surveillance attacks. Using new addresses for each transaction adds a layer of privacy protection.
FAQ
What is a dusting attack in cryptocurrency?
A dusting attack sends tiny crypto amounts to many wallets to track transactions and eventually link addresses to real identities.
How much cryptocurrency do attackers typically send in a single dusting transaction?
Attackers typically send between 0.00000546 BTC and 0.00058 SOL per wallet, amounts worth fractions of one cent.
Can a dusting attack steal cryptocurrency directly from a wallet?
Dusting attacks do not steal funds directly but enable deanonymization that can lead to phishing or extortion attempts afterward.
