From July 2022 to June 2024, researchers at CyLab, Carnegie Mellon University, identified 270 million attempts to "poison" addresses on the Ethereum and BNB Chain networks, affecting 17 million wallets. The confirmed damage exceeded $83.8 million. Following the Fusaka update, the number of "dust" transfers of USDT surged by 612%.

The term "dust" refers to two different types of attacks. The first aims to deanonymize the wallet owner, while the second seeks to steal funds. Together with the team from the Bitcoin mixer Mixer.Money, we explore how these attacks work, how they differ, and what to do about unwanted "dust".

Spy and Thief

The first method is dusting for deanonymization. The attacker scatters tiny amounts across thousands of wallets. Once the recipient spends these coins along with their main funds, an analyst can link the addresses into one cluster. The goal is to determine who you are and how many coins you have.

The second method is address poisoning. Here, the micro-transfer works differently. The attacker inserts a lookalike address into your transaction history, resembling the one you regularly send money to. The expectation is that next time, you will copy the details without checking.

In May 2024, an address poisoning attack netted the attacker 1155 WBTC, costing them only $0.65 in fees. At the time of the transfer, the victim lost $68 million.

CriteriaDusting for SurveillanceAddress PoisoningAttacker's GoalIdentify wallet owner
Steal funds
What They DoDisperse dust outputs to thousands of addresses
Send micro-transfer from a lookalike address
When It TriggersYou spend dust along with clean coins
You copy details from transaction history
What You LosePrivacy and trading strategy
Funds, irretrievably
How to DefendTags, freezing outputs, coin control
Address book and full address verification

The Mechanics of Dusting

To understand the mechanics of dusting, it's essential to recall how Bitcoin stores information about UTXO states. Unlike traditional banking systems, there are no familiar account balances. Instead, a UTXO model is used, where funds are represented as individual unspent transaction outputs. These can be compared to banknotes of arbitrary denominations, with the wallet balance being the sum of all outputs under your control.

To transfer 0.3 BTC, a wallet with outputs of 0.2 and 0.15 BTC combines both in one transaction. This property underpins the Common Input Ownership Heuristic. If a transaction has multiple inputs, they likely belong to the same person.

The process unfolds in four steps:

  1. The attacker generates dust — outputs worth a few hundred satoshis.
  2. Distributes them to thousands of addresses.
  3. The victim's wallet automatically selects the dust output along with regular coins to meet the payment amount.
  4. Both outputs are included in one transfer, and on-chain analysis links their source addresses to one owner.

External data comes into play next. Analytical companies like Chainalysis match the cluster with KYC data from exchanges, IP addresses, and behavioral patterns. ForkLog has detailed how specific names emerge from such connections in their OSINT investigations.

Lookalike in History

The second method, also referred to as "dust," operates quite differently. In this case, the attacker does not aim to deanonymize the wallet owner. Their goal is to steal funds using address poisoning.

This scheme relies on the habit of checking addresses by their first and last characters. Most interfaces display them in a truncated format like bc1qa...16z, and few people scrutinize the middle.

"Essentially, this is a convenience problem. Addresses are hard to remember, and people tend to copy them from transaction history. Such behavior creates vulnerabilities," comments Mixer.Money.

The attacker iterates through keys on GPUs until they find a lookalike with the same first and last characters as the regular recipient. Then, a micro-transfer is sent from the forged address, and the fake details settle in the transaction history alongside the real ones.

"Modern GPUs with tools like Profanity2 can generate over 500 million addresses per second. This is enough to find a matching vanity address in about 72 seconds.

Bitcoin addresses in the bech32 format use an alphabet of 32 characters, making the brute-force of each character more computationally intensive than in Ethereum. However, due to parallel processing on GPUs, attackers can still relatively quickly find an address that matches the target by the first and last few characters," experts from *Spark explain.

The most successful group in the CyLab sample earned $29 million with expenses of $2.7 million. Competition is fierce: in 79% of successful attacks in Ethereum, multiple teams simultaneously "poisoned" the same victim.

The cost of a mistake was illustrated by an incident in December 2025. A trader first sent a test transfer of 50 USDT to the correct address. A few minutes later, they copied the details from the poisoned history and transferred 49,999,950 USDT to the scammer. The lookalike matched the first three and last four characters.

Bitcoin has a structural advantage that account-based networks lack: dust in UTXO creates a separate identifiable output. It can be isolated and never spent. Below is how to achieve this.

Find and Freeze

Protection against dusting is based on one principle: dust is harmless as long as it remains untouched. It becomes dangerous when it gets included in a transfer with your coins. Therefore, it needs to be found and frozen.

Coin control helps — manually selecting coins for payment. Without it, the wallet automatically selects outputs based on algorithms optimized for fees, potentially pulling in dust UTXO into a transfer without your knowledge. With coin control, you specify which funds to spend and exclude the questionable ones.

Practical discipline boils down to three rules:

  • Label every unclear small incoming transaction as "dust" immediately upon receipt;
  • Freeze suspicious outputs to prevent the wallet from automatically including them;
  • Never combine dust with clean coins in one payment.

This function is available in desktop wallets with output labeling like Sparrow Wallet and Trezor Suite. They allow you to assign labels and manually select coins for sending or freezing UTXO.

Sparrow Wallet allows you to sign individual UTXOs, use them for sending, or freeze them. Source: Bitbox.

At Mixer.Money, it is recommended to leave dust untouched and label it, while obtaining the recipient of each payment not from the transaction history but from the address book.

"Verify the full address, keep the details of regular recipients in a separate list, and do not copy them from history. For large amounts, confirm through a second channel: a call or a messenger. Hardware wallets like Ledger and Trezor display the full address on the device screen and prevent substitution through the clipboard," experts add.

How to Maintain Anonymity

Coin control prevents dust from entering new transactions but does not eliminate connections that have already been established. If you have ever spent a dust output alongside other coins and the addresses have formed a cluster, freezing will not change anything.

To break the graph, a new history of funds is needed. One tool is Bitcoin mixers. Cooperative CoinJoin partially solves the problem. It disrupts the common ownership heuristic but leaves a characteristic pattern of many identical outputs in the blockchain. Analytical services can recognize it algorithmically, and exchanges often label such coins as high-risk.

The Mixer.Money service operates differently: at the output, the coins have no on-chain connection to the "dusty" cluster. In "Full Anonymity" mode, it works like this:

  1. Bitcoins enter a pre-mixer and are split into random parts.
  2. The funds are directed to investors — independent traders on major international exchanges.
  3. In exchange for two new addresses, the client receives a payout.

"Unlike CoinJoin, our algorithm excludes mixing clients' funds with each other. The user receives an equivalent amount of recently withdrawn coins from exchanges with a completely different history," explains Mixer.Money.

For AML systems, such a payout appears as a standard withdrawal from a trading platform to a personal address. For Chainalysis and Elliptic, exchange wallets represent monolithic clusters worth billions of dollars, where individual withdrawals are indistinguishable without the internal data of the platform itself.

In addition to "Full Anonymity," two other modes are available:

  • "Mixer" — basic privacy for a 1% fee and up to two hours of waiting, coins are mixed with other clients' funds;
  • "Exact Payment" — sending funds to a third party through the service, the seller receives payment "from the exchange" within six hours.

No registration is required, and a guarantee letter with a PGP signature is issued for each transaction. A detailed description and testing of the "Full Anonymity" mode can be found in a separate article.

Dust-Resistant Wallet

Dust poses two threats, and the response to them is different.

If it's dusting for deanonymization, such coins should not be spent alongside your main funds. Label the UTXO, freeze it through coin control, and the connection between addresses will not arise.

If it concerns address poisoning, the micro-transfer itself poses no danger. The risk comes from the lookalike that has settled in the transaction history. Do not copy details from there: verify the recipient's address in full and send funds only using records from your address book.

If the graph has already been built and addresses are clustered, changing wallets will not fix this. Services that provide coins with a new history, such as Mixer.Money, can help.