Researchers reveal extensive dusting attacks on Ethereum and BNB Chain, costing millions and highlighting the need for better wallet security.
Between July 2022 and June 2024, researchers at CyLab, Carnegie Mellon University, documented approximately 270 million attempts to conduct "dusting" attacks on the Ethereum and BNB Chain networks, impacting around 17 million wallets. The estimated losses from these attacks have surpassed $83.8 million. Following the introduction of the Fusaka update, there was a staggering 612% increase in the number of "dust" transfers involving USDT.
"Dust" refers to two primary attack strategies: one aimed at deanonymizing wallet owners and the other focused on stealing funds. Collaborating with Mixer.Money, a Bitcoin mixing service, researchers delve into the mechanics of these attacks, their distinctions, and preventive measures against unwanted "dust".
Types of Attacks: Surveillance vs. Theft
The first attack method involves dusting for deanonymization, where attackers distribute tiny amounts of cryptocurrency across numerous wallets. When victims spend these coins alongside their main funds, analysts can cluster the addresses together, revealing the wallet owner's identity and their total holdings.
The second method, known as address poisoning, involves the attacker inserting a fraudulent address into the victim's transaction history that closely resembles a legitimate address. The intent is for the victim to inadvertently use the fake address in future transactions.
A notable case in May 2024 saw an address poisoning attack result in the loss of 1,155 WBTC, with the attacker only incurring a fee of $0.65 while the victim lost an astonishing $68 million.
The Process of Dusting Attacks
To grasp the dynamics of dusting, it's crucial to understand the UTXO (Unspent Transaction Output) model utilized in Bitcoin, which differs from traditional banking systems. In this model, funds are represented as individual unspent outputs rather than a single account balance. For instance, to transfer 0.3 BTC, a wallet containing outputs of 0.2 and 0.15 BTC combines them into one transaction, which can lead to the Common Input Ownership Heuristic where multiple inputs suggest a single owner.
The dusting attack unfolds in four steps: generating dust outputs, distributing them widely, the victim's wallet selecting these dust outputs for transactions, and on-chain analysis linking the addresses to the same owner.
Address Poisoning Explained
In the case of address poisoning, the attacker's strategy shifts from deanonymization to outright theft. This method exploits users’ tendency to copy addresses from transaction histories, which often display only the beginning and end characters.
"This is fundamentally a convenience issue; users often copy addresses from their history, which creates vulnerabilities," Mixer.Money notes.
Attackers can generate lookalike addresses rapidly using modern GPUs, which can produce over 500 million addresses per second, potentially finding a matching address in just over a minute.
In a competitive landscape, successful attackers can reap substantial rewards; for example, one group in the CyLab study made $29 million with only $2.7 million in expenses. The stakes are high, with 79% of successful Ethereum attacks involving several teams targeting the same victim.
An illustrative incident occurred in December 2025 when a trader mistakenly sent nearly $50 million to a scammer after copying a poisoned address from their transaction history.
Defensive Strategies Against Dusting
To mitigate the risks associated with dusting, the primary approach is to leave dust untouched. Dust becomes problematic when it is included in transactions with legitimate funds. Implementing coin control allows users to manually select which coins to spend, thus avoiding the automatic selection of dust outputs.
Practically, users should adhere to three rules: label small incoming transactions as dust, freeze suspicious outputs, and never combine dust with clean funds in a single payment.
Wallets like Sparrow Wallet and Trezor Suite enable users to label outputs and manually select coins, providing additional layers of protection.
"Always verify the full recipient address, maintain a separate address book, and for large transactions, confirm details via a secondary channel," experts advise.
Maintaining Anonymity in Transactions
While coin control can prevent new connections from forming, it does not erase previously established links. Users who have spent dust alongside other coins will have their addresses clustered together. To sever these connections, one option is to use Bitcoin mixers, which can obscure the history of funds.
Mixer.Money offers a unique approach, ensuring that the coins received have no on-chain ties to the original dust cluster. Their process involves splitting funds and distributing them through independent traders, allowing users to receive coins with a different transactional history.
In addition to their "Full Anonymity" mode, Mixer.Money provides other options for privacy, including basic mixing services and exact payments, all without requiring user registration.
Conclusion: Navigating Dust Risks
Dusting attacks present dual threats: deanonymization and theft. To counteract deanonymization, users should avoid spending dust with main funds, while for address poisoning, the focus should be on verifying recipient addresses through reliable records rather than transaction histories. Changing wallets won’t eliminate prior linkages, but services like Mixer.Money can help provide a clean transactional history.
