Dust attacks on crypto wallets: 270 million attempts and $83.8 million in damages — a full breakdown of the threat
Over the past two years, from July 2022 to June 2024, a research team from Carnegie Mellon University's CyLab recorded 270 million attempts at so-called "address poisoning" on the Ethereum and BNB Chain networks. These attacks affected over 17 million wallets, with confirmed financial losses exceeding $83.8 million. After the Fusaka upgrade, the number of "dust" USDT transfers skyrocketed by 612%.
In professional circles, the term "dust" is used to denote two fundamentally different types of attacks. The first aims to deanonymize the wallet owner, while the second targets the direct theft of funds. Let's break down how these schemes work, how they differ, and how to protect yourself.
Two Faces of One "Dust": Spy and Thief
Dusting for deanonymization involves sending microscopic amounts to thousands of addresses. As soon as the recipient spends these coins together with their main funds, analytical tools link all the addresses into a single cluster. The goal is to find out who you are and how much crypto you hold.
Address poisoning works differently. The attacker sends a micro-transaction from an address that visually resembles the one to which the victim regularly sends money. The assumption is that the next time, the user will copy the details from the transaction history without noticing the substitution. In May 2024, one such attack netted a scammer 1155 WBTC, while the victim lost $68 million.
| Criterion | Dusting for Surveillance | Address Poisoning |
|---|---|---|
| Goal | Identify the wallet owner | Steal funds |
| Action | Sending dust outputs to thousands of addresses | Micro-transaction from a look-alike address |
| Trigger Moment | When you spend dust together with clean coins | When you copy details from history |
| Losses | Privacy and trading strategy | Money, irreversibly |
| Protection | Labels, UTXO freezing, coin control | Address book, full address verification |
The Mechanics of Dusting: How Surveillance Works
Bitcoin is based on the UTXO model, where funds are represented as individual "outputs" — like banknotes of different denominations. The attacker generates dust outputs of a few hundred satoshis and sends them to thousands of addresses. When the victim's wallet automatically selects the dust output along with regular coins for a transaction, both end up in the same transaction. The common-input-ownership heuristic kicks in: all source addresses are linked to a single owner. Then, analytical companies like Chainalysis match the cluster with exchange KYC data and IP addresses, turning an anonymous wallet into a specific name.
A Look-Alike in History: How Millions Are Stolen
The address poisoning scheme relies on the human habit of verifying details by the first and last characters. Most interfaces display addresses in a truncated form (e.g., bc1qa...16z). The attacker brute-forces keys on a GPU, generating up to 500 million addresses per second, until they get a look-alike with the same first and last characters as the regular recipient. Then, a micro-transaction is sent from this address, and the fake details settle in the transaction history. The most successful group in the CyLab sample earned $29 million with expenses of $2.7 million. Competition is high: in 79% of successful attacks on Ethereum, a single victim was simultaneously "poisoned" by several teams. In December 2025, a trader, after sending a test 50 USDT to the correct address, copied the details from the poisoned history and transferred 49,999,950 USDT to the scammer. The look-alike matched only the first three and last four characters.
Protection: Find and Don't Touch
The main principle: dust is safe as long as it remains untouched. Danger arises when it gets included in a single transaction with your coins. Coin control — manual coin selection — allows you to isolate suspicious outputs. Desktop wallets like Sparrow Wallet and Trezor Suite let you assign labels, freeze UTXOs, and exclude them from automatic selection. Practical rules: label every small incoming transaction as "dust," freeze suspicious outputs, and never combine dust with clean coins in a single payment. For protection against address poisoning — verify the entire address, store the details of regular recipients in an address book, and confirm large sums via a second channel.
Expert Summary
Dust attacks are not just a technical curiosity but a full-fledged threat vector that exploits both user behavioral habits and fundamental features of blockchain architecture. If the graph has already been built and addresses are clustered, simply changing wallets does not help. This requires services capable of breaking on-chain links, such as next-generation mixers that provide coins with a completely clean history. In the current environment, neglecting basic UTXO and address management hygiene is a direct path to capital loss.