If you have ever spotted a tiny, random deposit in your wallet, a fraction of a cent of a coin you never bought, you may have been dusted. A dusting attack is a privacy attack: someone sends minuscule amounts of cryptocurrency, called dust, to thousands of wallets at once. The dust itself is worthless and it cannot move your funds. Its purpose is to watch what happens next, because the moment you spend that dust together with your other coins, the attacker learns that several addresses belong to the same person.

The attack works because most blockchains are public. When you make a transaction, your wallet software often combines all available unspent outputs, including the dust, into a single transaction. That combination tells any observer that all the input addresses in that transaction are controlled by one owner. Attackers then cross-reference that cluster with other data, such as exchange records, IP address leaks, or social media posts, to narrow down who owns the wallet. The end goal is usually not the dust itself but what comes after: targeted phishing, extortion attempts, or simply building a profile of a high-value holder.

Dusting is different from address poisoning, and confusing the two leads to wrong responses. Dusting is about privacy: the attacker wants to link your addresses. Address poisoning is about deception: the attacker sends a transaction from a lookalike address so that you later copy the wrong address from your history and send funds to the scammer. Dust cannot steal your money on its own, and dusting transactions do not give anyone control over your wallet. The correct response to dust is to ignore it, not to panic or to rush your funds elsewhere.

The single most important rule is simple: never spend unexpected tiny deposits. Do not consolidate dust with your normal funds, do not try to sell it, and do not interact with any website or link mentioned in a memo attached to the dust transaction. Many wallets let you hide small tokens from your portfolio view, which reduces the chance of touching them by accident. For Bitcoin and similar coins, use wallets with coin control features that let you mark specific outputs as do not spend, freezing the dust so it is never included in future transactions.

Good address hygiene makes dusting far less useful to an attacker. Use a fresh receiving address for each transaction wherever your wallet supports it, especially for Bitcoin, Litecoin, and Dogecoin. Avoid posting your wallet addresses publicly on forums or social media, since dusting campaigns often start from harvested address lists. Keep your main savings in a wallet whose addresses you rarely expose, and use a separate everyday wallet for trading, airdrops, and experiments. If you believe you have been heavily dusted, moving your funds to a brand-new wallet with fresh addresses is a clean reset, as long as you do not carry the dust along with the move.

You cannot prevent dust from arriving, because anyone can send crypto to any public address. What you control is whether the dust ever tells its sender anything useful. Leave it untouched, keep your addresses separated, and treat every unexpected tiny deposit as a tracking attempt rather than free money. Privacy in crypto is mostly a habit, and ignoring dust is one of the easiest habits to build.

If you realise you already spent dust together with your normal funds, do not panic and do not rush to move everything at once. The exposure has already happened, so the useful response is forward-looking: stop reusing the affected addresses, move your remaining funds to fresh addresses in a new wallet, and treat the old address cluster as public knowledge from now on. Going forward, keep your savings addresses separate from your everyday addresses, and enable any coin control or do-not-spend features your wallet offers so the same mistake cannot repeat. One slip does not ruin your privacy permanently, but it does mean the old addresses should be retired.