Dusting Analysis

What Is Dusting Analysis?

Dusting analysis is a blockchain privacy attack where an adversary sends extremely small amounts of cryptocurrency (called "dust") to a target's wallet addresses, then watches the blockchain to see when and how those tiny outputs are spent. The goal is not theft: it is de-anonymization. By tracing spending patterns, the attacker can cluster addresses into wallets and potentially link them to real-world identities.

The technique works because most wallets use automatic coin selection algorithms that may inadvertently include dust UTXOs as inputs when constructing transactions. When the dust is co-spent with other UTXOs, the attacker gains evidence that all those addresses belong to the same person. This breaks the pseudonymous privacy model that Bitcoin and other UTXO-based blockchains rely on.

How It Works

A dusting analysis attack follows a four-stage cycle, each building on the previous stage to progressively strip away user privacy.

Stage 1: Dust Distribution

The attacker broadcasts transactions sending tiny amounts (typically at or near the dust limit) to hundreds or thousands of target addresses. The cost per output is negligible. In the 2019 Litecoin dusting attack, a single campaign targeted 294,582 addresses.

Stage 2: Waiting for Consolidation

The dust sits in target wallets. The attacker monitors the blockchain, waiting for recipients to spend funds. Most wallet software uses automatic coin selection that may include the dust UTXO as an input when the user constructs a normal transaction.

Stage 3: Common-Input-Ownership Analysis

This is the core analytical step. The common-input-ownership heuristic (CIOH) assumes that all inputs in a single Bitcoin transaction belong to the same entity. When a wallet spends the dust UTXO alongside the user's legitimate UTXOs, signing multiple inputs with the required private keys constitutes proof of control over all those addresses.

Stage 4: Address Clustering

The attacker builds a transaction graph, grouping addresses into wallet clusters. If even one address in the cluster has interacted with a KYC-compliant exchange, a merchant with shipping data, or any service that ties an address to a real-world identity, the attacker can potentially de-anonymize the entire cluster.

Dust Limit Thresholds

Bitcoin Core defines dust using the GetDustThreshold() function in its relay policy. Outputs below these thresholds are considered non-standard and will not be relayed or mined by default nodes. The default dustRelayFee is 3,000 sat/kvB:

SegWit and Taproot outputs have lower thresholds because witness data is discounted by a factor of four (the WITNESS_SCALE_FACTOR), reducing the effective cost to spend them. Attackers calibrate their dust amounts at or just above these thresholds to ensure the outputs are relayed and confirmed.

Who Performs Dusting Analysis

Dusting analysis and the underlying clustering techniques are used by several categories of actors:

• Chain analysis firms such as Chainalysis, Elliptic, and CipherTrace use common-input-ownership heuristics as the backbone of their address attribution. These companies cluster addresses into wallets and map them to known entities, exchanges, and services.
• Law enforcement agencies use blockchain analytics tools (often provided by chain analysis firms) to investigate financial crimes, trace stolen funds, and perform asset recovery.
• Malicious actors use dusting to de-anonymize high-value wallet holders, enabling targeted phishing campaigns, extortion, or social engineering attacks.
• Advertisers and spammers use dust transactions as a cheap distribution channel, sometimes embedding promotional messages in OP_RETURN data attached to the transaction.

Dusting Analysis vs. Dust Spam

Not all unsolicited dust is a surveillance attack. It is important to distinguish between two different phenomena:

Surveillance dusting aims to de-anonymize wallet holders by exploiting the CIOH when recipients spend the dust. The attacker monitors spending behavior over time and links addresses into identity clusters. The 2018 dust attack campaign that targeted approximately 100,000 Bitcoin addresses is the most widely cited example.

Advertising dust, by contrast, is a cheap spam channel. Entities send small amounts to many addresses with promotional messages or URLs embedded in transaction metadata. The 2019 Litecoin dusting campaign was later attributed to a mining pool advertising its services. The intent is visibility, not surveillance.

The fundamental distinction is intent: advertising dust is not designed to track spending behavior, while surveillance dust is specifically crafted to exploit the CIOH when the recipient spends it. Both are unwanted, but surveillance dusting poses the greater privacy risk.

Defenses Against Dusting

Do Not Spend the Dust

The simplest and most effective defense: never spend suspicious dust outputs. The attack only succeeds if the dust UTXO is co-spent with other UTXOs in the same transaction. If the dust remains unspent and isolated, the attacker cannot use it to link addresses.

Coin Control and UTXO Labeling

Privacy-focused wallets such as Sparrow, Wasabi, and Electrum allow users to manually select which UTXOs to include in a transaction using coin control. Users can mark dust UTXOs as "frozen" or "do not spend" to prevent automatic coin selection from including them.

Labeling each UTXO with its source (exchange deposit, payment received, suspicious dust) helps users and automated coin selection algorithms identify and isolate suspicious outputs. Samourai Wallet pioneered this approach in October 2018 by adding real-time dust-tracking alerts and a "Do Not Spend" marking feature.

CoinJoin and Address Hygiene

CoinJoin transactions combine inputs from multiple users into a single transaction, breaking the CIOH by making it impossible to determine which inputs belong to which user. However, CoinJoin does not help if dust is co-spent with known UTXOs before the CoinJoin round.

Avoiding address reuse by using HD wallets that generate a new address for every transaction limits the information an attacker can extract from any single dust deposit.

Network-Level Privacy

Broadcasting transactions over Tor or a VPN prevents IP-to-address correlation that could supplement a dusting attack. Combining network-level privacy with UTXO management creates a stronger overall defense.

Why It Matters

Dusting analysis is one of the most practical threats to Bitcoin privacy because it requires minimal resources from the attacker and exploits default wallet behavior. Unlike more complex taint analysis techniques, dusting actively creates new data points by forcing observable interactions on the blockchain.

As chain analysis capabilities have grown more sophisticated, UTXO management has become an essential skill for any Bitcoin user who values financial privacy. Tools like coin control, UTXO labeling, and thoughtful coin selection are no longer advanced features: they are baseline hygiene. For a deeper exploration of the privacy landscape, see the research article on Bitcoin privacy techniques in 2026.

Layer-2 protocols offer structural advantages against dusting analysis. Because systems like Spark and the Lightning Network move transactions off-chain, they reduce the on-chain footprint available for clustering analysis. Off-chain payments do not create the UTXO co-spending patterns that dusting exploits, limiting the attack surface for surveillance techniques that rely on the CIOH.

Risks and Considerations

UTXO Set Bloat

Large-scale dusting campaigns create thousands of tiny UTXOs that may never be spent. These outputs permanently occupy space in the UTXO set that every full node must maintain, increasing storage and memory requirements for the network. For strategies on managing UTXO overhead, see the research on Bitcoin UTXO management.

False Sense of Security

Users who believe they are immune because they have never been "dusted" may not practice proper UTXO hygiene. Chain analysis firms can apply the same CIOH-based clustering to any on-chain transaction, not just those involving received dust. Dusting merely adds more data points to an already observable ledger.

Rising Fee Environments

When on-chain fees rise (driven by demand from Ordinals, Runes, or general congestion), the economics of dusting attacks shift. Sending dust to hundreds of thousands of addresses becomes significantly more expensive, which reduces the frequency of large-scale campaigns but does not eliminate the underlying analytical techniques that chain analysis firms apply to existing transaction data.

Evolving Defenses

BIP 451 (draft, assigned April 2026) proposes a standardized protocol for safely disposing of dust by spending it to an OP_RETURN output, sending all input value to miner fees. The proposal includes safeguards such as requiring that dust from different addresses never be spent in the same disposal transaction, which would defeat the purpose by linking addresses.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.