Bitcoin Dust Attack Detection Guide

What Is a Bitcoin Dust Attack?

A Bitcoin dust attack is a privacy exploitation technique where an attacker sends tiny, unsolicited amounts of BTC to a large number of addresses. The amounts are deliberately small: often just a few hundred satoshis, right at or near the dust limit. The goal is not to steal funds. The attacker is waiting for you to spend the dust.

When your wallet automatically includes a dust UTXO as an input alongside your other coins in a future transaction, the attacker can observe that co-spending on the public blockchain. Using the common input ownership heuristic (CIOH), they link all the addresses used in that transaction to a single entity: you. Combined with off-chain intelligence such as exchange KYC records, this can de-anonymize your entire wallet.

How Address Clustering Works

The address clustering technique behind dust attacks is well-documented in academic research dating back to Reid and Harrigan's 2013 work on Bitcoin transaction graphs. The core assumption is simple: inputs spent together in the same transaction are controlled by the same party. When an attacker sends dust to one of your addresses and you later co-spend it with coins from other addresses, those addresses merge into a single cluster in the attacker's analysis.

Chain analysis firms use this heuristic at scale, combining it with change-output detection and wallet fingerprinting to build comprehensive ownership graphs. A single dust spend can expose addresses that were otherwise unlinkable. For a deeper look at these techniques and their countermeasures, see our research on Bitcoin transaction graph privacy defenses.

Protocol Dust vs. Economic Dust

Two distinct definitions of "dust" matter for detection. Protocol dust is defined by Bitcoin Core's relay policy: outputs below a fixed threshold that standard nodes refuse to propagate. Economic dust is any output that costs more in fees to spend than it is worth, a moving target that depends on the current fee rate.

Bitcoin Core computes the protocol dust limit at a fixed dust relay fee rate of 3 sat/vB. This is a relay policy, not a consensus rule: miners can still include dust outputs in blocks even though standard nodes will not propagate transactions that create them. For exact thresholds by output type, see our Bitcoin dust thresholds reference.

Economic dust shifts with the fee market. An output worth 1,000 sats is spendable at 2 sat/vB but becomes a stranded UTXO at 20 sat/vB or above. Dust attacks exploit this gap: the attacker sends amounts that pass the protocol threshold but are economically painful to spend, making the victim more likely to ignore them and eventually co-spend them without thinking.

How to Identify Dust in Your Wallet

Dust attack detection starts with recognizing unsolicited small deposits. The following signs indicate a potential dust attack:

• A small incoming transaction (typically under 1,000 sats) that you did not initiate or expect
• The sender address has broadcast identical amounts to hundreds or thousands of other addresses
• The amount sits near the protocol dust limit for your address type (546 sats for P2PKH, 294 sats for P2WPKH, 330 sats for P2TR)
• The transaction has no OP_RETURN message or other identifying payload
• Your wallet did not generate the receiving address as part of its normal gap limit sequence

In wallets with a UTXO view (such as Sparrow, Electrum, or Bitcoin Core), sort your unspent outputs by value. Any output below 1,000 sats that you cannot trace to a known source is suspicious. Use a block explorer to check the sender: if the same address has broadcast hundreds of near-identical transactions, it is almost certainly a dust campaign.

Wallet-Specific Detection Methods

Different wallets expose UTXO-level detail in different ways. The following table summarizes coin control and dust detection features across popular Bitcoin wallets.

If your wallet lacks coin control features, consider importing your keys into Sparrow or Electrum for UTXO-level inspection. For a detailed feature comparison, see our Bitcoin wallet coin control comparison.

The Privacy Risk: What Happens When You Spend Dust

The danger of a dust attack is entirely in the spending. If you never spend the dust, the attacker learns nothing beyond the fact that you control that one address, which they already knew from the blockchain. The privacy damage occurs in a specific sequence:

1. The attacker sends 546 sats to your address 1A. They record this transaction.
2. Later, your wallet builds a transaction using the dust UTXO from 1A plus a larger UTXO from your address 3B as inputs, sending payment to a recipient and change to address bc1q...C.
3. The attacker now knows that 1A, 3B, and bc1q...C are all controlled by the same entity, because the CIOH assumes that all inputs to a transaction share a single owner.
4. If any of those addresses is linked to your identity through exchange withdrawals, KYC records, or public payment requests, all three are now de-anonymized.

This is why address reuse and poor UTXO management compound the risk. Each additional address the attacker can link expands the cluster, potentially revealing your total balance and transaction history. For more on Bitcoin privacy techniques, see our Bitcoin privacy landscape analysis.

Decision Flowchart: How to Handle Suspicious Dust

When you spot an unsolicited small deposit, follow this decision process:

1. Check the amount. Is it below 1,000 sats and unexpected? If no, it is likely a normal payment: no action needed.
2. Inspect the sender. Did the same address send identical amounts to many recipients? If yes, proceed to step 3. If no, it may be a legitimate micro-payment or tip: label it and monitor.
3. Freeze the UTXO immediately. Use your wallet's coin control feature to mark it as frozen or locked. This prevents automatic spending.
4. Assess your privacy posture. Have you used the dusted address with a KYC exchange or public payment request? If yes, the address is already partially de-anonymized: the dust adds marginal risk. If no, the dust is the primary threat vector.
5. Choose a mitigation strategy. See the next section for options ranked by effectiveness.

Mitigation Strategies

There are four primary approaches to neutralizing dust. The right choice depends on your threat model, the number of affected UTXOs, and the fees you are willing to pay.

1. Freeze and Ignore

The simplest and most cost-effective approach: freeze the dust UTXO so your wallet never selects it as a transaction input. The dust remains in your wallet balance but cannot be co-spent. This is the default recommendation for most users because it costs nothing, has no on-chain footprint, and fully prevents the clustering attack. The only downside is that you permanently lose access to the dust amount, though at 294 to 546 sats, the value is negligible.

2. UTXO Freezing with Coin Control

A more active version of the same approach. Rather than freezing just the dust, review all your UTXOs and manually select inputs for every outgoing transaction. This prevents accidental co-spending even if you later unfreeze the dust. Sparrow and Electrum both support full coin control, letting you choose exactly which outputs fund each transaction. In Bitcoin Core, the lockunspent RPC command locks specific outputs, and since version 23.0 the lock persists across restarts.

3. Sweep to Fees

Build a transaction where the dust UTXO is the only input and the entire value goes to the miner fee, producing no output. This destroys the dust on-chain so it can never be co-spent. The cost is the dust amount itself (a few hundred sats) plus the transaction fee. This approach is overkill for most users but can be appropriate if you want to remove the dust from your UTXO set entirely.

4. Consolidation via CoinJoin

If you have many small UTXOs including dust, a CoinJoin transaction can consolidate them while breaking the link between inputs and outputs. The dust gets merged into a larger output with uniform denominations, disrupting the attacker's clustering. This is the most privacy-preserving option but also the most expensive: CoinJoin coordination fees plus the on-chain transaction cost can easily exceed the value of the dust being handled. It is best suited for users who are already running a CoinJoin workflow for other reasons.

Notable Dust Attack Campaigns

Dust attacks are not theoretical. Several large-scale campaigns have been documented:

• In August 2019, Binance identified a dusting campaign targeting Litecoin users. A single sender broadcast 0.00000546 LTC to approximately 300,000 addresses. The sender was later identified as a Russian mining pool operator who claimed the purpose was advertising, though the technique could equally serve surveillance
• In late 2018, thousands of Bitcoin wallet owners received unsolicited deposits of exactly 888 satoshis. The campaign was later attributed to BestMixer, a cryptocurrency mixing service, which used the dust transactions as an advertising vector
• Samourai Wallet issued a public warning in October 2018 about a large-scale dusting attack targeting Bitcoin wallets. The wallet subsequently introduced its "Do Not Spend" feature, allowing users to flag suspicious UTXOs

These campaigns targeted hundreds of thousands of addresses at a cost of only a few dollars in transaction fees, demonstrating how cheaply an attacker can attempt mass dusting analysis.

Preventing Future Dust Attacks

While you cannot prevent someone from sending BTC to your address, you can minimize the impact:

• Use a wallet with full coin control and UTXO labeling (Sparrow, Electrum, or Bitcoin Core)
• Enable address rotation and never reuse addresses: each transaction should use a fresh receiving address
• Label every incoming UTXO with its source so you can identify unexpected deposits immediately
• Consider using Layer 2 solutions for regular payments: protocols like Spark operate off-chain, so your on-chain UTXO set stays minimal and less exposed to dusting
• Review your UTXO set periodically and freeze any suspicious small deposits before your wallet selects them for spending

For a comprehensive guide to UTXO management beyond dust defense, see our research on Bitcoin coin control and UTXO privacy.

Dust Consolidation Timing

If you have accumulated multiple small UTXOs (whether from dust attacks or normal usage), consolidating them during low-fee periods can prevent them from becoming stranded UTXOs when fees spike. The tradeoff is privacy: consolidation links addresses together, similar to what a dust attacker hopes to achieve. The key difference is that you control the timing and can use privacy tools like CoinJoin or PayJoin during consolidation.

Use our dust calculator to determine which of your UTXOs are economically spendable at current fee rates, and see our research on dust UTXO consolidation timing for strategies on when to consolidate.

Frequently Asked Questions

Can a dust attack steal my Bitcoin?

No. A dust attack cannot move your funds, access your private keys, or compromise your wallet security. The sole purpose is privacy de-anonymization through address clustering. The attacker sends you a few hundred satoshis and waits for you to spend them alongside your other UTXOs, which reveals address ownership links on the public blockchain.

How small does a transaction need to be to qualify as dust?

Bitcoin Core's protocol dust limit depends on the output type: 546 sats for P2PKH, 294 sats for P2WPKH, and 330 sats for P2TR (Taproot). However, dust attacks often send amounts slightly above these limits to ensure the transaction is relayed by nodes. Economic dust is higher and depends on the current fee rate: at 50 sat/vB, a P2WPKH input costs approximately 3,400 sats to spend. Any unsolicited deposit under a few thousand sats should be treated as potentially suspicious.

What should I do if I already spent dust by accident?

If your wallet has already co-spent a dust UTXO with other inputs, the clustering damage is done for that specific transaction. The attacker can now link all addresses used as inputs. Going forward, stop using the affected addresses, generate fresh receiving addresses, and consider moving funds to a new wallet with proper coin control. A CoinJoin transaction can help break the link for future activity, though it cannot undo the on-chain record of the co-spend.

Do hardware wallets protect against dust attacks?

Hardware wallets like Ledger and Trezor protect your private keys but do not inherently protect against dust attacks. Their companion software (Ledger Live, Trezor Suite) currently lacks coin control features, meaning they may automatically include dust UTXOs when building transactions. For dust defense, pair your hardware wallet with Sparrow or Electrum, which support full coin control while using the hardware device for signing.

Are dust attacks illegal?

Sending small amounts of cryptocurrency to publicly visible addresses is not inherently illegal. However, using dust attacks for stalking, harassment, or as part of a broader surveillance or fraud scheme could violate privacy laws or anti-stalking statutes depending on the jurisdiction. Chain analysis firms routinely perform similar clustering techniques for compliance purposes under regulatory mandates, which occupies a legally distinct category.

How much does it cost an attacker to launch a dust attack?

Very little. Sending 546 sats to one address costs the dust amount plus a transaction fee of a few hundred sats at low fee rates. An attacker can batch hundreds of dust outputs into a single transaction, reducing the marginal cost to under 50 sats per target. The 2019 Litecoin campaign that hit roughly 300,000 addresses cost the attacker only a few dollars in total fees, making dust attacks one of the cheapest privacy exploits available.

Does using a Layer 2 like Lightning or Spark prevent dust attacks?

Layer 2 protocols significantly reduce exposure to dust attacks because most activity happens off-chain. On the Lightning Network, payments route through channels without creating individual on-chain UTXOs. On Spark, users hold virtual transaction outputs (VTXOs) that are managed off-chain, keeping the on-chain footprint minimal. However, channel open and close transactions still create on-chain UTXOs that could be targeted, so on-chain hygiene remains important even for Layer 2 users.

This guide is for informational purposes only and does not constitute financial or security advice. Privacy techniques and wallet features change frequently. Always verify current wallet capabilities and dust thresholds before acting on the information presented here.