What is a dusting attack?

Blockchains are public, so anyone can see that an address received dust. On their own, addresses are pseudonymous and not tied to a name.

The link is made when you spend. If a later transaction draws on the dust at the same time as your own funds — known as input consolidation — that transaction is public proof the same person controls both. The attacker can then cluster your addresses and estimate your total holdings. If any address in that cluster has touched a verified exchange account or a merchant, the cluster can be tied to a real identity.

This is clearest on Bitcoin and other chains that use unspent transaction outputs (UTXOs), but the same pattern-analysis applies to account-based chains such as Ethereum.

To de-anonymize you. Once a wallet is linked to a person and shown to hold a large balance, that person becomes a target for spear-phishing, extortion, or in high-risk regions, physical threats.

To advertise a scam. Dust often arrives as an unknown token with a name, image or memo pointing to a website — "claim your reward", "you have won". The site asks you to connect your wallet and approve a transaction that hands the attacker permission to move your real assets.

To poison your transaction history. The attacker generates an address whose first and last characters match one you have already used, then sends a tiny or zero-value transfer from it. The look-alike address now sits in your history. If you later copy an address from your history rather than from the original source, your funds go to the attacker. This variant, known as address poisoning, causes the largest losses.

Not all dust is hostile. Law enforcement and tax agencies use dusting in investigations, blockchain analytics firms use it for research, and developers use it to stress-test or spam networks. Dust is also used to carry advertising messages. You cannot tell which is which from the transaction alone, so treat all of it the same way.

Crypto held on Kraken sits in Kraken's custody. Dust sent to a Kraken deposit address does not put your account, your balance or your credentials at risk.

• A small unexpected deposit is not a sign that your account has been compromised.
• You do not need to report dust or take any action to secure your account.
• Kraken will never ask you to connect a wallet, claim a token or approve a transaction to release funds.
• Deposits below the minimum deposit amount for that asset will not credit to your account.
• Trading or converting a small balance held on Kraken does not expose your addresses. Any consolidation happens inside Kraken's systems, not on the blockchain.
• Treat any message, email or call that follows a dust deposit as a possible phishing attempt, especially if it references the deposit to establish credibility.

Self-custody is where dusting matters, because you control the addresses and you sign the transactions.

• Leave the dust alone. Do not spend it, swap it or consolidate it with your other funds. Unspent dust cannot be used to link your addresses.
• Mark it "do not spend" if your wallet has coin control. This stops the wallet selecting the dust automatically when it builds a future transaction.
• Do not interact with unknown tokens or NFTs that appear in your wallet — no claiming, swapping, sending or approving.
• Never connect your wallet to a site you reached from a token name, memo, airdrop message or search result.
• Hide spam tokens rather than trying to move or sell them. In Kraken Wallet, use your Token reputation settings to filter out tokens that are not listed or are flagged as spam.
• Verify the full address every time you send. Check the entire string, not just the first and last few characters, and copy it from the original source — never from your transaction history.
• Use a fresh receiving address for each transaction. Hierarchical deterministic (HD) wallets do this automatically, which spreads your holdings across many addresses and makes clustering harder. Consider keeping separate wallets for long-term holdings and day-to-day activity.
• Never share your Secret Recovery Phrase. No legitimate claim, refund or support process requires it. Kraken will never ask you for it.

For most people, dust is a nuisance rather than a threat. De-anonymization is mainly a risk if you hold a large balance in self-custody, or live somewhere personal safety or political instability is a concern.

Address poisoning is different. It does not depend on the size of your balance, and it works on anyone who copies an address from their transaction history. Verify the full address on every send.

Receiving crypto gives the sender no control over your wallet. Nobody can move your funds by sending you a transaction. Losses happen only when you sign something, approve a token allowance, or send funds to an address you did not verify.

• Stop making transactions from the affected wallet.
• Revoke any token approvals you granted to the site or contract.
• If you entered or exported your Secret Recovery Phrase anywhere, move your remaining assets to a new wallet created with a new Secret Recovery Phrase.
• Report it to Kraken using the links below.

• Protect yourself from scams
• How do I report a phishing incident?
• Securing your Kraken account and digital life
• Show or hide tokens based on reputation (Kraken Wallet)
• Backing up and securing your Kraken Wallet
• Kraken Wallet frequently asked questions
• Cryptocurrency deposit is missing