Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. Take 2 minutes to learn more.

What is a dusting attack?

"Dust" is a tiny amount of crypto, usually worth less than the network fee needed to spend it. A dusting attack is when someone sends dust to thousands of addresses at once, then watches the blockchain to see what those addresses do next.

Receiving dust does not give anyone access to your funds. The risk comes from what you do afterwards.

How the tracking works

Blockchains are public, so anyone can see that an address received dust. On their own, addresses are pseudonymous and not tied to a name.

The link is made when you spend. If a later transaction draws on the dust at the same time as your own funds — known as input consolidation — that transaction is public proof the same person controls both. The attacker can then cluster your addresses and estimate your total holdings. If any address in that cluster has touched a verified exchange account or a merchant, the cluster can be tied to a real identity.

This is clearest on Bitcoin and other chains that use unspent transaction outputs (UTXOs), but the same pattern-analysis applies to account-based chains such as Ethereum.

Why attackers send dust

To de-anonymize you. Once a wallet is linked to a person and shown to hold a large balance, that person becomes a target for spear-phishing, extortion, or in high-risk regions, physical threats.

To advertise a scam. Dust often arrives as an unknown token with a name, image or memo pointing to a website — "claim your reward", "you have won". The site asks you to connect your wallet and approve a transaction that hands the attacker permission to move your real assets.

To poison your transaction history. The attacker sends a tiny or zero-value transfer from a look-alike of an address you use, hoping you copy it later. This variant, known as address poisoning, causes the largest losses. See How address poisoning works.

Not all dust is hostile. Law enforcement and tax agencies use dusting in investigations, blockchain analytics firms use it for research, and developers use it to stress-test or spam networks. Dust is also used to carry advertising messages. You cannot tell which is which from the transaction alone, so treat all of it the same way.

How address poisoning works

  1. The scammer watches public blockchain activity and spots an address you send to regularly.
  2. They create an address that starts and ends with the same characters as yours. Most wallets and apps only show the start and end of an address, so the two look identical.
  3. They send a tiny amount, a zero-value transfer, or a fake token from that address, so it appears in your transaction history.
  4. Next time you send, you copy the address from your history and your crypto goes to the scammer.

This is especially common with stablecoins such as USDT and USDC. Some malware does something similar: it swaps an address you've copied for the scammer's when you paste it. See Beware of computer malware.

If you hold crypto on Kraken

Crypto held on Kraken sits in Kraken's custody. Dust sent to a Kraken deposit address does not put your account, your balance or your credentials at risk.

  • A small unexpected deposit is not a sign that your account has been compromised.
  • You do not need to report dust or take any action to secure your account.
  • Deposits below the minimum deposit amount for that asset will not credit to your account.
  • Trading or converting a small balance held on Kraken does not expose your addresses. Any consolidation happens inside Kraken's systems, not on the blockchain.
  • Treat any message, email or call that follows a dust deposit as a possible phishing attempt, especially if it references the deposit to establish credibility.
  • Check where you're withdrawing to. Address poisoning can still catch you when you withdraw from Kraken. Copy the destination address from its original source, not from a wallet's transaction history, and check the whole address. Save addresses you use regularly to your withdrawal addresses once you've checked them. See Adding and confirming a new cryptocurrency withdrawal address.

If you use Kraken Wallet or another self-custody wallet

Self-custody is where dusting matters, because you control the addresses and you sign the transactions.

  • Leave the dust alone. Do not spend it, swap it or consolidate it with your other funds. Unspent dust cannot be used to link your addresses.
  • Mark it "do not spend" if your wallet has coin control. This stops the wallet selecting the dust automatically when it builds a future transaction.
  • Do not interact with unknown tokens or NFTs that appear in your wallet — no claiming, swapping, sending or approving.
  • Never connect your wallet to a site you reached from a token name, memo, airdrop message or search result.
  • Hide spam tokens rather than trying to move or sell them. In Kraken Wallet, use your Token reputation settings to filter out tokens that are not listed or are flagged as spam.
  • Verify the full address every time you send. Check the entire string, not just the first and last few characters, and copy it from the original source — never from your transaction history.
  • Treat test transactions with care. A small test can itself trigger poisoning. Once the test arrives, still copy the address from the original source, not from your history.
  • Use a fresh receiving address for each transaction. Hierarchical deterministic (HD) wallets do this automatically, which spreads your holdings across many addresses and makes clustering harder. Consider keeping separate wallets for long-term holdings and day-to-day activity.
  • Never share your seed phrase (also called a recovery phrase). No legitimate claim, refund or support process requires it. Kraken will never ask you for it.

Kraken will never ask you to

  • Share your username, password, 2FA codes or Master Key.
  • Share or forward a device approval email, or the link inside it.
  • Share your seed phrase (also called a recovery phrase), for any wallet.
  • Remove or change your 2FA, Master Key or Global Settings Lock (GSL), unless you contacted us first for help with it through our official channels.
  • Install remote access software such as AnyDesk or TeamViewer. See Risks of remote access software.
  • Send crypto, or move your funds to a “safe” or “secure” wallet or address.
  • Send a payment to release, unfreeze or “verify” your funds.

Should you be concerned?

For most people, dust is a nuisance rather than a threat. De-anonymization is mainly a risk if you hold a large balance in self-custody, or live somewhere where personal safety or political instability is a concern.

Address poisoning is different. It does not depend on the size of your balance, and it works on anyone who copies an address from their transaction history. Verify the full address on every send.

What dust cannot do

Receiving crypto gives the sender no control over your wallet. Nobody can move your funds by sending you a transaction. Losses happen only when you sign something, approve a token allowance, or send funds to an address you did not verify.

If you think you have interacted with a malicious token

  • Stop making transactions from the affected wallet.
  • Revoke any token approvals you granted to the site or contract.
  • If you entered or exported your seed phrase anywhere, move your remaining assets to a new wallet created with a new seed phrase.
  • Report the scam. If someone may have access to your Kraken account, contact Kraken Support straight away using this form and answer the questions truthfully and as fully as you can.

If you've sent crypto to the wrong address

Blockchain transactions can't be reversed, and Kraken can't recover crypto sent to an address it doesn't control. Report the scam, and report it to the authorities (see Protect yourself from scams). Be wary of anyone who offers to get it back.

Additional reading