The goal of the Bitcoin Dust attack is to expose your identity and assets.
An attacker will send a small amount of crypto to different wallet addresses hoping that the wallet owner will eventually pool or consolidate their UTXOs, including dust, to use in a future transaction.
Once the recipient (you) spends the dust in a transaction, the attacker can connect the dots to associate the dusted address with other addresses you own.
For example, if you inadvertently send the dust to a centralized exchange to cash it out, the attacker could target you with a phishing attack to compromise your account or install malware.
Most dust cannot be spent alone because it is too small and lower than the network fee.
To spend the dust, you need to combine it with other UTXOs, which is exactly what the attacker wants you to do.
How to protect your wallet from Bitcoin dust?
You can’t prevent a dusting attack because anyone can send Bitcoins to any address without censorship.
Here are some proactive measures to protect yourself against a dust attack:
- Before creating a transaction, scan your wallet regularly for dust-sized UTXOs.
- Most wallets have default values dust thresholds which will automatically reject, isolate and freeze UTXOs suspected of dust. Bitcoin Core has a dust limit of 546 satoshi.
- Create a rule in your wallet, if available, that prevents UTXOs below a certain value from being included in a transaction.
- Only use wallets with Coin Control functionality. The wallet owner can choose to include or exclude certain UTXOs from a transaction.
- Use a HD Portfolio to generate a new address every time you receive Bitcoin. Hackers often refine their searches by looking for addresses that have received more than one transaction, which can make you a target.
- The whitelist, if provided by your wallet, defines specific addresses and prevents inadvertently sending crypto to an address you have not previously authorized.
- Do not mix coins from different sources or addresses.
- Practice UTXO management, including a UTXO consolidation strategy.
- Implement good cryptographic operational security. For example, use a VPN to avoid geolocation and log into a website from your browser rather than clicking on a link in an email the website sent you. Accidentally scanning fake QR codes on fake phishing sites or offline in real life is another exploit that hackers target.
- Avoid signing up for free cryptocurrency airdrops, as these sites are often created by the attacker to look like legitimate sites in an attempt to trick you into connecting a wallet or disclosing an address or other personally identifiable information.
- Avoid using vanity addresses that are susceptible to being “poisoned” where the attacker finds your vanity address, creates a similar address to transact with your vanity address, hoping that you will accidentally transact with the fake address instead of your real address at some point in the future. Double-check that you are using the correct address.
As the price of Bitcoin increases and transaction fees rise, dusting attacks become more costly for the attacker. The attacker’s natural reaction is to focus their attention on wallets with higher balances, which should put Bitcoin users on alert.
What should I do if my wallet is dusty?
The proactive actions we suggested in the previous section can help you mitigate a crypto dusting attack.
If you have been dusted, don’t panic and don’t spend bitcoin dust in a transaction.
In fact, don’t even click on the token to prevent any malicious code in a smart contract from activating.
Pro tip: Identify unsolicited dust-sized UTXOs. Freeze UTXOs that you judge as malicious or mark/note as Don’t spend. Archiving UTXO is your safest option and be careful if your wallet offers dust to to exchange the UTXO for another part.
The attacker tricks you into interacting with the dust so that he can trace the transaction, even if it is an exchange, and then analyze future transactions until he finds a vulnerability.
Software wallets, especially browser-based ones, are more frequently attacked by altcoin mining because these wallets are primarily used for Web3, decentralized applications (DApps), and altcoins.
You can use a blockchain explorer to track the transaction if you receive dust. Check your address to see who the sender was. Then, check the sender’s address on the explorer to see how many other dust transactions were created.
Report Dust Attacks to your wallet provider and law enforcement’s cyber division, such as the FBI’s tips for victims of cryptocurrency scams.
Will I lose my Bitcoin if I spend the dust?
Making a transaction with Bitcoin dust will not necessarily allow the hacker to empty your wallet, but it will open the vulnerability that will allow them to deanonymize the wallet and target you with a phishing attack to potentially gain access.
Mining cryptocurrencies with altcoins is more common than minting Bitcoin because it is cheaper and more susceptible to smart contracts that have the ability to access your keys and empty the wallet through blind signing.
Smart contracts are embedded in transactions and most wallets do not display details of the smart contract functions.
The smart contract vulnerability relates to code designed to execute when you link your wallet to a specific website, most often a decentralized exchange, which can execute a set of instructions to empty your wallet.
This happens more frequently with DeFi than with Bitcoin, because it is cheaper to transact and easier to mine.
Risks associated with the promotional dusting of cryptocurrencies
Not all dust is a scam or an attack.
Researchers use dust to collect data. Governments use it to identify criminal activity. Developers use it to test their software. Marketers use dust to promote new projects.
New crypto projects (NFTs and coins) are scattering addresses in a similar way to spamming an email address.
Dust UTXOs can be benign and contain promotional messages or simply intended to entice you to research the project and visit the project website.
You should still not interact (click, transact, exchange) with dust, ever!
How do you know if the site you are visiting is legitimate? What if a hacker created a fake site (or app) and made it rank higher than the legitimate site?
Even if you are sure that the site is legitimate, once you open the site, your IP address may expose city, state, country, latitude, longitude, zip code, time zone, ISP, and other sensitive data.
Now that the marketer or hacker knows your location, if you interact with the dust, you could be doxed and inadvertently reveal your cryptocurrency net worth.
Getting doxed by a powder attack is easier than you think.
Dealing with dust is always a NO!
Personally, accepting airdrops from sites I haven’t verified is always a NO!
There is no free lunch.
Stay vigilant, trust no one and do your own research!
Note: Stratus does NOT provide investment, legal, or tax advice. All information contained in this article is provided for educational purposes and should not be construed as investment, legal, or tax advice. The opinions expressed are those of the author for informational purposes and neither Stratus nor the author are responsible for any errors, inaccuracies, or omissions. Digital assets, such as cryptocurrencies or decentralized finance, present unique risks to investors. For investment, legal, tax, or other financial advice, you should consult your own advisor.
