What Is a Dusting Attack, and How Does It Relate to Post-Scam Exposure?

03 November 2026

A dusting attack is a privacy-breaking technique in which a scammer or tracker sends tiny amounts of cryptocurrency - often called "dust" - to a large number of wallet addresses. After a crypto scam, finding unexpected dust in your wallet usually does not mean you are being scammed again, but it can signal that your address has been linked to other activity, including a previous theft. The dust itself is harmless, but the tracking it enables can expose your remaining holdings and transaction history to bad actors.

What dusting attacks actually do

Dusting attacks are not a method of stealing funds. The attacker sends a negligible amount of crypto - sometimes fractions of a cent - to thousands of addresses. The goal is to "cluster" those addresses by observing where the dust moves next. If the recipient later spends or consolidates the dust along with other coins, the attacker can infer that all those addresses belong to the same person or entity.

This clustering can reveal:

• The total balance across multiple wallets you control
• Patterns in how you move funds
• Connections to exchanges, DeFi protocols, or other services you use

After a scam, your wallet address may already be known to the scammer or posted publicly. A dusting attack on that address is one way an attacker tries to map the rest of your crypto footprint.

How dusting attacks differ from other post-scam threats

It is easy to mistake a dusting attack for a phishing attempt or a new scam. Unlike those, a dusting attack does not:

• Request any action from you
• Contain a malicious link or contract
• Attempt to trick you into sharing keys or seed phrases

The dust just sits in your wallet. The danger is not in the transaction itself but in what the attacker learns if you touch it.

What to Do If You Find Dust in Your Wallet After a Scam

1. Do Not Move the Dust

The single most important step is to leave the dust untouched. If you combine it with other funds in a transaction, you confirm to the attacker that all addresses in that transaction belong to you. That confirmation can be used to target you further or to sell your identity to other scammers.

2. Mark or Hide the Dust

Most wallets allow you to hide small balances or mark specific tokens as spam. This prevents the dust from appearing in your main balance view and reduces the chance you accidentally spend it later.

3. Check Whether the Dust Is a Token Approval Trap

Rarely, what looks like dust may actually be a token that requires you to approve a smart contract before you can interact with it. If you receive an unknown token with a suspicious contract address, do not approve any transaction involving it. Use a block explorer or a token approval checker to see whether the contract has been flagged as malicious. If it has, revoke the approval immediately using a token approval tool - but only after you are certain the tool itself is legitimate.

4. Consider a Fresh Wallet

If you have been dusted after a scam and you are concerned that your wallet address is now widely known, the safest long-term move is to create a new wallet and transfer your remaining funds to it. Before you do that, make sure the new wallet is generated securely and that you never reuse the old address for new transactions.

Does a Dusting Attack Mean the Scammer Is Still Watching You?

Not necessarily. Some dusting attacks are automated and sent to every address that appears in a given block or that holds a certain token. The attacker may not be targeting you personally. However, if you were recently scammed and your address was part of that incident, it is reasonable to assume that your address is on a list somewhere. The dusting attack may be part of a broader data collection effort rather than a direct follow-up to the scam.

Can You Trace the Dust Back to the Attacker?

In theory, yes. The dust transaction is recorded on the blockchain like any other. You can look up the sending address on a block explorer. In practice, the dust is often sent from a freshly created address that has no other history, or from a mixer or exchange that obscures the source. Tracing it rarely leads to useful information, and it is not worth significant time or money to pursue.

Should you report a dusting attack?

Law enforcement and exchanges are generally not interested in dusting attacks because no funds were stolen. If the dust is accompanied by a threatening message or a demand for payment, that is extortion and should be reported as part of your existing scam case. Otherwise, dust alone is a privacy nuisance, not a crime.

How Dusting Attacks Fit Into the Bigger Picture After a Scam

If you have already been scammed, your wallet address may be public knowledge. A dusting attack is one more way that information can be used against you. The practical takeaway is simple: do not interact with unsolicited small transactions, and if your address is compromised, move your remaining funds to a fresh wallet before conducting any new transactions.

Dusting attacks do not recover stolen funds, reverse transactions, or provide evidence that leads to an arrest. They are a reminder that once your address is exposed, your privacy is reduced. The best defense is to compartmentalize your crypto activity and to treat any unexpected inbound transaction with suspicion, even if the amount is too small to matter.

Back to scam recovery