Dust Attack

A dust attack is a privacy-degradation tactic where an adversary sends tiny amounts of BTC (dust) to many addresses they want to track. When the recipient eventually consolidates those dust outputs with other coins in a transaction, the adversary can link all the inputs together as belonging to the same wallet. The Bitcoin Wiki files the tactic under forced address reuse and says it "is sometimes incorrectly called a dust attack": the crumb is a forced payment to an address you already used, and the damage is the address reuse it coerces, not the dust itself. The popular name stuck anyway, so this entry uses both.

How the attack works:

1. The attacker sends a few hundred sats, just above the dust limit, to thousands of addresses that have already appeared on the chain and look interesting (from chain analysis, leaked databases, etc.).
2. Some recipients ignore the dust; some don't notice; some intentionally sweep it up later thinking it's "free money."
3. Whenever the recipient signs a transaction that includes the dust as one of the inputs, the wallet has effectively declared "these inputs belong to the same entity." Chain analysis algorithms cluster the inputs into a single owner's wallet.
4. The attacker now knows the cluster's other addresses, can track its activity, and potentially identify the real-world owner.

The precondition is easy to miss: the attack only works against an address that has already been used. The payoff only comes if you spend the crumb alongside coins the address was not yet linked to. Your unused addresses cannot be targeted at all, which is one more reason to hand out a fresh one for every payment.

Modern defenses:

• Coin control. Bitcoin Core and most serious self-custody wallets let users select which UTXOs to spend. Excluding suspicious dust from a transaction preserves the privacy boundary.
• UTXO labels and freezing. Some wallets automatically flag small payments that land on addresses you have already used, and most self-custody wallets let you freeze such a UTXO so it is never spent.
• The split rule. What to do depends on where the crumb landed, and the Wiki splits it in two. On an address you already emptied: never spend it. Lock it (Bitcoin Core's lockunspent gained a persistent option in PR #23065, merged 2021 and shipped in 23.0 in 2022, so the lock survives a restart), freeze it, forget it; it is worth little more than the fee anyway. On an address that still holds your coins: the next time you spend from that address, spend everything on it together, crumb included, in one transaction with no inputs from elsewhere. The crumb then adds no link the address did not already carry. Core's -avoidpartialspends grouping does exactly this, and has been on by default whenever it costs no extra fee since 0.21.0 (2021).
• Or burn it. If you want it gone, a crumb can be spent by itself, entirely to fees, so it never shares a transaction with your other coins.
• Core's built-in answer. Bitcoin Core 0.19.0.1 (2019) added the avoid_reuse wallet flag. The wallet marks every address it has spent from and skips any coins paid to those addresses afterwards, because, in the words of the pull request, "a payer could otherwise begin tracking a payee's wallet by regularly peppering a known UTXO with dust outputs". It is off by default: set it when you create a wallet (createwallet, avoid_reuse) or later with setwalletflag, and listunspent will then mark such coins reused.

The attack is old and keeps coming back. The defense isn't difficult once you know to look; the attack succeeds against users who don't.

For ordinary users: don't sweep random small UTXOs into your main wallet. If you didn't send it to yourself or recognize the source, treat it as a tracking attempt, and if it landed on an address that still holds your coins, apply the split rule above.