What is a cryptodusting attack and how do you avoid it?

What is crypto dust?

Cryptodust is small amounts of cryptocurrency sent to a large number of wallet addresses for benevolent or malicious purposes.

Generally, dust is considered the amount of cryptocurrency that is equal to or lower than a transaction fee. Bitcoin, for example, has a dust limit imposed by Bitcoin Core, the Bitcoin blockchain software, of around 546 satoshis (0.00000546 BTC), the smaller denomination of Bitcoin (BTC). Wallet nodes using such a limit may reject transactions equal to or less than 546 satoshis.

Dust can also be the small amount of cryptocurrency that remains after a trade due to rounding errors or transaction fees and can accumulate over time. The small amount cannot be traded, but can be converted to the exchange’s original token.

Cryptodust should not pose a significant threat, as it has mainly been used for legitimate rather than malicious purposes. For example, reaching wallet holders via dusting can be an alternative advertising method to more traditional postal mailings. The dust transactions may contain advertising messages, so dusting is used instead of postal messages.

Despite not being a major concern, crypto users should still know what a dust attack is and take steps to protect themselves should it occur.

What is a cryptodusting attack?

A dust attack occurs when small amounts of crypto-assets, called dust, are sent by malicious actors to multiple wallet addresses – just like dust – spread across blockchain networks.

Blockchain technology is pseudonymous, meaning that owners of a cryptocurrency address are not defined by name or other personal data. However, the blockchain ledger is transparent and traceable; thus, all transactions are visible to everyone, and a user’s activity can be tracked by history to that specific address.

When attackers transfer dust to cryptocurrency wallets, they want to invade the privacy of their owners by tracking their money as they move it from one address to another. The attacker’s goal is not to steal cryptocurrency—since simple dusting won’t allow that—but rather to associate the target’s address with other addresses that could lead to identifying the victim through off-blockchain hacking activity.

A cryptodusting attack can occur in most public blockchains, including Bitcoin, Litecoin, and Dogecoin. A dust attack aims to link the attacked addresses and wallets to the personal data of their related companies or individuals and use this knowledge against their goals, either through elaborate phishing scams, cyber extortion threats, extortion or identity theft to make money.

Are all dust attacks crypto scams?

Not all the cryptodust transferred to the address of a cryptowallet is a scam. Dusting can be used for reasons other than hacking activities.

A dusting technique can be used by authorities to link a specific cryptocurrency address to a person or organization and identify a variety of criminal activities, including money laundering, tax evasion, terrorist threats, etc., or to ensure regulatory compliance and security.

Developers can also use dusting to perform software stress tests, a software testing that stretches beyond the limits to determine the robustness of the software and other features such as transaction processing speed, network scalability, and security protocols. This can help identify potential problems and vulnerabilities in the software, allowing developers to improve performance and security.

Crypto traders tend to receive dust as a result of trades and it is not considered an attack. Many exchanges offer customers the option to exchange these small amounts of cryptocurrency for their original tokens for use in future trades or another cryptocurrency with a low transaction fee.

How does a dust attack work?

Malicious actors rely on the fact that cryptocurrency users do not even realize that they have received small amounts of cryptocurrency in their wallet addresses.

By the way blockchains work, with their transparency and traceability, it is possible to trace transaction movements that can lead to the identification of wallet owners. For a dust attack to be effective, the owner of the wallet must combine the cryptodust with other funds in the same wallet and use it for other transactions.

By including a small amount of cryptocurrency in other transactions, the target of the attack can inadvertently and unknowingly send the dust to a centralized organization outside the blockchain. Since the centralized platform must comply with Know Your Customer (KYC) regulations, it will store the victim’s personal information, which may become vulnerable to phishing, cyber extortion threats, extortion and other targeted blockchain hacks aimed at stealing sensitive information.

The cryptocurrency addresses that are more vulnerable to dust attacks are the UTXO-based addresses used in various blockchains, mainly Bitcoin, Litecoin and Dash, because they all generate a new address for every change left over from transactions. UTXO prevents double spending and is an unused transaction output that remains after a transaction is executed and can be used as input to another transaction.

It’s like the change we receive from a merchant when we spend $9.59, say after giving a $10 bill. Just as that small change can be used in other monetary transactions later, cryptodust from multiple addresses can be used in other transactions. By discovering the origin of funds from the dust attack transaction, the attackers can use advanced technological tools to trace a thread to determine the victim’s identity.

Can Dust Attacks Steal Crypto?

A traditional dust attack cannot be used to access users’ money and steal their crypto assets. However, hackers’ increasingly sophisticated tools can trick wallet holders into phishing websites and draining their money.

A traditional dust attack is used to identify the individuals or groups behind the wallets, de-anonymize them and break their privacy and identity. Such activities cannot directly steal cryptocurrency, but are aimed at discovering the victims’ social activities – traced through the combination of different addresses – in order to then blackmail them, for example.

Over time and with the technology’s new use cases, such as nonfungible tokens (NFT) and decentralized finance (DeFi), attackers have become more sophisticated and have learned to disguise scam tokens as airdrops of free cryptocurrency. The wallet holders can access these appealing free tokens by claiming them from popular NFT projects on phishing sites created by hackers that appear legitimate. Such sites are so similar to the authentic ones that it is difficult for the average cryptocurrency enthusiast to tell them apart.

The phishing sites will not steal usernames and passwords, but will convince the victim to link their wallet to the malicious sites. By allowing these phishing sites to access their wallets, the unwitting victim enables the hacker to move their money and NFT funds into their wallets, and steal crypto using malicious lines of code in smart contracts.

Increasingly, dust attacks are occurring on browser-based wallets such as MetaMask and the Trust wallet, which are primarily used as an escape to decentralized applications (DApps) and Web3 services. Browser-based wallets are particularly vulnerable to dust attacks because they are more accessible to the public and more easily targeted by hackers or fraudsters.

How to identify crypto dust attacks?

A clear indicator of a dust attack in a wallet is the sudden appearance of small amounts of extra cryptocurrency that are not suitable for spending or withdrawal.

The dust attack transaction will appear in a wallet’s transaction history, so it should be easy to check if malicious dust deposits have occurred. In terms of how cryptocurrency exchanges operate and comply with KYC and Anti-Money Laundering (AML) regulations, they will store customers’ data, making them a potential target for cryptocurrency fraud.

In October 2020, Binance suffered a dust attack with small amounts of BNB (BNB) sent to several wallets. When the victim sent the dust in combination with other means, they received a transaction confirmation with a malware link with an offer that would trick the victim into clicking on it and getting hacked without knowing it.

After a dust attack, a cryptocurrency provider, such as an exchange or a wallet, is usually urged to take strict measures to prevent future episodes.

In late 2018, the Samourai Wallet developers warned some of their users that they were experiencing a dust attack and asked them to mark UTXO as “Do not use” to tackle the problem. A real-time dust tracking notification and an easy-to-use feature to mark suspicious funds with a “Do Not Spend” tag were soon implemented by the wallet’s development team to help users better protect their transactions from future attacks.

How to prevent dust attacks?

Although it is unlikely for cryptocurrency users to fall victim to dust episodes, they should still take some steps to protect themselves from such crypto-attacks.

Due to increasingly higher transaction fees, especially on the Bitcoin blockchain, it has become more expensive for a hacker to launch a cryptodusting attack compared to a few years ago. Still, cryptocurrency users should take a few steps to secure their money.

Since dust attacks rely on combining analysis of multiple addresses, if a dust pool is not moved, the attackers cannot trace a transaction that does not happen to make the connections they need to “de-anonymize” the wallets.

Simple measures, including due diligence and education, can go a long way in tackling these attacks. However, more elaborate methods can also be used to protect a wallet’s funds, and here are some of the most effective practices available:

• Use privacy tools like The Onion Router (TOR) or a Virtual Private Network (VPN) to increase anonymity and strengthen security.
• Use a hierarchical deterministic (HD) wallet to automatically create a new address for each new transaction, making it difficult for hackers to trace the thread of your transactions.
• Use dust conversion services that automatically exchange cryptodust into native tokens for use in future trades.

Taking these steps should help users protect their money. Nevertheless, cryptocurrency users should be aware of other cyber threats besides dusting and deanonymization attacks. For example, ransomware is designed to deny a user or organization access to their digital files until a sum of money is paid.

Cryptojacking is a type of cybercrime where a criminal secretly uses a victim’s computing power to mine cryptocurrency. Cryptocurrency can be useful and efficient technology, but can also be at the mercy of malicious actors who primarily work to steal data and value. This is why users should always exercise caution and be aware of the risks when dealing with cryptocurrency.