Dust transactions and dust attacks

The attack is a bet on the common-input heuristic. An adversary sends a tiny amount to a large number of addresses. Each recipient now holds an output they did not ask for. If the recipient later spends that output in the same transaction as coins from a different address, the heuristic links the two addresses, and the attacker has learned that they share an owner. The dust was never meant to be spent for its value; it was meant to be spent for its position in a transaction.

The literature is precise about what counts as success. Loporchio and colleagues define a dust attack as successful when the victim spends the received output together with funds from at least one other address they own. If the output is never spent, or is spent only alongside other funds from the same address, the attack has learned nothing. Their measurement found that transactions likely to be part of dust attacks are a minority of all dust-creating transactions, but that they have a disproportionately large effect on deanonymisation — a small number of outputs doing most of the linking.

The attack is also called forced address reuse, and the name is accurate. The recipient did not choose to receive the dust, and the link it creates is not one they consented to. This is what separates a dust attack from ordinary address reuse: in reuse, the owner published the link themselves; in a dust attack, someone else created it and waited.

The first defence is to leave the dust alone. An output that is never spent cannot link anything, and the attacker's bet fails. This is why wallets increasingly mark suspicious small outputs as unspendable or lock them, so that automatic coin selection cannot pick them up. The limitation is that locking is a wallet-level setting: a restore from seed, a migration to new software, or a change in defaults can unlock the output and expose the user to the original attack.

The second defence is to spend the dust without linking it. A proposal now published as BIP 451 specifies a disposal protocol in which dust outputs are spent to an unspendable OP_RETURN output with the entire value going to fees. Because the output is provably unspendable, it never enters the UTXO set, and because the transaction creates no change, there is no new address to link. The proposal is explicit that dust from different addresses must be disposed of in separate transactions, since consolidating them would achieve exactly what the attacker wanted.

The third defence is the general one: never spend an output you did not expect. Coin control makes that enforceable, because the user chooses the inputs and can see what is being selected. The coin control page covers the mechanism, and the consolidation page covers the related risk of sweeping many small outputs at once.