Why You Should Be Aware of Privacy-Disrupting Dusting Attacks on Public Blockchains

Bitcoin is not really anonymous, as many users have discovered since delving deeper into the cryptocurrency world. The initial expectation with Bitcoin is that it offers anonymity and as such will be a preferred transaction channel for criminal activity. However, Bitcoin is solely pseudonymous, which means that users’ transactions are publicly visible on the blockchain but are not directly mapped to one’s identity. This may be safe enough for many to maintain their privacy, but unfortunately for others, it is not.

Bitcoin Transactions are Traceable

With the emergence of blockchain analysis tools, it is becoming easier to track addresses, transactions, and identify potential persons behind certain accounts. In order to map accounts to real-life identities, it is necessary only to trace transactions to and from a group of addresses. Through association and transitivity, it would be possible to identify someone’s Bitcoin address. This is nothing new and has always been the case with Bitcoin and other public blockchains, but with the increase in users that are less tech-savvy, this becomes a potential attack vector. The method used by attackers, in this case, is called a ‘dusting attack.’ Dusting attacks happen when someone sends a few satoshis to various addresses. The amount that is sent is so insignificant that it is called dust. Usually, users will not notice insignificant amounts and will continue their usual spending.

“I just received 0.00000546 BTC, where did it come from and do I need to be worried?”

If you’ve received a small amount of BTC and aren’t sure where it came from, you may be a victim of a dusting attack. Learn how they may affect you. @BinanceAcademy https://t.co/KNVoQLwBUb

— Binance (@binance) February 9, 2019

The potential for an attack appears when users spend that dust in various places as part of other larger payments. Attackers can then trace that ‘dust’ and are able to inspect the transactions within the blockchain. By assimilating collected data from transactions of multiple addresses, the attackers can link these addresses to the source and who it belongs to, whether it be individuals or companies. The low amount of satoshis acts as breadcrumbs to paint a path of funds that the attacker can always monitor. As a result identified users are exposed to various phishing attacks, ransomware and targeted hacking.

Should Users Dust Bitcoin?

If Bitcoin can be de-anonymized, has the digital currency failed to fulfill its purpose? Not at all, in fact, it only confirms how transparent Bitcoin really is. The purpose of Bitcoin is to offer a censorship-resistant ledger for value transfers. The dust attack vector is actually a side-effect of the means necessary for Bitcoin to achieve social consensus on a global scale. This also shows that malicious actors will always exist and look for methods to exploit vulnerabilities, both on the ledger and the user side. Finally, this highlights how far Bitcoin has come, confirming its status as a digital currency, but also signaling that attacks on this level might increase along with Bitcoin’s rise in popularity.

How to Prevent Dust Attacks

Thankfully, every potential attack can be countered. Though it might seem like the user has no control over the specific coins being sent during a payment, there are already wallet services that can counter these specific dusting attacks. Users who receive the dust will not be at risk of having their privacy disrupted as long as the received funds are not spent in the process. Some wallet services spot these small amounts and label them, bringing it to the user’s attention not to spend them. However, since this is an attack at the user level, it also requires users to be aware of these potential attacks. Just like users are responsible for their private key to their Bitcoin address, they are also responsible for keeping their account from becoming compromised. The counter to dusting attacks could become a staple feature for all wallet services, but at the moment it is essential that users are aware of dusting attacks and take precautionary measures when they spot suspicious transfers into their account. Have you heard about dusting attacks? Have you been the recipient of a small amount of BTC which seemed to come from an unknown source? Share your stories in the comments below!