At some point you might notice a deposit in your wallet so small it barely registers, a fraction of a cent of ETH, USDC, or some token you have never heard of, sent by an address you do not recognize. Nothing was signed, nothing was approved, and no popup asked you to click anything. It just appears. This is usually a dusting attack, and while it looks harmless, it is worth understanding what it is actually trying to do.
What counts as dust
Dust is an amount of crypto so small that it is worth close to nothing, often less than the fee it would cost to move it anywhere. On a network with cheap transactions, sending dust to a large number of addresses is inexpensive, which is exactly why the technique exists. Whoever sends it is not trying to make you richer or poorer. They are trying to get something into your wallet's transaction history without needing your permission for anything.
What a dusting attack is trying to achieve
A blockchain like Base is a public ledger. Anyone can see which addresses hold which assets and which addresses have transacted with each other, as covered in our on chain privacy article. A dusting attack tries to turn that visibility into something more specific: a way to link addresses that look separate into a single identity.
The idea works like this. An attacker sends the same small amount, or a batch of matching amounts, to a large number of addresses at once. Then they wait and watch. If you ever combine that dust with other funds in a later transaction, for example by sweeping several balances into one wallet or spending from an address that also holds the dust, the transaction reveals that both addresses are controlled by the same person. Specialized chain analysis tools are built to spot exactly this pattern across thousands of addresses at a time.
Once addresses are linked this way, the next step for an attacker is usually trying to connect that cluster of addresses to a real identity, perhaps through an exchange deposit address, a public social media post, or a leaked email tied to an account. From there, the goal can range from simple profiling to more targeted attacks, including phishing messages aimed specifically at wallets known to hold significant funds, or in rarer and more serious cases, real world targeting of people known to hold crypto.
How dusting differs from other unwanted transfers
Dusting is easy to confuse with two other things that also involve unsolicited transfers showing up in a wallet, but the mechanics and goals are different.
Airdrop scams, covered in our unsolicited tokens article, work by dropping a token into your wallet that is designed to bait you into visiting a fake website or interacting with a malicious contract. The scam only works if you act on it.
Address poisoning, covered separately, plants a fake transaction from a lookalike address into your history, hoping you later copy that address by mistake when sending funds. The scam only works if you copy the wrong address later.
Dusting is quieter than either of these. It does not need you to click, sign, or copy anything. Its entire purpose is observation, not direct theft, which is also why it can be harder to notice and easier to dismiss as unimportant.
What you can actually do about it
You cannot stop dust from arriving. Base, like any public blockchain, lets anyone send a small amount of an asset to any address, and there is no permission step on the receiving end. What you control is what happens after.
Do not interact with the dust. Do not try to swap it, send it, or combine it with your main balance out of curiosity or a desire to tidy up your wallet. Leaving it untouched means it never gets linked to anything else you do.
Be careful about consolidating wallets. If you use more than one address and plan to move funds between them, do it deliberately and be aware that the transaction itself is public. This is one of the more common ways dust ends up correlated with a real balance.
Treat it as a signal, not a threat by itself. A single dust deposit rarely means anything is actively wrong. It is closer to background noise on a public ledger. It becomes worth more caution if it coincides with other signs, such as unexpected contact from someone claiming to be support, as described in our fake support article.
Keep your general privacy habits in mind. Using separate wallets for separate purposes, and being sparing about which addresses you attach to a public identity, limits what any single piece of tracking, dust included, can actually connect.
The short version
A dusting attack sends you a tiny, unsolicited amount of crypto so that an outside party can try to trace and link your addresses together through later transactions, not to trick you into an action or drain your wallet directly. It relies on the same public nature of the blockchain that makes self custody possible in the first place. The response is simple: leave the dust alone, be deliberate about how you move funds between your own addresses, and treat any deposit you did not ask for as something to observe rather than something to use.
This article is educational and not financial or legal advice. If you want a wallet built for one network, with nothing hidden about how a transaction reaches the chain, Simple Base Swap works exactly that way. Start at app.simplebaseswap.com.