A Bitcoin dust attack uses unsolicited small outputs to observe possible links in later spending. Receiving one does not authorise its sender to spend your other funds. The main issue is privacy, not code automatically running when the payment arrives.
Small does not automatically mean malicious
Change, test payments and rewards can create legitimate small outputs. Technical dust thresholds also depend on relay policy and output type; there is no single universal amount for every script. Size alone cannot establish the sender’s intentions or prove an attack.
A cautious example
If an unexpected payment of a few hundred satoshis appears, record the transaction and investigate its origin. Where coin control and output freezing are supported, prevent automatic selection. Hiding a label or asset in the interface is not necessarily a spending restriction. Check what the wallet actually does.
Further reading: related technical explainer.
Why moving everything can make privacy worse
Spending previously separate outputs together can suggest common control. An immediate transfer of the entire balance may include the suspicious output itself. A fresh destination address does not erase that connection. Recheck input selection and labels during later migrations as well.
Further reading: connected operating guide.
Do not confuse Bitcoin with token spam
On other networks, unwanted tokens or NFTs can advertise phishing sites. Do not open supposed refund links or sign requests to remove an alleged threat. Receiving a Bitcoin UTXO and signing a transaction that grants a contract powers are different mechanisms.
Further reading: security checklist.
Useful records, private secrets
Keep the hash, amount, date and source notes. Never give an analyst recovery phrases or private keys; extended public keys also reveal sensitive information. Match the response to the actual threat. Isolating an output and checking spending can be more appropriate than rushing to move all holdings.
An explorer is not proof of identity
A transaction hash reveals outputs and their history, not automatically the person behind them. Third-party labels may be incomplete or wrong. Separate observable evidence from interpretation: the amount and transaction are facts, while the sender’s intention needs additional evidence.
Output freezing can be local
A freeze setting in your app does not alter the blockchain and may not carry over when restoring into another wallet. Records of outputs you intend not to spend are therefore operationally important. After migration or an update, check that automatic selection still respects the intended restriction.
Do not pay to make dust disappear
Treat requests for an external payment to unlock the wallet with particular caution. The sender gains no power over the rest of the balance simply by making a small deposit. Do not turn a privacy concern into a transfer to a stranger or a signature you do not understand.
Practical checks
- assuming every small payment proves a hack.
- clicking a memo, token page or support link.
- sweeping all coins without coin control.
- sharing an xpub or seed with an alleged analyst.
- forgetting the frozen output during a later wallet migration.
