In 2013–2014 thousands of wallets received 1 satoshi they never asked for. Who was paying to watch them?
Dust attacks do not steal coins. They stain them. A 1-satoshi output is a tracking pixel paid for in bitcoin.
The appearance
A wallet that has never advertised itself receives 1 satoshi, or 546 satoshis, from a stranger. The owner did nothing. If they later consolidate that dust with their real coins, they have just drawn a line on a graph between a covert identity and a public one. That is the whole trick.
Case file sealed
Investigation notes, the reconstruction, and sources sit behind this seal. Open it when you have sat with the raw transaction.
Open the case file
The investigation
-
01 The graph
Bitcoin’s anonymity is the difficulty of clustering addresses. Dust from a known attacker address, later spent in the same transaction as a victim’s real UTXOs, is a free edge in that graph. In 2013–2014, as the first serious chain-analysis firms stood up, dusting campaigns spiked. Some were researchers. Some were advertisers. Some were law-adjacent.
-
02 Why 546
Bitcoin Core refuses to relay outputs below the 'dust' threshold — historically 546 sats for a P2PKH output — because they cost more to spend than they are worth. Attackers who want their stain to propagate use exactly that floor, or they bribe a miner. The 1-sat era was earlier, when policy was kinder to nonsense.
Reconstruction
Not a mystery of motive so much as of method. Dust is a paid, on-chain cookie. The defence is never to spend it: leave the satoshi sitting, or spend it alone, never mixed with coins you care about. Wallet software that auto-consolidates is the attacker’s best friend. The museum keeps a slot for dust because a scanner that only looks at large numbers will miss the smallest crimes.