44.18 $
+0.18% +0.08 $
44.18 $
+0.18% +0.08 $
Tiny unsolicited deposits in your Litecoin wallet are usually dusting or address poisoning. Neither can steal funds by itself. How both attacks work, and the simple habits that make them useless.
Use Litecoin long enough and eventually your wallet will show a deposit you never asked for. A few hundred litoshis, worth a fraction of a cent, from an address you have never seen. It isn't a gift and it isn't a bug. Odds are it's one of two cheap, automated attacks: dusting or address poisoning. The two get lumped together because both arrive as unsolicited micro-transactions, but they want different things from you, and the defenses aren't identical.
Some good news before anything else: neither attack can take a single litoshi on its own. Both need you to make a mistake later. That turns this from an emergency into a hygiene problem, and hygiene problems can be fixed in an afternoon.
Dust is any coin fragment too small to be worth spending, because the fee to move it rivals or exceeds its value. On Litecoin that usually means a few hundred litoshis, a litoshi being one hundred-millionth of an LTC. A dusting attacker scripts thousands of these tiny payments to a huge set of addresses, then sits back and watches the chain.
The main prize is deanonymization. Litecoin, like Bitcoin, tracks money as unspent transaction outputs, or UTXOs. When you send a payment, your wallet gathers several UTXOs as inputs, and chain-analysis firms apply the common-input-ownership heuristic: inputs spent together are assumed to belong to the same owner. Dust is a tracking beacon built on that assumption. If your wallet later sweeps the dust into a payment along with your other coins, the attacker can link the dusted address to every address that co-signed the spend, and often onward to an exchange account with your name on it. You didn't leak anything by receiving the dust. You leaked it by spending it.
There are two lesser motives. Some dust is spam, with a message or domain name stuffed into the transaction as a crude billboard. And some is a prelude to phishing: the attacker dusts you, waits, then contacts you posing as support for the mysterious deposit. The deposit is bait for the conversation, not the theft itself.
This isn't hypothetical for Litecoin. In August 2019 a single campaign sprayed 0.00000546 LTC across a very large slice of the network, with analysts at the time putting the count in the neighborhood of 300,000 addresses, and Binance publicly warning its customers about it. The party behind it later claimed it was advertising a mining service rather than running surveillance. Maybe so. The mechanics are identical either way, and nobody dusting you owes you an honest account of their motives.
Nothing dramatic. The dust can't execute code, can't see your balance, and has no path to your keys. The one thing it can do is ride along the next time your wallet builds a transaction, so your job is to stop that ride.
Use coin control. In Litecoin Core, enable coin control features in the wallet options, then lock the dust UTXO so the wallet never selects it as an input. In Electrum-LTC, open the Coins tab and freeze the output with a right click. Frozen dust just sits there, inert, indefinitely. Beyond that: don't visit any link or domain embedded in the transaction, don't respond to anyone who contacts you about the deposit, and don't send the dust back, since sending is exactly the action the attacker is fishing for.
Dusting wants information. Address poisoning wants a payday, and it gets one by exploiting how people actually read crypto addresses, which is to say barely.
The attacker watches the chain for a pair of addresses that transact repeatedly, say your wallet and an exchange deposit address. Then they grind out a vanity address matching the real destination at the start and the end. This is brute force, not broken cryptography: generate keypairs by the billion and keep the one whose address happens to share the right characters. Each extra matched character multiplies the work, roughly 58-fold for legacy addresses and 32-fold for lowercase ltc1 ones, so matching four or five characters at each end is practical on rented GPUs while matching an entire address is far out of reach. The middle of the lookalike is always different. That detail is the whole defense, so hold onto it.
The attacker sends you a tiny transfer from the lookalike. On Litecoin the poison has to carry real value, since node relay policy rejects zero-value payments to ordinary addresses as dust, but a few hundred litoshis is nothing to a thief hoping to redirect an entire withdrawal. Sometimes the amount even echoes your usual payments to look plausible. Now the fake sits in your transaction history, first and last characters matching the address you actually use. Weeks later you need to pay that counterparty again, you copy the address from history because it's convenient, your eyes confirm the familiar ends, and the funds go to the attacker. Final, irreversible, and entirely dependent on one lazy copy-paste.
Worth covering because it defeats people who think they're being careful. Clipboard hijackers are malware that monitors your clipboard for anything shaped like a crypto address and silently substitutes the attacker's own. You copy the correct address from the correct source, you paste, and the pasted string is wrong. No blockchain trickery involved, just a compromised computer.
The countermeasures overlap neatly with the poisoning defenses. Re-read the address after pasting, including the middle. Scan a QR code where possible, since it skips the clipboard entirely. And a hardware wallet screen shows the true destination at signing time, which catches the swap at the last possible moment. Since this one is ordinary malware, ordinary machine hygiene applies too: updates, no pirated software, no random browser extensions with broad permissions.
| Attack | Mechanism | What it can and can't do | Defense |
|---|---|---|---|
| Dusting | Tiny payments sent to many addresses, then chain analysis watches how they're spent | Can link your addresses together if you spend the dust; can't steal keys or funds by itself | Freeze or lock the dust with coin control; never interact with embedded links or follow-up messages |
| Address poisoning | A vanity address matching the ends of a real counterparty lands in your history via a micro-transfer | Can capture a full payment if you copy it by mistake; can't do anything if you never send to it | Pay from an address book, verify middle characters, test-send, confirm on hardware |
| Clipboard hijacking | Malware on your machine swaps the address in your clipboard between copy and paste | Can redirect any payment you paste; can't act without malware already installed | Re-check pasted addresses, prefer QR codes, verify on a hardware wallet screen |
Honestly, not very, provided your habits are sound. These attacks persist because they cost almost nothing to run at scale, not because they succeed often against any given target. Dust costs the attacker fractions of a cent per address. A vanity lookalike costs a few dollars of GPU time. Sprayed across enough victims, a handful of sloppy moments somewhere make the campaign profitable. The losses cluster almost entirely among people who copy from history, skim-read addresses, and click things that arrive uninvited.
The underlying rule is broader than Litecoin: receiving something on a public blockchain costs you nothing until you act on it. Anyone can send anything to any address, and no wallet setting changes that. What the attacker is really buying with their dust is a future lapse in your attention. Decline to sell it.
No. An incoming transaction can't access your keys, run code, or move your funds. The risk begins only if you later spend the dust alongside other coins, which can link your addresses for chain analysis, or if you engage with a link or message attached to it. Freeze it with coin control and it stays harmless indefinitely.
No. Any transaction that spends the dust is precisely what a deanonymization attacker wants, because it ties the dusted address to your other UTXOs. Lock it and forget it. There's no cleanup required, since doing nothing is the cleanup.
More than the first and last four characters, because those are exactly the parts a poisoning attacker can replicate. Compare a few chunks from the middle as well, or better, take manual comparison out of the process: pay from a saved address-book entry, scan a QR code, and confirm the destination on a hardware wallet screen for meaningful amounts.
It helps, since less address reuse gives the clustering heuristic less to work with, and it's good practice anyway. It doesn't make you immune: attackers dust any address that has been active, and careless coin selection can still merge dust with your other outputs. Fresh addresses plus coin control is the working combination.
It closes the final gap, but only if you use it properly. The device screen shows the address actually being signed, which defeats clipboard swaps outright. Against poisoning it still depends on you comparing that address to a trusted source rather than to your transaction history, because the device can't know which address you meant.
