The growth and development of web3 is a fascinating journey to be a part of. We’ve seen the rise of blockchain technology and its importance to numerous industries outside finance and economics. A standout innovation of the web3 emergence is how we connect, interact and identify on web applications. In the era of web2, an account must be created using a phone number, email address and other personal information, which has always been a risk. The risk of personal data being used for malicious purposes makes many people hesitant to interact with web applications requiring such information. Web3 solves this identity crisis with decentralised/non-custodial hot wallets such as MetaMask, TrustWallet, Phantom, SafePal, Keplr, Argent, Petra, Martian and others. These wallets offer users protection against identity theft by giving the user a unique array of alpha-numeric strings which serve as their wallet address and identity on web apps.

Although these wallets offer greater data security compared to web2 password managers, there are risks associated with using them. If users lack the knowledge on proper use, they are vulnerable to attacks on not only their identity and money but also their activities and movements. A popular attack is the dusting attack involving the malicious user sending small amounts of crypto called “dust” to several wallets, intending to discover the owner's identity through monitoring their on-chain activity. We’ll go through the dust attack, to gain a better understanding of what it is and how we may be in danger, if not already a victim.

Crypto dust refers to very small amounts of cryptocurrency that can be considered negligible. They build up in wallets over time as transactions grow or are intentionally sent to an address by a malicious entity. As stated earlier, the attacker(s) will send a small amount of cryptocurrency to many wallets and watch the activity of these wallets, waiting for an opportunity to strike with a greater attack.

Crypto dust found in a Solana and Metamask (shown via poocoin app) wallet

The attack is two-fold. The first part of the attack is to find an unsuspecting user on the blockchain who has made a transaction. The attacker monitors the address of their victim, trying to achieve 2 things:

De-anonymize the user
Identify the value of crypto held in the wallet.

The attacker poses both a security and privacy risk to the wallet owner. By identifying the person behind the wallet, They remove the privacy associated with cryptocurrency transactions, putting a target on said person's back.

Another potential risk associated with dust attacks is that the victims fall prey to sending crypto to the wrong addresses, generated by the attackers. The attacker uses a scrypt-type program to create a wallet address similar to a previous wallet address the victim has sent crypto before. The attacker will use the pseudo address to send the crypto dust to the victim, who will see it as a harmless transaction between known addresses. The attacker then waits for the victim to send crypto to the address unsuspecting of fraud.

Attackers will use the few characters that would be visible to create their pseudo wallet. To the unsuspecting eye, there is no difference.

Many times, when the victim sends the first amount and it does not appear, they become perplexed and would more often than not, send crypto to the address again. Their thought process is usually “Maybe there's a network error that would revert the sending process” or “Let me try again to find out what's going on”. By the time they realize that they've sent their money to the wrong address

Crypto dust in a SUI wallet. Note that crypto dust can be in the form of ANY cryptocurrency.

1. Crypto dust is sent to your wallet by an attacker. It may be in the form of a cryptocurrency you have recently interacted with. the attacker sends it using a wallet with the same first and last characters as the wallet you've recently interacted with.

2. The Waiting Game. The attacker waits patiently for you to make a careless move.

3. The Mistake. The unsuspecting victim does not do their due diligence when sending crypto out. This results in them sending their tokens to the attacker's address due to the similarities in the first and last few characters of the addresses.

4, After the mistake is made, the attacker quickly sends the stolen funds to their ultimate wallet. This may involve a few wallets and Dapps, hoping to hide their trail.

5. The attacker sends the crypto to a centralized exchange for conversion to another crypto or fiat.

This type of scam is a very hard pill to swallow because it involves the victim's negligence and lack of situational awareness. A more recent high-profile crypto dust scam occurred in October this year when over $600,000 in USDT was lost in 4 days. For context, that is over 600 million Naira, 7.2 million Cedis, 11 million Rand and 357 million CFA. The attack is detailed in the report published by Plasbit.

There will be no steps or tips to avoid this scam because it's common logic for you to do what's needed and you will be safe. The main reason why this scam is lucrative is because people are lax about the security of their crypto. If you vet every wallet address you interact with and take your time to select YOUR wallets and look at the wallet's characters in FULL, there will be no issues for you.

Attackers will send crypto to your wallet, hoping you slip up. Do not engage them and you will be more than safe. Last thing before we head out if your wallet is compromised or you suspect it is, then drop it and create a new one.

Haha, I guess I still gave some tips in the end. Well, till next time.