Tainted crypto refers to digital assets that blockchain analysis links to illicit activity such as hacks, scams or sanctioned addresses. A dusting attack sends tiny amounts to many wallets to track or lure their owners. Address poisoning plants a look-alike address in your transaction history so you copy the wrong one later. None of them needs access to your keys, but each calls for a different response.
What is tainted crypto?
Every transaction on a public blockchain is recorded permanently, so the path that assets have taken can be traced. Analytics providers use this history to label addresses linked to theft, fraud, sanctioned parties and similar activity. Funds that can be traced back to those addresses are often described as tainted.
Taint is usually an assessment, not a label recorded on the blockchain, and providers can judge the same funds differently. Two exceptions matter: governments publish sanctions lists that can name specific wallet addresses, and some token issuers can freeze tokens held at an address. In practice, the assessment matters: an exchange or payment provider that screens deposits may delay a transfer, ask for information about the source of funds, or decline to accept it.
What is a dusting attack?
A dusting attack sends very small amounts of crypto, known as dust, to a large number of addresses. It usually has one of two aims:
- Tracking. If the dust is later spent together with other funds, analysis of that transaction may link several of your addresses to each other. This mainly affects networks such as Bitcoin, where a payment can combine several earlier inputs.
- Luring. Unsolicited tokens may carry a name, note or link that points to a fraudulent website.
Receiving dust does not by itself give anyone access to your wallet. The risk comes from what you do next, such as interacting with an unknown token or visiting a link attached to it.
What is address poisoning?
In an address poisoning attack, someone generates an address that closely resembles one you already use, often matching the first and last few characters. They then create a tiny or zero-value transfer involving that address, sometimes made to look as if you sent it, so that the look-alike appears in your transaction history.
The attacker is relying on a habit: copying a recipient address from recent history instead of from a verified source. If you copy the look-alike address, your next payment goes to the attacker, and blockchain transfers cannot be reversed.
How the three compare
| Risk | What happens | Main danger | Common precaution |
|---|---|---|---|
| Tainted crypto | You receive funds with a problematic history | Questions, delays or refusals from service providers | Keep the funds separate and keep records of how you received them |
| Dusting attack | Tiny unsolicited amounts or tokens arrive | Address linking, or a lure to a scam site | Do not interact with unknown tokens or follow their links |
| Address poisoning | A look-alike address appears in your history | Sending your next payment to the attacker | Verify the full address from a trusted source every time |
What to do if you receive crypto you did not expect
- Do not rush to move or spend it. Take time to understand what arrived and where it came from.
- Do not follow links in token names, memos or messages that accompany the transfer.
- Check the source where you can, using a block explorer or the risk tools in your wallet.
- Keep it apart from your other funds if your wallet allows, so its history does not mix with assets you trust.
- Keep a record of the transaction reference, the date and what you know about the sender.
- Ask before you act if anything suggests a link to crime or sanctions, whatever the amount. You may have legal or reporting obligations; your service provider or a qualified adviser can tell you what applies.
Where Finyon Wallet fits
Finyon Wallet is built around the idea that funds from unknown sources should not mix with funds you trust. You save the counterparties you know as trusted sources, and their transfers go directly to your Main Wallet. Transfers from every other source enter an isolated Risk Wallet, where you can review them before moving funds. The DARAM® risk scan makes incoming activity easier to understand.
That separation does not remove the risks described in this guide, and a risk scan cannot detect every problem. It does not replace checking the address you are sending to. It does give unexpected deposits a defined place before you decide. For background, read what a crypto risk wallet is.
Common questions
Is receiving dust dangerous?
Receiving dust does not give anyone access to your wallet. The risk comes from interacting with unknown tokens, following links attached to them, or spending the dust together with other funds.
How can I avoid address poisoning?
Do not copy recipient addresses from your transaction history. Take the address from a verified source, check the full address rather than only the first and last characters, and consider sending a small test amount first.
Who decides whether crypto is tainted?
No single body decides. Governments designate sanctioned parties and, in some cases, specific addresses. Beyond that, analytics providers and the service providers that rely on them make their own assessments, which can differ.
This guide is general information, not financial, legal or tax advice. Digital assets carry risk, and a risk scan or score is a decision aid that cannot detect every risk. See digital asset risks.