How to Tell the Difference Between an Airdrop and a Dusting Attack

18 October 2026

The difference is simple: an airdrop is a legitimate token distribution intended to reward users or promote a project, while a dusting attack is a malicious tactic where tiny amounts of crypto are sent to many wallets to break privacy or lure victims into scams. You can usually tell them apart by examining the source, the value, and what you are asked to do.

What each one actually is

Airdrops are deliberate. A project chooses to send tokens to wallet addresses that meet eligibility criteria - often based on past on-chain activity, holding a specific NFT, or interacting with a smart contract. The project announces the airdrop in advance, provides clear instructions, and the tokens typically have a visible market value once claimed. The goal is to distribute governance rights, bootstrap liquidity, or reward early adopters.

Dusting attacks are unsolicited. Someone sends a negligible amount of crypto - often less than a cent worth - to thousands of random wallet addresses. The attacker does not announce anything. The goal is to "dust" the recipient's wallet so they can cluster addresses together and de-anonymize the owner, or to plant a known address that later receives a phishing token or malicious NFT. The dust itself is worthless.

How to Check the Source

• Airdrop: You can trace the transaction to a known project contract. The sending address is usually a project's official deployer wallet or a distribution contract that has been verified on a block explorer. The project publishes the contract address in its documentation or official social media.
• Dusting attack: The sending address is often a newly created wallet with no history, or it belongs to a known dusting campaign address that block explorers flag. The transaction may come from a mixer or a private transaction service to hide the origin.

Look up the sending address on Etherscan or the relevant block explorer. If the address is unverified, has only a tiny outbound transaction history, and no associated project, treat it as dust.

What the tokens look like

• Airdrop tokens: They will appear in your wallet under a recognizable token symbol that matches the project name. The token contract is verified on the block explorer, has a known total supply, and often has a price listed on CoinGecko or CoinMarketCap shortly after distribution.
• Dust tokens: They are usually a token that does not exist anywhere else. The contract is unverified, the token name may be nonsensical or spoofed (e.g., "USDTe" instead of "USDT"), and the token has zero liquidity. If you try to swap it, it will fail or you will be asked to approve a malicious contract.

What Happens Next

• Airdrop: You may be asked to claim the tokens via a website or automatically receive them. If claiming, you visit the project's official site, connect your wallet, and sign a claim transaction. That transaction usually calls a claim function on a known contract. No further action is required unless you want to sell or stake.
• Dusting attack: Nothing happens unless you interact. The dust sits in your wallet and does nothing by itself. The danger comes if you try to move it or if the attacker later sends you a phishing NFT or token that looks like a legitimate airdrop. The real attack is the follow-up.

The red flags that reveal a dusting attack

Watch for any of these signs:

1. The token has no website or project name you recognize. A legitimate airdrop comes from a project you have heard of or that has a clear public presence.
2. You are asked to visit a URL embedded in the transaction memo or the token name. Dusting attackers often put a phishing link in the token name or in the transaction note. Never click those links.
3. You are asked to "activate" the token or "claim" it on an unfamiliar site. Dust tokens sometimes come with instructions to connect your wallet to a fake dApp. That site will steal your approvals.
4. The amount is absurdly small and inconsistent with any known airdrop. A dusting attack sends 0.0000001 ETH worth of a token. A real airdrop sends a quantity that matches the project's distribution plan.
5. The token appears in your wallet without any prior announcement or eligibility check. Airdrops are usually preceded by a snapshot and a public eligibility checker. If a random token appears with no context, it is dust.

What to Do in Each Case

For a legitimate airdrop: - Verify the claim site URL from the project's official documentation or verified social media accounts. - Use a burner wallet or a wallet with minimal funds to claim, as detailed in our guide on main wallet vs burner wallet. - Only sign a transaction that calls the claim function - never sign a blanket approval or a setApprovalForAll unless you fully understand the contract.

For a dusting attack: - Do nothing. Ignore the dust entirely. Do not attempt to transfer it, swap it, or interact with it. - If you want to keep your wallet clean, you can hide the dust token using your wallet's interface (e.g., "Hide token" in MetaMask). Do not send it back - that would confirm your address is active. - If the dust came with a phishing NFT or a token that looks like a real airdrop, do not click any links. Revoke any approvals you may have accidentally signed using our guide on revoking token approvals.

One Edge Case

Some projects do airdrop very small amounts to test distribution mechanisms or to reward micro-interactions. These are still airdrops, not dust, because the project announces them and the tokens have a purpose. The difference remains: the airdrop is intentional, public, and verifiable. The dusting attack is silent, anonymous, and has no honest use.

Back to airdrops