Bitcoin dust attack detection: dust limit and threshold data

We measured it rather than assuming it. Every output of block 964,592, mined 29 August 2026 at 15:38:20 UTC, was fetched and checked against the threshold for its own script type. Of 6,915 spendable outputs, exactly zero fell below the line. Not one. The smallest Taproot output in the block was 330 satoshis and the Taproot threshold is 330. The smallest legacy P2PKH output was 546 and the P2PKH threshold is 546. Values pile up precisely on the floor and never go under it, which is what a binding policy rule looks like from the outside. We repeated the whole exercise on block 964,100 to be sure it was not a quirk of one block: 5,635 transactions, 6,043 spendable outputs, again zero below threshold. Across the two blocks that is 12,958 spendable outputs and not a single one of them was dust.

The attacking side knows the rule better than most tooling does. On 28 August 2026 at 23:13:55 UTC, transaction ad3501200064d4ae96b13c77c668777f88fc40baad065c49a0b5cca3981674bb spent 21 native SegWit inputs into 21 outputs. Twenty of them were poison: 546 satoshis to three legacy addresses, 540 to five P2SH addresses, and 330 to twelve SegWit script-hash addresses. Those are not round numbers somebody picked. They are the exact Bitcoin Core dust threshold for each recipient script type, computed per output. Two of the twenty went to cold addresses that sit on widely published exchange reserve lists.

The economics changed recently and the tooling has not caught up. That transaction paid 1,125 satoshis in total fees at a rate of 0.52 satoshis per virtual byte, which works out near 56 satoshis per poisoned address. Under the old default it would not have relayed at all, because Bitcoin Core carried a minimum relay feerate of 1,000 satoshis per kilovirtualbyte, or 1 satoshi per virtual byte. Release 30 cut that default to 100. The dust feerate that sets the thresholds was deliberately left at 3,000, so the floor on output size held while the floor on fee rate dropped by a factor of ten. Spraying got cheaper. Dust did not get smaller.

That matters now because dust stopped being only a privacy problem. Between 17 and 24 August 2026, roughly 12,000 unsolicited small deposits reached Kraken from a wallet that Arkham Intelligence had labeled as belonging to the sanctioned exchange HTX. Automated sanctions screening locked customer accounts that had done nothing except receive coins they never asked for. Access was restored and a disputed sum stayed segregated, and HTX denies sending them. Note where the uncertainty actually sits: the amounts and the transactions are exact and anyone can recompute them, while the label that triggered the freeze is inference and is contested.

BitcoinDatabase gives you the layer underneath a vendor alert. Every output carries its value and its script type, so you can apply the correct threshold per type instead of a flat cutoff, find the transactions that create many near-threshold outputs at once, and follow whether poisoned dust was ever spent alongside real funds. You decide what counts as suspicious rather than inheriting somebody else scoring model. This is informational on-chain data and analytics, not legal, compliance, investment or trading advice.