Nested exchanges, dusting and address-poisoning dust

The final lesson of the section gathers the "junk" and "parasitic" layer of typologies: nested exchanges, which hide their clients inside someone else's compliance; dusting attacks, which scatter micro-amounts for deanonymization; and spam tokens with poisoning dust, which clutter the history and serve as bait. The common theme is how to tell meaningful activity from parasitic noise and why that noise cannot simply be ignored in AML analysis.

Nested exchanges

A nested exchange is an exchange service that operates not on its own banking/exchange infrastructure but "sits" inside the account of a larger exchange. Formally it is a single client of the big exchange, but in fact it services hundreds of its own users, running their operations through its deposit addresses on the "parent" venue. Classic examples of this model are the numerous instant-swap services and OTC desks, as well as the notorious services such as Suex/Chatex, which came under sanctions precisely for laundering through this kind of "matryoshka."

The danger is that the parent exchange's compliance sees the aggregated flow of the "exchange client," not its end users. The KYC of the real senders and recipients is blurred: behind one verified account hides a crowd of unidentified people, some of whom deliberately came "to launder." For a launderer this is a way to reach the liquidity of a large exchange without passing its KYC directly.

Various clients
some are dirty

⇉

Nested exchange
1 account on the exchange

→

Parent exchange
sees only "the client"

A sign on the graphA deposit address through which an atypically heterogeneous flow passes from many unrelated sources and to many recipients, while the address itself clusters as belonging to a large exchange.
High "turnover"Funds do not settle: they came in and almost immediately went onward, thousands of small counterparties, a round-the-clock rhythm — the handwriting of a service, not of a private individual.
Analysts' labelsMany nested services are already labeled in databases as high-risk; interacting with them raises the risk score even if your own funds are clean.

Dusting attacks

Dusting is the sending of tiny amounts ("dust") to a multitude of addresses. The dust itself steals nothing, but it is a reconnaissance and deanonymization tool. The logic: the attacker scatters crumbs across thousands of wallets and then watches which of them "spend" the dust, accidentally combining it with their main funds in a single transaction. As soon as the dust mixes with the victim's real UTXOs, the attacker uses clustering to link together addresses the owner considered independent — and deanonymizes them, tying them to an identity, exchanges, and other wallets.

Scattering the dust. Micro-amounts (a few satoshis / penny tokens) go out to a mass of addresses.Cheap at scale, especially in cheap networks.
Observation. The attacker waits for the victim to "sweep up" the dust together with their ordinary funds into a common spend.UTXO wallets tend by default to pick up all outputs.
Clustering. Combining inputs in one tx betrays a common owner — this is how previously "clean" addresses get linked.This is the very goal: to strip away pseudonymity.
Monetizing the intel. Next come targeted phishing, blackmail, or preparing address poisoning against the now-linked addresses.Dusting often precedes other attacks.

Protection against dusting. Do not spend dust — many wallets let you mark small UTXOs as "do not spend" (freeze them). Use wallets with coin control and, where privacy matters, separate funds across accounts that are not linked to one another. Do not follow "instructions" that arrive together with dust or spam tokens.

Spam tokens and poisoning dust

In networks with cheap token issuance (Ethereum L2s, BSC, TRON), victims' wallets are showered with spam tokens: fake coins with familiar tickers, "airdrop" bait, NFT scams. This is adjacent both to dusting (noise and reconnaissance) and to address poisoning from lesson 7.5 (micro-transfers and fake tokens in the history as bait for copying). Often such tokens lead to a phishing site ("claim N tokens"), where the victim is asked to sign a transaction that drains their wallet.

A typical "junk" layer in a wallet: spam tokens with fake tickers and "claim" bait — do not interact and do not copy addresses.

A rule of hygiene. Never interact with spam tokens: do not swap them, do not "claim," do not follow links in their names, do not copy the associated addresses from the history. Any action is a potential trigger for poisoning, phishing, or deanonymization. Simply hide such tokens in the interface.

How to tell dust apart from real activity

The key analytical task is not to confuse parasitic noise with a genuine money flow. Otherwise the graph gets overgrown with false links, and scoring starts to "get scared" of harmless dust or, conversely, misses real risk. Reference points:

The economic sense of the amountReal activity carries meaningful value. Dust is fractions of a cent with no payment function; its only goal is to get into the history.
Direction and consentA genuine transfer is initiated by the owner. Dust and poisoning arrive unrequested, often en masse and from unfamiliar sources.
Mass mailingA single source that sent identical micro-amounts to thousands of addresses in a narrow window is a dusting campaign, not payments.
A token with no liquidity or historyA spam token usually is not traded, has no real pool, and its "contract" was created in a batch of identical ones. A real asset has a market and a history.
Not mixed with the main fundsIf the victim did not spend the dust, it is isolated and creates no real links — it must be excluded from clustering, not used to build conclusions.

How competent AML analysis accounts for this

Filtering the noiseThe engine separates dust and spam tokens from the significant flow so as not to spawn false graph edges and false scoring triggers.
But not "blind" ignoringThe very fact of dusting/poisoning is recorded as a signal: the address may have been a target of reconnaissance or attack preparation — this is risk context, not pure emptiness.
Untangling nested flowsFor nested exchanges it is important not to assign all the risk to the parent exchange, but to isolate the specific high-risk sub-flow.
Link with lesson 7.5Poisoning dust is analyzed together with "erroneous" large transfers — a lookalike address standing right next to it gives away the attack.

Summary of Section 7. We have gone through six typologies of laundering and parasitic attacks: peel chains (the linear "comb" of cleaning), fragmentation/smurfing (the star-shaped "fan" under thresholds), mixers and privacy (a cryptographic break of connectivity), chain-hopping (jumping across networks through bridges), address poisoning (deceiving the habit of trusting the abbreviated address) and, finally, nested exchanges + dusting + spam tokens (the parasitic layer of noise and reconnaissance). The practitioner's overall conclusion: graph topology, the origin of the root, the economic sense of amounts, and the consent/direction of operations — these are the four lenses through which laundering and attacks are separated from the normal life of a wallet. Dust must neither be blindly ignored nor mistaken for a real flow — it should be filtered but recorded as risk context. Return to the programme to consolidate the material on practical cases.

← Programme Programme →

This material is for educational purposes.