Arbitrary AML and Effect of Dust Attack.

[Ambatman]

Few months ago, The US rather than choosing the route of buying bitcoin for their SBR
Chose getting from seized coins AKA tainted coins as they call it.

Before I start I would advice individuals that don't really understand UTXO and dust attack to check out this threads before proceeding.
[Edu] Bitcoin Wallet UTXO and Consolidation
[Edu] Bitcoin Wallet Dusting Attack and UTXO Control.


Now what role does Dust attack play here?
Bitcoin makes use of UTXO just like Banks make use of account balances.

Normally dust attacks are usually used to denonymize an address i.e bridge privacy
But with the AML and the classification of coins as clean and tainted its danger has grown more.

If an individual owns a clean Bitcoin UTXO and a supposedly tainted address sends a tainted UTXO to them
If spent the transaction would be considered tainted according to AML mind you there's no tainted coin according to Bitcoin protocol..


If you read that link you should understand what Coin control is and how it can help mitigate such
But not many are aware of it nor does all wallet support such.


This easy route they have taken is going to affect innocents and another sign that with growing interest
Regulations may get stricter that coins not in exchanges are own by scammers
Worse scenario so don't mind me....... Or do

AML, Anti Money laundering looking good in paper(preventing illicit funds and shii) but it can serve as a way the government can legally steal ones funds.
It's arbitrary and lacks real transparency
Bitcoin is money
And money should be fungible.

If not properly checked dust attack can taint your UTXO.  

Contributions would be appreciated. Thank you.

[Darker45]

I'm actually torn between advising Bitcoin owners to use non-custodial wallets that have coin control and allows them to freeze certain UTXOs, and resisting this unfair and unreasonable approach altogether.

Although we have the option to just stick with the likes of Electrum, BlueWallet, Sparrow, and others, is it not actually a gesture of giving in to the whimsical and shallow tendencies of the authorities?

One might ask, but what else can we do? I don't know, but is going along with whatever the regulators think the better option? And how careful can we be? If a dusted output is spent by a clueless user and eventually ended up in your wallet after 3 separate transactions, your address and the funds in it are already tainted, right? Was that something you could have prevented?

[Cookdata]

AML, Anti Money laundering looking good in paper(preventing illicit funds and shii) but it can serve as a way the government can legally steal ones funds.
It's arbitrary and lacks real transparency
Bitcoin is money
And money should be fungible.

If not properly checked dust attack can taint your UTXO.  

One thing I know about Bitcoin network,  the network doesn't lie. Whoever is in charge of anti money laundering scheme would be train to understand what is a dust utxo and the likelihood of people been affected by taint dust voluntarily or involuntarily. If as an investigative chain analyst and they can't differentiate addresses that are attack with a taint dust and address that bought a spendable utxo, then there is going to be ton of investigation files on their offices every day, it's something unavoidable, mistakes are bound to happen even with the awareness of dust attacks, they ought to know this better than anyone.


There should be a limit to taint coin one can spend without been convicted. We know that dust can't be spent, it's literally useless, so if this happens onchain and unknowingly someone spent it, there might not be nothing to investigate. Maybe it is going to become a crime when you spend Bitcoin that is more than a dust, that's when they might have interest investigating such transactions and address involved.

As an individual, this isn't a problem, the rule is simple. When you see a Bitcoin in your wallet you never bought in the first place, don't spend it. Most wallet at this age of Bitcoin has coin control, unless people that use garbage wallet, this mistakes can be avoided but who knows, we have to wait to see how each government is going to react to this analysis.

[joniboini]

If as an investigative chain analyst and they can't differentiate addresses that are attack with a taint dust and address that bought a spendable utxo, then there is going to be ton of investigation files on their offices every day, it's something unavoidable, mistakes are bound to happen even with the awareness of dust attacks, they ought to know this better than anyone.

Yeah, I find it hard to believe that a chain analysis company would generalize every UXTO as a suspicious transaction without further proof. I can understand some exchanges being lazy and just flagging everything because they don't want to spend money to improve their AML filter, but they'll change how they do that if enough complaints are coming. That being said, it's always a good decision not to trust a third party to be smart about it, and instead prepare for the worst from our perspective.

[FortuneFollower]

If as an investigative chain analyst and they can't differentiate addresses that are attack with a taint dust and address that bought a spendable utxo, then there is going to be ton of investigation files on their offices every day, it's something unavoidable, mistakes are bound to happen even with the awareness of dust attacks, they ought to know this better than anyone.

Yeah, I find it hard to believe that a chain analysis company would generalize every UXTO as a suspicious transaction without further proof. I can understand some exchanges being lazy and just flagging everything because they don't want to spend money to improve their AML filter, but they'll change how they do that if enough complaints are coming. That being said, it's always a good decision not to trust a third party to be smart about it, and instead prepare for the worst from our perspective.

We surely may see more complaints than now due to the facts presented in the OP

One way or another, their filters will need to catch up, and new standards will be set (which is good).

[Ambatman]

One might ask, but what else can we do? I don't know, but is going along with whatever the regulators think the better option?

It goes to show how much lack of knowledge could cost one and that others can benefit from it.
Supporting such regulation undermines the essence of owning a Bitcoin
For now they can implement such action from Big exchanges or corporations.
But we can't really tell their stance in the future.

And how careful can we be? If a dusted output is spent by a clueless user and eventually ended up in your wallet after 3 separate transactions, your address and the funds in it are already tainted, right? Was that something you could have prevented?

Knowing a problem exist is a start.
fillippone experienced a dust attack some years ago among other users as can be seen here  https://bitcointalk.org/index.php?topic=178336.msg61607090#msg61607090

No they become tainted when they are spent. Note no coin is tainted
Just saying it from AML perspective. As long as its not spent then there's nothing to worry about
Hence why it's adviced against using wallets that automatically choose UTXOs to spend.

The issue comes when a person isn't aware. Take for example then when I check some wallet owning huge Bitcoins and have been inactive
I usually see small amount sent there. Then I never knew thinking maybe it was interest on their earnings (Lol yes I was that Noob when it came to Bitcoin)
Turns out they were dust and are sent so they can denonymize the owners pseudonymous identity.

We know that dust can't be spent, it's literally useless, so if this happens onchain and unknowingly someone spent it, there might not be nothing to investigate. Maybe it is going to become a crime when you spend Bitcoin that is more than a dust, that's when they might have interest investigating such transactions and address involved.

Well it can be spent. Just not economical because of the fee associated with it.
Hence why I said its arbitrary.
If a UTXO worth 10BTC is spent with a dust UTXO, the new UTXO becomes tainted according to AML
Because the supposedly tainted dust can be traced to it and it has been spent.

[Hatchy]

If not properly checked dust attack can taint your UTXO.  

The term tainted bitcoin is just some made up shit the government use to feed us with more nonsense drama. Well fact being said is many might not be able to detect such tiny transactions ontime and most likely fall victims of the dust attacks. I've seen such transactions on one of my old wallets then, but not on bitcoin, usdt. And if you check any explorer you most likely aren't going to be the only one who was targeted by these scammers.

Their aim is very visible but they have little or no idea of the damage they cause to innocent people aside from trying to monitor their transactions. This might just be another one of those methods the government will try to take advantage off.

[Solosanz]

I would like to know which person had a problem with exchange/bank/government due to dust attack? that's the most important part to draw a conclusion whether dust attack is a problem or not.

What I know, the centralized entities consider tainted address has a problem if the address received a good amount coins related to high illicit money.

I think since 2022 the regulation about Bitcoin is tight enough, so far I haven't heard this thing could be a big problem.

[Ambatman]

I would like to know which person had a problem with exchange/bank/government due to dust attack? that's the most important part to draw a conclusion whether dust attack is a problem or not.

What I know, the centralized entities consider tainted address has a problem if the address received a good amount coins related to high illicit money.

I don't know if you didn't read my post well or I wasn't clear enough
I'm not saying dust attack would Red flag AML
What I meant was dust attack from a tainted UTXO if spent can compromise the new UTXO in being tainted.

What I know, the centralized entities consider tainted address has a problem if the address received a good amount coins related to high illicit money.

There are scores. We have low, moderate and high. It's not primarily based on amount but also source
You can check this out
https://cointelegraph.com/news/bis-crypto-compliance-scores-aml-offramps

I think since 2022 the regulation about Bitcoin is tight enough, so far I haven't heard this thing could be a big problem.

We can't tell how the regulation would be in the next five years
But one thing I'm sure is it won't looser but tighter.

And on it being a problem? To my limited knowledge I believe it should since nothing stops authority or CEX for branding a UTXO as being tainted because of a dust attack.
I can't really tell if I'm wrong when I don't share my view so I could be over thinking.

[d5000]

Shower thought: Wallet developers could offer an anti-dust-attack mechanism, which could work in this style:

- You have the option to set up a wallet as "protected".
- On protected wallets, only UTXOs coming from addresses / transactions you personally whitelist will be used as inputs in transactions.
- Any new funds not coming from a whitelisted address will have to be whitelisted or they will be "quarantined" (and not used in transactions). You could whitelist them at any moment.

For me personally current coin control is good enough, but that could be an interesting mechanism aimed for new/non-technical users. And technically it should be easy to implement.

Superficial googling (with Gemini activated) did not provide any hits for such a mechanism. If there's any wallet offering that, it would be cool to read about that in this thread.

[BlackBoss_]

Shower thought: Wallet developers could offer an anti-dust-attack mechanism, which could work in this style:

- You have the option to set up a wallet as "protected".
- On protected wallets, only UTXOs coming from addresses / transactions you personally whitelist will be used as inputs in transactions.
- Any new funds not coming from a whitelisted address will have to be whitelisted or they will be "quarantined" (and not used in transactions). You could whitelist them at any moment.

It's kind of insightful ideas for development but it is also sort of cumbersome with some possible inconvenience and false protection too. If such whitelist is applied, and I am a receiver, I will have to ask the sender about the address used by the sender for a transaction to my receiving wallet. If it is a peer to peer trade, it is possible but it still depends case by case. Sometimes the sender does not want to reveal that information with me or if the trade is made from a Peer to Peer marketplace, even the sender does not know it.

If it is a transaction from an e-commerce site, an exchange, it's impossible.

For me personally current coin control is good enough, but that could be an interesting mechanism aimed for new/non-technical users. And technically it should be easy to implement.

For me, the coin control feature is enough too.

[d5000]

It's kind of insightful ideas for development but it is also sort of cumbersome with some possible inconvenience and false protection too. If such whitelist is applied, and I am a receiver, I will have to ask the sender about the address used by the sender for a transaction to my receiving wallet.

No, that is not necessary. The idea is that you also can whitelist a transaction without knowing the origin address, at any time (i.e. also after the transaction has been made). If you receive a P2P trade, then you normally know the amount you will be sent and so it will be easy to set that transaction apart from those who may be a dust attack.

Even if it was necessary, you can either calculate the address (in the case of P2(W)PKH transactions and other "simple" transaction types, as a hash of the public key shared in the transaction data) or you can request a full node or explorer to provide the address.

I can also imagine another variant of the concept: you get a list of all transactions received and can toggle them one by one as "known" or "unknown (may be attack)". This is mainly an interface change but that may be easier for some people, and address whitelisting (instead of transaction whitelisting) can also lead to address re-use which is often not a good idea.

[Kruw]

If you read that link you should understand what Coin control is and how it can help mitigate such
But not many are aware of it nor does all wallet support such.

Although we have the option to just stick with the likes of Electrum, BlueWallet, Sparrow, and others, is it not actually a gesture of giving in to the whimsical and shallow tendencies of the authorities?

If there's any wallet offering that, it would be cool to read about that in this thread.

The best one to use is Wasabi Wallet, it has a feature specifically for detecting and blocking dust attacks:

[ertil]

If there's any wallet offering that, it would be cool to read about that in this thread.

There is "freeze coin" feature in Electrum. And you can do a similar thing in Bitcoin Core. For example:

[BlackBoss_]

No, that is not necessary. The idea is that you also can whitelist a transaction without knowing the origin address, at any time (i.e. also after the transaction has been made). If you receive a P2P trade, then you normally know the amount you will be sent and so it will be easy to set that transaction apart from those who may be a dust attack

I am sorry for misunderstanding your idea.

So now it is like you want to whitelist transactions without need of knowing where it comes from, just basing on the transaction amount. If it is a figure that matches your settings and definitions of a dust transaction, your wallet software with your customization will freeze it.

Do I understand you well now?

Some information about dust transaction amount
What is meant by Bitcoin dust?
P2PKH outputs: 546 satoshis
P2WPKH outputs: 294 satoshis.
P2SH outputs: 540 satoshis.
P2WSH and P2TR outputs: 330 satoshis.

[d5000]

There is "freeze coin" feature in Electrum. And you can do a similar thing in Bitcoin Core. For example:

Yes, that's actually exactly the opposite of what I'm proposing: you manually blacklist coins instead of whitelisting them. If you know about Bitcoin the freeze coin feature is quite cool, but you already must suspect an UTXO is part of an attack, so I think the whitelist method is "safer" for non-technical Bitcoiners.

In reality, all what Electrum devs would need to change is (if this feature is activated) to freeze all incoming coins automatically until they're whitelisted or come from a whitelisted address.

So now it is like you want to whitelist transactions without need of knowing where it comes from, just basing on the transaction amount. If it is a figure that matches your settings and definitions of a dust transaction, your wallet software with your customization will freeze it.

That's how the Wasabi wallet feature mentioned by @Kruw above works. My proposal is still different: all coins not coming from either 1) a whitelisted address or 2) a whitelisted transaction (all of them can be whitelisted at any time) are automatically frozen until the user chooses to un-freeze them.

[ABCbits]

There is "freeze coin" feature in Electrum. And you can do a similar thing in Bitcoin Core. For example:

Yes, that's actually exactly the opposite of what I'm proposing: you manually blacklist coins instead of whitelisting them. If you know about Bitcoin the freeze coin feature is quite cool, but you already must suspect an UTXO is part of an attack, so I think the whitelist method is "safer" for non-technical Bitcoiners.

In reality, all what Electrum devs would need to change is (if this feature is activated) to freeze all incoming coins automatically until they're whitelisted or come from a whitelisted address.

Few thoughts,
1. With HD wallet, the same sender may send Bitcoin from different address.
2. What would happen if the TX contain multiple input from multiple address?

On side note, i also have concern some users would be confused that they can't send all of their Bitcoin or Bitcoin they recently received.

[Z-tight]

In reality, all what Electrum devs would need to change is (if this feature is activated) to freeze all incoming coins automatically until they're whitelisted or come from a whitelisted address.

Personally i do not like this feature. I would not like to manually whitelist addresses and transactions before they are added and i am sure a lot of users wouldn't like that as well. If such a feature is added for the non-technical users as you call it, it would be added in a new update, along with other implementations and anyone who updates will have the feature available. However, it will only make sense if it is an opt-in feature and those who think they need it would have to opt-in for it.

On side note, i also have concern some users would be confused that they can't send all of their Bitcoin or Bitcoin they recently received.

I think so too, but that would be for those who do not understand the feature, if not it should be easy to simply whitelist any 'pending' or 'frozen' tx so it gets added.