Why sanctioned 'dust' can become an exchange problem

Blockchain transfers are permissionless. Anyone can send a small amount of crypto to a public address, which means users cannot always prevent themselves from receiving funds linked to a sanctioned entity. That creates a difficult compliance problem for centralized exchanges that automatically monitor wallet activity and may restrict accounts when a screening system detects prohibited exposure.

The risk is that an attacker can deliberately send tiny amounts—often called dust—to many addresses in an attempt to trigger automated controls. The recipient has not chosen to transact with the sanctioned party, yet the exchange still has to investigate the alert.

Why automated compliance can overreact

Screening systems are designed to minimize the chance that prohibited funds move through a regulated platform. If rules are too strict, however, they can create false positives and lock legitimate customers out of accounts. The challenge is distinguishing intentional economic interaction from unsolicited transfers that carry almost no value.

What exchanges can improve

More sophisticated systems can consider transaction size, direction, known attack patterns and whether the customer exercised any control over the receipt. Human review and clear escalation processes are also important for cases where automation cannot make a reliable decision.

What users should do

Customers who receive suspicious dust should avoid trying to move or consolidate it unnecessarily and should preserve transaction records. If an exchange restricts an account, communicating through official support channels and providing wallet history can help establish that the transfer was unsolicited.

Why this matters for the industry

As crypto becomes more integrated with regulated finance, compliance systems need to handle adversarial behavior rather than assume every on-chain connection represents a voluntary relationship. Poorly designed controls can become a denial-of-service vector against innocent users.

Bottom line

The Kraken incident highlights a new form of operational risk created by transparent, permissionless blockchains interacting with sanctions rules. Strong compliance remains necessary, but the industry also needs systems that distinguish meaningful prohibited activity from malicious dusting. Otherwise, attackers can weaponize regulation itself to disrupt ordinary users.