Spam tokens, dusting and address poisoning: keep them out of the books

Unsolicited tokens and tiny transfers hit every active wallet. Keep them off the balance sheet, avoid poisoned addresses, screen for sanctions.

2026-10-17 · 6 min read

What this means for you: most active wallets receive tokens and tiny transfers nobody asked for. Some are noise, some are bait, and a few carry sanctions risk. The goal is to keep worthless items out of assets and income, without hiding anything real, and to stop them from tricking your team into paying the wrong address.

What you are looking at

• Spam tokens: unsolicited tokens sent to many wallets, often with names or links that push you to a website. Interacting with them can expose you to phishing or malicious contracts.
• Dusting: very small transfers of a real asset, sent to many addresses. It is used to probe or link wallets, and sometimes to attach a wallet to a tainted source.
• Address poisoning: a tiny transfer from an address made to look like one you use, so it appears in your history. The attacker generates an address matching the first and last characters of a familiar one and waits for someone to copy it [3].

Why not to book them as assets or income

Recognizing income or an asset needs two things: control of the item and a value you can support. US tax guidance ties airdrop income to fair market value when the tokens are recorded on the ledger, and to the ability to transfer or dispose of them [1]. A token with no real market and no realistic exit fails the value test, and a token that only exists to lure you into a malicious contract is not something you would rationally use.

The UK takes a different starting point for genuine airdrops. HMRC says an airdrop received without doing anything in return is generally not income, though a later disposal may still give rise to a capital gain [2]. Neither the IRS nor HMRC has published rules specific to spam tokens that we found as of October 2026. Treating them at zero value is therefore a policy choice based on the general guidance, not a stated rule. Document it.

For the books, a common approach is to record spam receipts at zero value, keep them out of fair value remeasurement and holdings reports, and keep the raw record. If gas was spent interacting with a spam token, the gas is still a real cost and should be booked under your normal gas policy.

Keep spam out without losing real assets

The risk runs both ways. Over-filtering can hide a legitimate airdrop, a new stablecoin, or a token a counterparty actually paid you in. Under-filtering lets fake value into the balance sheet.

• Hide, do not delete. Flag spam in a reviewable list; never remove the underlying record.
• Let a person override a flag, with a reason, when a token turns out to be real.
• Never value a token from a single thin pool. Small pools are easy to move.
• Re-check the list when a flagged token later gains a real market.

Address poisoning: payment controls

Poisoning attacks target the payment process, not the ledger. They work because people recognize long addresses by the first and last few characters [3]. Wallet providers recommend checking the middle characters too, not copying addresses from transaction history, and keeping saved, verified contacts [3].

• Keep a verified address book. New payees go through a separate approval with confirmation by a second channel.
• Never copy a destination from transaction history or an explorer.
• Compare the full address, character by character, before signing.
• Send a small test payment to new addresses before large ones.
• Use hardware or multisig signing so a second person checks the address.

Sanctions screening of incoming dust

Receiving funds you did not ask for does not switch off sanctions rules. OFAC says compliance obligations are the same for virtual currency as for fiat, and recommends a risk-based program that generally includes list screening [4]. If you hold virtual currency that must be blocked, you must deny all parties access to it and report it to OFAC within 10 business days, then annually [4].

OFAC has dealt with dusting directly. In 2022, after designating the Tornado Cash mixer, it said US persons who were sent unsolicited dust from it still had reporting obligations, but it would not prioritize enforcement of late reports where there was no other sanctions link [5]. Tornado Cash was removed from the sanctions list on March 21, 2025, after a federal appeals court ruled against the designation; the Lazarus Group remains designated [6]. The lesson holds: screen inbound transfers, including small ones, against current lists.

Records to keep

• The raw transfer: chain, hash, sender, token contract, quantity and time.
• Your classification, who made it, when, and why.
• Screening results for inbound transfers, and any OFAC reports filed.
• The written spam and dust policy, with version and approval date.

The IRS expects records that support the positions on your return [1]. A clear spam log also answers the auditor's question of why a token in the wallet is not on the balance sheet.

What to do

• Adopt a written policy: spam at zero value, flagged and reviewable, never deleted.
• Use more than one signal to flag spam, and allow documented overrides.
• Lock down payments with a verified address book, full-address checks and test sends.
• Screen inbound transfers against current sanctions lists and escalate any match.
• Book gas spent on spam interactions as an ordinary cost.

Sources

1. Frequently asked questions on virtual currency transactions (Internal Revenue Service)
2. CRYPTO21250 - Cryptoassets for individuals: Income Tax: airdrops (HM Revenue & Customs)
3. Address poisoning scams (MetaMask Support)
4. Questions on Virtual Currency (FAQs 560, 562, 646) (US Treasury, Office of Foreign Assets Control)
5. OFAC issues 4 new FAQs to address the Tornado Cash designation (Willkie Farr & Gallagher (Compliance Concourse))
6. United States removes economic sanctions against Tornado Cash (Willkie Farr & Gallagher (Compliance Concourse))

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers