2.7 Billion Blockchain Spam Transfers: What It Means for Sanctions Screening
Between January and August 2026, more than 2.7 billion suspected spam transfers crossed TRON, Ethereum, BNB Smart Chain, and Polygon. Add 2.5 billion dust transfers on Solana in Q1 2026 alone, and the picture is stark: a substantial portion of all on-chain activity carries no economic value and serves no genuine user intent. For compliance teams, that volume is not just a nuisance. It translates directly into alert fatigue, inflated dismissal rates, and real questions about the integrity of sanctions screening workflows. For firms relying on crypto accounting software to feed transaction data into compliance controls, understanding what spam is, how it behaves by chain, and what it costs operationally is now a baseline requirement.
What Blockchain Spam Actually Is
The umbrella term covers three distinct attack types, each with different cost structures, detection profiles, and chain preferences. All three share one goal: inserting an attacker-controlled address into a victim's transaction history so it can later be mistaken for a trusted counterparty.
Dusting
The attacker sends a real but negligible amount of a token, often a fraction of a cent in a stablecoin, to the target wallet. The transaction is technically legitimate. Tokens move. But the only purpose is to plant the attacker's address in the victim's history. When the victim next copies a recent address from their wallet interface, which typically truncates addresses to show only the first few and last few characters, they may copy the wrong one.
Zero-Value Transfers
On certain blockchains, notably TRON, the token transfer rules permit anyone to submit a zero-amount transfer on behalf of any address without that address's private keys. No funds move. No keys are compromised. But the victim's wallet history now shows an apparent outbound transfer to the attacker's address. The victim sees the entry and may later copy that address for a real transfer.
Counterfeit Token Spoofing
The attacker deploys a fake token contract that mimics a legitimate token's name and ticker symbol, then generates transfer events that appear in block explorers and wallets as if the victim received or sent the real token. This is the most technically demanding variant because it requires smart contract deployment, which makes it more expensive. That cost pushes it toward higher-fee chains where the payoff per targeted wallet justifies the overhead.
The Chain-by-Chain Breakdown
Spam concentrates where fees are low relative to potential payoff. Which method attackers use follows the underlying fee regime and architecture of each chain. The data covering January through August 2026 makes the variation clear.
TRON
TRON is the most affected network in proportional terms. Dust accounted for 30% of all transfers across the measurement period. Of all active wallets receiving funds on TRON, 60% were touched by dusting at least once. TRON's bandwidth and energy model, which makes many transfers effectively free for accounts with sufficient staked resources, enables industrial-scale spam at negligible marginal cost. Zero-value transfers are also structurally possible on TRON due to the permissive rules governing token transfer submissions.
Solana
Solana saw 2.5 billion dust transfers in Q1 2026 alone, representing 13% of activity and reaching 27 million addresses. Those figures cover only the first quarter, so they are not directly comparable to the eight-month totals for the other four chains. Solana's architecture includes mint-authority validation, which makes counterfeit token spoofing impractical at scale. As a result, dusting dominates here, while the more sophisticated contract-based spoofing found on EVM chains is largely absent.
BNB Smart Chain
BSC is the counterfeit token capital in the data set. More than 460 million fake transfer events occurred between January and August 2026, with roughly 7,000 counterfeit token contracts reaching more than 454 million addresses. That is 44.5% of all active BSC receivers encountering at least one spoofed token event. Each contract reached approximately 65,000 addresses on average.
Ethereum
Ethereum sees lower spam volumes overall, which reflects higher gas costs making mass dusting uneconomical. Attackers compensate by getting far more out of each contract they do deploy. Just 390 counterfeit token contracts reached 30.6 million Ethereum addresses, roughly 18% of active receivers, at a rate of approximately 79,000 addresses per contract. That is the highest per-contract reach of any chain measured, indicating highly targeted deployment.
Polygon
Polygon shows a mix of all three attack types. Counterfeit tokens reached 22.7 million addresses via roughly 790 contracts, covering 24% of active receivers. The lower per-contract reach compared to Ethereum reflects Polygon's lower fee environment, which makes broader but less targeted deployment viable.
| Chain | Dominant Spam Type | Addresses Affected | Share of Active Receivers |
|---|---|---|---|
| TRON | Dust / Zero-Value | ~709M (combined, 5 chains) | 60% dusted |
| Solana | Dust | 27M (Q1 only) | 13% of Q1 activity |
| BSC | Counterfeit Token | 454M+ | 44.5% |
| Ethereum | Counterfeit Token | 30.6M | ~18% |
| Polygon | Mixed | 22.7M | 24% |
The Operational Cost for Compliance Teams
Spam at this scale lands directly inside sanctions screening workflows. Every spam transfer that touches a flagged or near-flagged address generates an alert that a human or automated system must review and either escalate or dismiss. The data quantifies that burden precisely.
Alert Dismissals Driven by Dust
In 2026, 38% of all sanctions alert dismissals originated from dust transfers. The figure was not static across the year. It started at 25% in January 2026 and declined to 10% by August 2026, with surges at various points in between. The trend suggests that compliance workflows adapted over the period, either through improved filtering rules, threshold adjustments, or better tooling, but the starting point underscores how exposed many teams were at the beginning of the year.
The economic significance of these dismissals is negligible almost by definition. The average value of a dismissed dust-related sanctions alert was USD 0.0000588, and the median was USD 0.00, reflecting zero-value token transfers. Compliance teams were spending investigative time on transactions that moved nothing. That is not a risk calibration problem; it is a noise problem that, left unaddressed, degrades the signal quality of the entire screening programme.
Threshold and Weighting Decisions
How much of this burden any individual firm carries is, to a significant extent, an institutional choice. Compliance programmes have broad discretion over what their screening controls flag and at what thresholds. The analysis notes that the most mature teams weigh multiple factors in combination: sender characteristics, wallet history, transaction amount, and hop pattern. Acting on any single data point, such as an address appearing in a transaction, without context is what produces alert volumes that tracking systems cannot clear efficiently.
What This Means for Accounting Firms and CFOs
For accounting firms advising digital asset clients and for CFOs managing treasury operations that include crypto assets, the spam problem has two distinct dimensions.
Transaction Classification and Ledger Integrity
Unsolicited dust transfers and zero-value token events land in a client's wallet history whether they want them or not. In a well-configured digital asset accounting software environment, those entries need to be identified and classified correctly. An unsolicited dust receipt with a market value of USD 0.00000X is technically income under most recognition frameworks, but the amount is so small that materiality thresholds will almost universally eliminate it. The more serious risk is that a counterfeit token event appears in a ledger as if a real token was received, which could distort asset balances if the software ingests raw transaction data without distinguishing genuine from spoofed transfers.
Firms running crypto bookkeeping workflows need to confirm that their data pipelines can distinguish between genuine token receipts and events generated by counterfeit contracts. This is not a theoretical concern. With 460 million fake transfer events on BSC alone over eight months, the probability that at least one such event touches an actively managed wallet is high.
AML Programme Design
For firms with AML obligations, whether as virtual asset service providers, as advisers to them, or as regulated entities processing crypto transactions, the TRM data reinforces a principle that regulators in multiple jurisdictions have already articulated: sanctions screening controls must be risk-calibrated, not binary. A screening system that fires an alert on every address that appears in a transaction record will produce an unworkable alert volume on TRON, BSC, and increasingly on Ethereum. Regulators expect firms to document their threshold-setting rationale and to demonstrate that dismissals are based on substantive analysis, not reflexive clearance of low-value noise.
This connects directly to enforcement posture. As covered in our earlier reporting on blockchain analytics and sanctions compliance, regulators have made clear that inadequate screening methodology, rather than just inadequate screening coverage, is a source of enforcement risk. A firm that dismisses 38% of its sanctions alerts due to dust without a documented rationale for why dust at sub-cent thresholds represents negligible risk is not in a defensible position.
The cross-chain dimension adds further complexity. Firms that operate across TRON, Ethereum, and BSC face materially different spam typologies on each chain, and a single screening policy is unlikely to be well-calibrated for all three simultaneously. The cross-chain crime analysis published earlier this year highlights why chain-specific risk assessments are increasingly necessary for firms with multi-chain exposure.
Practical Steps for Compliance Teams
Review Threshold Logic by Chain
If your sanctions screening programme applies uniform thresholds across all chains, the data above suggests it is miscalibrated. TRON's 30% spam rate and BSC's 44.5% counterfeit token penetration rate mean that an undifferentiated approach will either generate excessive alert volume or miss genuine risk by suppressing too aggressively. Document chain-specific threshold rationale now, before a regulator asks.
Audit Ledger Data Ingestion
Ask your crypto bookkeeping software provider or internal data team how the system handles counterfeit token events. Specifically: does it ingest all token transfer events from block explorers, or does it validate token contract addresses against a known-good registry? If the answer is the former, you may have phantom asset balances in client ledgers that need to be reviewed and corrected.
Train Staff on the Mechanics
Compliance analysts who understand why a wallet has received thousands of USD 0.00 transfers, and can identify the tell-tale patterns of address-truncation spoofing, will clear legitimate alerts faster and escalate genuine risk more reliably. The TRM analysis provides a useful technical foundation for internal training materials.
Frequently Asked Questions
Does receiving a dust transfer create a tax liability?
In most jurisdictions, unsolicited receipt of a token is technically a taxable receipt at its fair market value. For dust transfers with a value of USD 0.00 or a fraction of a cent, that amount will almost always fall below any practical materiality threshold, but the principle still applies. Firms should ensure their digital asset accounting software classifies these correctly rather than ignoring them entirely, so that records are auditable.
Can a counterfeit token event create a false asset balance in accounting records?
Yes, if your data pipeline ingests raw token transfer events without validating the originating contract address against the genuine token's contract. A counterfeit token event can appear as a receipt of a well-known stablecoin or governance token. If the software does not distinguish between the real and fake contract, it may record a phantom asset. Firms should confirm with their data providers how contract verification is handled.
Are firms required to screen dust transfers under sanctions regulations?
Sanctions obligations are generally transaction-based and do not exempt transfers simply because their value is negligible. However, regulators expect screening programmes to be risk-calibrated. Firms can document a threshold below which dust transfers are assessed as presenting negligible economic risk, provided that rationale is defensible and consistently applied. A firm that dismisses dust alerts without any documented rationale is in a weaker position than one that has a written policy setting out why USD 0.000X transfers fall outside the scope of meaningful exposure.
Why does spam vary so much between blockchains?
Fee economics and chain architecture drive the variation. Low-fee chains like TRON and Solana make mass dusting viable at almost no cost per transfer, so attackers run it at volume. Higher-fee chains like Ethereum make mass dusting uneconomical, pushing attackers toward fewer but more precisely targeted counterfeit token contracts that can reach many wallets per deployment. Solana's mint-authority validation also makes counterfeit token spoofing structurally impractical there, which is why dust dominates instead.
What should a firm do if it discovers counterfeit token events in a client's ledger history?
The first step is to identify all affected entries by validating the token contract address for each event against the legitimate token's published contract. Entries generated by counterfeit contracts should be reclassified, typically as nil-value non-economic events, and the adjustment documented with a clear audit trail. If the ledger has been used to prepare financial statements or tax returns, an assessment of materiality is required to determine whether amendments are necessary.
Source: TRM Labs