Key takeaways
- Spam transfers function at industrial scale throughout main blockchains. Greater than 2.7 billion suspected spam transfers crossed TRON, Ethereum, BSC, and Polygon between January and August 2026, reaching roughly 709 million pockets addresses. On Solana, a additional 2.5 billion mud transfers landed in Q1 2026 alone.
- On TRON, 30% of all transfers between January and August 2026 have been potential mud, and 60% of lively wallets receiving funds have been touched by dusting.
- The size and sort of spamming varies by blockchain economics and structure. Low-fee chains allow high-volume dusting and zero-value transfers, whereas higher-fee chains favor extra focused counterfeit token spoofing. Solana’s mint-authority validation makes counterfeit token spoofing impractical at scale.
- Spam creates a measurable operational burden for compliance groups. In 2026, 38% of all sanctions alert dismissals originated from mud. That quantity diverse by means of the yr, beginning In January 2026 at 25% and falling to 10% by August 2026, with surges round sanctioning events like HTX.
- The typical measurement of a sanctions alert dismissal as a consequence of mud is negligible (USD 0.0000588), with the median quantity being USD 0.00 because of the zero-value switch tokens, suggesting these dismissals will not be eradicating economically vital exercise.
- How a lot of that burden reaches any particular person agency is an institutional alternative. Corporations have huge latitude over what their screening controls flag and at what thresholds, and probably the most mature compliance groups weigh sender, pockets traits, quantity, and hop sample in combination fairly than performing on any single information level.
{{horizontal-line}}
Between January and August 2026, 30% of every little thing that moved on TRON was spam. Throughout 5 main blockchains, billions of transfers a yr carry no worth and serve no person’s intent — they exist to plant an deal with in somebody’s transaction historical past. This report measures how a lot of that spam there may be, what it prices the individuals sending it, and what it prices the compliance groups who need to separate it from real publicity.
What is blockchain noise?
A significant share of on-chain exercise doesn’t mirror actual financial habits. As an alternative, it consists of transactions that create data with out representing real person intent or worth switch. Widespread sources of this exercise embrace:
- Inner service transactions generated by platform operations fairly than person exercise
- Pockets consolidation transfers
- Dusting transfers that ship negligible quantities to populate pockets transaction histories
- Zero-value transfers that create transaction data with out transferring funds
- Counterfeit token transfers involving tokens designed to resemble official belongings
- Spam and airdrop campaigns that distribute unsolicited tokens throughout massive numbers of wallets
Among the many varieties of non-economic exercise, this report focuses on spam transfers: unsolicited mud, zero-value transfers, and counterfeit token transfers. The intention of these transfers just isn’t at all times seen on-chain. Some are deliberate address poisoning, an assault that manipulates pockets transaction historical past by planting attacker-controlled addresses resembling official counterparties. Others are routine automated exercise, such as exchanges activating their very own deposit addresses. The evaluation subsequently identifies spam based mostly on transaction traits fairly than making an attempt to deduce the sender’s intent.
{{58-as-much-as-30-of-a-blockchains-transfers-are-spam-heres-what-it-means-for-sanctions-screening-callout-1}}
The size of the issue
Throughout 5 main blockchains between January and August 2026, greater than 2.7 billion suspected spam transfers crossed TRON, Ethereum, BSC, and Polygon, alongside a additional 2.5 billion mud transfers on Solana within the first quarter alone. The depth is most seen on TRON, the place mud makes up 30% of complete transfers, reflecting repeated and systematic air pollution of transaction histories fairly than one-off occasions.
TRON and Solana lead in dusting quantity. On Solana, 2.5 billion mud transfers landed in Q1 2026 alone, accounting for 13% of exercise and reaching 27 million addresses. These figures cowl Q1 2026 solely, so they don’t seem to be straight corresponding to the eight-month totals for the opposite 4 chains.
Trying solely at lively addresses — those who obtained no less than one switch on the chain in the course of the interval — a massive share encountered spam no less than as soon as: 60% on TRON by means of dusting, 44.5% on BSC by means of counterfeit tokens, and 20.8% on Ethereum by means of zero-value transfers. Spam is a structural characteristic of the transaction panorama on all 4 EVM and TRON networks measured.
BSC is dominated by counterfeit token spoofing. Greater than 460 million pretend switch occasions occurred between January and August 2026, with roughly 7,000 counterfeit-token contracts reaching greater than 454 million addresses, or 44.5% of lively receivers.
Ethereum sees decrease spam volumes total, however attackers there get extra out of every contract than on every other chain measured. Simply 390 counterfeit-token contracts reached 30.6 million addresses, roughly 18% of lively Ethereum receivers, which is near 79,000 addresses per contract towards roughly 65,000 on BSC and 29,000 on Polygon.
Polygon sees a combine of all three assault sorts, with 24% of lively receivers hit by counterfeit tokens no less than as soon as. Roughly 790 counterfeit-token contracts reached 22.7 million addresses.
The economics and structure of blockchain spam
Spam is viable solely the place transfers value little relative to the payoff, so it concentrates on low-fee chains. Which methodology attackers use follows the charge regime.
On TRON and Solana, dusting runs at quantity for nearly nothing. TRON’s bandwidth and vitality delegation mannequin lets accounts transact with out burning tokens, so all dusting on TRON throughout practically eight months value a mixed USD 1,799. A thousand mud transfers on Solana prices beneath USD 1.
Ethereum inverts this. Dusting and zero-value transfers value roughly USD 115 and USD 200 per thousand, so a few thousand transfers runs into the lots of of {dollars}. Counterfeit tokens value a fraction of a cent per switch, since one deployment reaches many victims, and attackers shift accordingly. The economics nonetheless maintain: one sufferer in a thousand misdirecting a stablecoin switch repays a marketing campaign many occasions over.
Ethereum can be getting cheaper. Dusting fell from roughly USD 200 per thousand in January 2026 to about USD 45 by August. Community fuel was flat throughout that interval, so this was a bidding change fairly than a charge reduce — spam senders paid 0.18 gwei by August towards a 0.61 community common — with a falling ETH worth accounting for a lot of the remaining. Community fuel sat beneath one gwei all through, so “higher-fee” describes Ethereum relative to the opposite 4 chains, not in absolute phrases.
BSC and Polygon sit between. Dusting on BSC prices about USD 28 per thousand, pushing attackers towards counterfeit tokens and zero-value transfers. Polygon is extra even, at USD 7 to eight per thousand for each, with counterfeit tokens beneath USD 0.25.
Structure units the ceiling. On EVM chains any contract can emit switch occasions for any token, which is what lets counterfeit tokens work at scale. Solana’s token program validates mint authority on each switch, so an attacker can’t forge occasions for tokens they don’t management, leaving dusting as successfully the one vector there.
What it prices compliance groups
For compliance groups operating sanctions screening, spam creates a measurable drawback by producing alerts from unsolicited inbound transfers fairly than real person habits.
To this point in 2026, 36% of sanctions alert dismissals have been related to spam. In January, roughly 25% of dismissals throughout organizations traced to spam exercise after excluding one outlier group with an unusually excessive quantity of spam-related alerts. The impression could be way more pronounced at a person group. Together with that outlier raises the January share to 80%.
How a lot of that burden reaches any particular person compliance workforce depends upon how its screening controls are designed. As Tom Armstrong, TRM’s Head of Compliance Advisory, places it, companies have huge latitude over what exercise they flag and at what thresholds. Extra mature approaches contemplate sender and middleman traits, transaction quantities, and hop patterns collectively fairly than treating any single information level as determinative. An unsolicited inbound switch of a fraction of a cent, from an deal with with no different historical past, is a completely different threat proposition from a funded switch from a counterparty with sustained publicity, and screening logic can mirror that distinction. When screening controls account for these distinctions, the quantity of dust-driven alerts reaching an analyst queue falls sharply.
By August 2026 the share of dismissed sanctions alerts traceable to mud had fallen from roughly 25% to 10%. Together with the outlier talked about above, the quantity declined from 80% to 33%. That decline displays higher screening configuration fairly than much less spam. Compliance groups are getting extra environment friendly at filtering this noise earlier than it reaches an analyst queue. Compliance groups will not be dismissing economically vital exercise. The typical measurement of a sanctions alert dismissal as a consequence of mud is negligible (USD 0.0000588), with the median quantity being USD 0.00 because of the zero-value switch tokens.
Nonetheless, single occasions can disrupt the noise occurring on the blockchain. For instance, in June 2026, instantly after the UK designated HTX, the share of dismissed sanctions alerts traceable to mud rose to 66%, up from 25% in January. A surge in dusting round a main designation feeds straight into alert quantity, which suggests dust-specific screening guidelines matter most at precisely the second screening queues are already beneath pressure. It can be one purpose publicity screening must extend beyond the designated addresses themselves.
What comes subsequent
Spam is unlikely to vanish as lengthy as transfers could be inserted into pockets histories at negligible value. The sensible objective is subsequently to cease that exercise from deceptive customers and producing pointless compliance alerts.
For compliance groups, meaning distinguishing spam from real publicity utilizing transaction worth, deal with habits, and different contextual alerts. On the pockets layer, stronger safeguards can scale back the prospect that spammed transaction histories flip into precise losses: validating paste targets, flagging addresses that seem solely in mud transactions, and warning customers about unfamiliar locations.
Till these protections grow to be commonplace, spam will stay a low-cost approach to exploit the hole between what occurs on-chain and the way that exercise is introduced to customers.
{{horizontal-line}}
Continuously requested questions (FAQs)
1. Can spam transfers steal funds from my pockets with out my motion?
No. Spam transfers don’t compromise personal keys or enable an attacker to maneuver funds straight. The danger arises solely when a person copies a lookalike deal with from their transaction historical past and manually sends funds to it.
2. How can I defend myself?
Confirm the total vacation spot deal with earlier than sending funds fairly than counting on the shortened deal with displayed by a pockets. Saved deal with books also can scale back the necessity to copy addresses from transaction histories.
3. What is TRM doing about blockchain spam?
TRM identifies spam exercise throughout TRON, Ethereum, BSC, Polygon, and Solana and helps compliance groups distinguish it from real sanctions publicity. TRM Transaction Monitoring permits groups to mix a number of situations when assessing publicity, which helps separate spam from transactions that warrant additional investigation. TRM has additionally partnered with Sphinx to use AI compliance brokers to first-line alert triage, together with resolving sanctions alerts brought on by spam.
4. Why is blockchain spam troublesome to cease?
The underlying transactions utilized in many spam campaigns, such as sending very small quantities of tokens to a different pockets, will not be inherently malicious. Mixed with the extraordinarily low value of producing these transactions on some blockchains, that makes the exercise troublesome to forestall on the protocol degree. The extra sensible defenses are figuring out spam and stopping customers from mistaking attacker-controlled addresses for official counterparties.
