You received a tiny deposit you did not expect. Now what?
Small unsolicited transfers are usually a dusting attack or an address-poisoning setup. What they are for, and the one thing not to do.
Anyone can send to any address without permission, which means an unexpected small deposit is not a glitch and not necessarily good news. There are two common reasons someone does it deliberately.
Dusting
Someone sends a tiny amount — dust — to many addresses at once, then watches the blockchain to see which ones get combined with other funds later. Combining the dust with your other coins in a single transaction links those addresses together publicly.
The goal is deanonymisation: building a picture of which addresses belong to the same person. It costs the sender almost nothing and the information can be sold or used for targeted phishing.
Address poisoning
A nastier variant. The attacker generates an address whose first and last characters match one you have genuinely used, then sends you a tiny amount from it.
Now their address sits in your transaction history looking familiar. The hope is that next time you send, you copy the address from your history instead of from the real source — and the first and last characters will check out.
This works precisely because checking the start and end of an address is the habit people are taught. Against this one attack, it is not enough.
What to do
Nothing. Leave the dust alone. Do not spend it, do not consolidate it, do not try to send it back.
Never copy a destination address from your own transaction history. Always take it fresh from the source: the recipient's message, the exchange's deposit page, the wallet's receive screen.
If a tiny deposit arrives in BYCRYPTO that you did not expect, it is worth mentioning to support so it can be looked at, but it does not put your balance at risk by itself.