diff --git a/README.md b/README.md
index 67d4fbf..50eddd0 100644
--- a/README.md
+++ b/README.md
@@ -524,11 +524,22 @@ indexes it as a real token transfer.
accidentally interacting with a spoofed token that appeared in their balance
via a fake Transfer event.
+- **Dust transaction filtering**: A second wave of the same attack used real
+ native ETH transfers instead of fake tokens. Transaction
+ `0x2708ebddfb9b5fa3f7a89d3ea398ef9fd8771b83ed861ecb7c21cd55d18edc74` sent 1
+ gwei (0.000000001 ETH) from `0xC3c6B3b4402bD78A9582aB6b00E747769344F37E` —
+ another look-alike of the legitimate recipient `0xC3c693...`. Because this is
+ a real ETH transfer (not a fake token), none of the token-level filters catch
+ it. AutistMask hides transactions below a configurable dust threshold
+ (default: 100,000 gwei / 0.0001 ETH). This is high enough to filter poisoning
+ dust while low enough to preserve any transfer a user would plausibly care
+ about. The threshold is user-configurable in Settings.
+
- **User-configurable**: All of the above filters (known symbol verification,
- low-holder threshold, fraud contract blocklist) are settings that default to
- on but can be individually disabled by the user. AutistMask is designed as a
- sharp tool — users who understand the risks can configure the wallet to show
- everything unfiltered, unix-style.
+ low-holder threshold, fraud contract blocklist, dust threshold) are settings
+ that default to on but can be individually disabled by the user. AutistMask is
+ designed as a sharp tool — users who understand the risks can configure the
+ wallet to show everything unfiltered, unix-style.
### Non-Goals
diff --git a/src/popup/index.html b/src/popup/index.html
index 4211288..4dcb69a 100644
--- a/src/popup/index.html
+++ b/src/popup/index.html
@@ -565,6 +565,22 @@
/>
Hide transactions from detected fraud contracts
+
+