<blockquote>
  <p>But on bitcoin.it, it is recommended to never reuse addresses (not only for Privacy (not my concern here) but especially for security purposes).</p>
</blockquote>

<p>It doesn't make a security difference. The two attacks mentioned (deriving k through a timing attack, and reusing k for two transactions) have very little to do with address reuse.</p>

<p>If you don't care that someone can link your transactions together, listing a constant donation address is fine.</p>

CC BY-SA 3.0
2015-03-04T19:21:18.927Z
2015-03-04T19:21:18.927Z
Nick ODell
<p>The main security risk is that the elliptical curve might get broken in which case reusing addresses will become unsafe. You can use armory to make new addresses every time if this is a big concern.</p>

CC BY-SA 3.0
2016-01-15T15:14:02.480Z
Does somebody know why this is downvoted? Is this accurate?
Murch
CC BY-SA 3.0
2016-01-19T01:06:39.553Z
I would love to know myself =)
Jimmy Song
CC BY-SA 4.0
2021-03-12T07:14:49.043Z
@Murch Probably because he is wrong. You can receive an infinite amount of donations to the same address and as long as you have never SPENT anything from it, you public elliptic curve key is not known to anyone but yourself, only the hash of it. A quantum computer could reverse a public key, but to our knowledge it cannot reverse a hash of one.
Chris_F
CC BY-SA 3.0
2015-03-05T22:04:09.103Z
2015-03-05T22:04:09.103Z
Jimmy Song
<p>For a blog that only receives occasional small amounts you probably shouldn't worry too much about it.  However, if you plan to scale up, here are some things to consider:</p>

<p>One issue with using the same address for all transactions is that people can see the total amount received by that address and know how many bitcoins you have.  If the total is large enough, this might make you a target for attack, especially if you publish personal information along with the bitcoin address.  </p>

<p>Another potential issue is that people can see who else is donating to you.  They only see the bitcoin addresses used, but this might be enough to draw some conclusions about who they are.</p>

<p>Best practice is to use new addresses for each donation.  This way there is no link among the transactions except in your wallet, which is only accessible by you.  </p>

<p>If you plan to keep bitcoins (instead of just receiving them and cashing them in), you should look into creating an offline wallet.  You could generate a new address for each web page view, and then transfer funds from each of the addresses that received a donation to a different pre-computed offline wallet address.  </p>

CC BY-SA 3.0
2015-03-04T18:30:20.467Z
2015-03-04T18:30:20.467Z
juhraffe
<p>I am running a blog and would like to receive donations from my followers. So I thought to add a bitcoin address on my "Support me"-page!</p>

<p>But on <a href="https://en.bitcoin.it/wiki/Address_reuse#Security" rel="noreferrer">bitcoin.it</a>, it is recommended to never reuse addresses, which is supported by citing not only Privacy concerns (not my concern here) but especially for security reasons. </p>

<p>So:</p>

<ol>
<li>Is it safe to use (and thus reuse) the same address for all my donations?</li>
<li>If not, what are the best practices?</li>
</ol>

<security><donation><address-reuse>
Receiving donation on a bitcoin address and security issues of reusing the same address
MagTun
# Receiving donation on a bitcoin address and security issues of reusing the same address

(Asked by: username_0 on 2015-03-04)

I am running a blog and would like to receive donations from my followers. So I thought to add a bitcoin address on my "Support me"-page!

But on [bitcoin.it](https://en.bitcoin.it/wiki/Address_reuse#Security), it is recommended to never reuse addresses, which is supported by citing not only Privacy concerns (not my concern here) but especially for security reasons.

So:

1. Is it safe to use (and thus reuse) the same address for all my donations?
2. If not, what are the best practices?

**Tags:** security, donation, address-reuse


---

## 3 answers

### Answer by username_5 on 2015-03-04. Score: 5 | Accepted answer

For a blog that only receives occasional small amounts you probably shouldn't worry too much about it. However, if you plan to scale up, here are some things to consider:

One issue with using the same address for all transactions is that people can see the total amount received by that address and know how many bitcoins you have. If the total is large enough, this might make you a target for attack, especially if you publish personal information along with the bitcoin address.

Another potential issue is that people can see who else is donating to you. They only see the bitcoin addresses used, but this might be enough to draw some conclusions about who they are.

Best practice is to use new addresses for each donation. This way there is no link among the transactions except in your wallet, which is only accessible by you.

If you plan to keep bitcoins (instead of just receiving them and cashing them in), you should look into creating an offline wallet. You could generate a new address for each web page view, and then transfer funds from each of the addresses that received a donation to a different pre-computed offline wallet address.


---

### Answer by username_1 on 2015-03-04. Score: 2

> But on bitcoin.it, it is recommended to never reuse addresses (not only for Privacy (not my concern here) but especially for security purposes).

It doesn't make a security difference. The two attacks mentioned (deriving k through a timing attack, and reusing k for two transactions) have very little to do with address reuse.

If you don't care that someone can link your transactions together, listing a constant donation address is fine.


---

### Answer by username_2 on 2015-03-05. Score: -2

The main security risk is that the elliptical curve might get broken in which case reusing addresses will become unsafe. You can use armory to make new addresses every time if this is a big concern.

> **Comments:**
> **username_3**: Does somebody know why this is downvoted? Is this accurate?  
> **username_2**: I would love to know myself =)  
> **username_4**: @username_3 Probably because he is wrong. You can receive an infinite amount of donations to the same address and as long as you have never SPENT anything from it, you public elliptic curve key is not known to anyone but yourself, only the hash of it. A quantum computer could reverse a public key, but to our knowledge it cannot reverse a hash of one.  

---

