<p>because exposing your private keys on your computer will expose them to all the viruses and keyloggers on your computer that non-experts tend to have.</p>

<p>thats one reason</p>

CC BY-SA 4.0
2024-02-18T16:28:54.540Z
This is not specific to Bitcoin, though. It's true of all financial authentication.
Cameron Hudson
CC BY-SA 3.0
2013-12-12T18:51:55.143Z
2013-12-12T18:51:55.143Z
CQM
<p>Importing a private key can lead to non-intuitive behaviour, and that can be exploited by an attacker.</p>

<p>Imagine I'm evil. I give you a paper wallet with 1 mBTC on it. You're happy and import it. I keep the private key and wait. Depending on the client/user, maybe someday you'll put some real money on there as change/received funds. Then I can swipe them right off from you. If you don't bother moving the original money off the key, I can also steal that back.</p>

<p>If not, then at the very least I can trick you next time into thinking you were paid by sending funds to that address. Then I can steal them right back.</p>

<p>Importing also tends to break backups, especially deterministic key schemes. Armory gives you one line of text for all your keys, and then 1 line <em>per imported key</em>. Every time you import, you'll need to redo all your backups.</p>

<p>Because most users don't understand these implications, wallets tend to discourage importing, and instead offer <em>sweeping</em> (moving the funds to an address that was generated by the wallet itself). Supports 90% of the use cases with none of the issues.</p>

CC BY-SA 3.0
2014-03-12T21:38:00.210Z
In other words, you should only import private keys that are only known to yourself.
uminatsu
CC BY-SA 3.0
2017-06-25T04:14:24.457Z
If that's the reason for the warning, the warnings should be re-written to specifically say that any coins in the wallet are still accessible to anyone who has the private key.  It's confusing that many sources say "users should never import private keys", but then don't say why and leave users wondering how they're correctly supposed to spend coins from their own private paper wallets.
orrd
CC BY-SA 3.0
2014-03-12T21:08:33.903Z
2014-03-21T23:39:43.413Z
2014-03-21T23:39:43.413Z
Christophe Biocca
<p>Blockchain.info and other products make you read dire (but vague) warnings that "you must be an expert" before you can import private keys.  What's that all about?</p>

<private-key><import><private-key-import>
Why so many warnings about importing private keys?
RentFree
# Why so many warnings about importing private keys?

(Asked by: username_0 on 2013-12-12)

Blockchain.info and other products make you read dire (but vague) warnings that "you must be an expert" before you can import private keys. What's that all about?

**Tags:** private-key, import, private-key-import


---

## 2 answers

### Answer by username_3 on 2014-03-12. Score: 21 | Accepted answer

Importing a private key can lead to non-intuitive behaviour, and that can be exploited by an attacker.

Imagine I'm evil. I give you a paper wallet with 1 mBTC on it. You're happy and import it. I keep the private key and wait. Depending on the client/user, maybe someday you'll put some real money on there as change/received funds. Then I can swipe them right off from you. If you don't bother moving the original money off the key, I can also steal that back.

If not, then at the very least I can trick you next time into thinking you were paid by sending funds to that address. Then I can steal them right back.

Importing also tends to break backups, especially deterministic key schemes. Armory gives you one line of text for all your keys, and then 1 line *per imported key*. Every time you import, you'll need to redo all your backups.

Because most users don't understand these implications, wallets tend to discourage importing, and instead offer *sweeping* (moving the funds to an address that was generated by the wallet itself). Supports 90% of the use cases with none of the issues.

> **Comments:**
> **username_4**: In other words, you should only import private keys that are only known to yourself.  
> **username_5**: If that's the reason for the warning, the warnings should be re-written to specifically say that any coins in the wallet are still accessible to anyone who has the private key.  It's confusing that many sources say "users should never import private keys", but then don't say why and leave users wondering how they're correctly supposed to spend coins from their own private paper wallets.  

---

### Answer by username_1 on 2013-12-12. Score: 1

because exposing your private keys on your computer will expose them to all the viruses and keyloggers on your computer that non-experts tend to have.

thats one reason

> **Comments:**
> **username_2**: This is not specific to Bitcoin, though. It's true of all financial authentication.  

---

