<p>Why address reuse is discouraged:</p>
<ol>
<li><strong>Reduced security</strong> An unused address is protected by <a href="https://en.bitcoin.it/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">ECDSA</a> <strong>AND</strong> several <a href="https://en.wikipedia.org/wiki/SHA-256" rel="nofollow noreferrer">SHA-256</a> and <a href="https://en.bitcoin.it/wiki/RIPEMD-160" rel="nofollow noreferrer">RIPEMD-160</a> operations, but only ECDSA after being used because the public key must be revealed during spending. This has been shown to open up several possible attacks in the past.[1]</li>
<li><strong>Reduced privacy</strong> All participants who you give the address to know it is yours obviously.  They can use this information to analyze incoming and outgoing transactions to identify other addresses you own and who you are interacting with, not to mention how much bitcoin you have.  This can be serious for businesses in competition or in situations where a payment might put someone into harms way (<a href="https://shop.wikileaks.org/donate#db3" rel="nofollow noreferrer">politically unpopular donations</a> or as a means for extortion, etc).</li>
</ol>
<p>[1] More info: <a href="https://en.bitcoin.it/wiki/Address_reuse" rel="nofollow noreferrer">https://en.bitcoin.it/wiki/Address_reuse</a></p>

CC BY-SA 4.0
2016-01-15T14:20:37.153Z
2022-12-10T20:15:04.973Z
2022-12-10T20:15:04.973Z
Jonathan Cross
<p>It is absolutely safe at the moment since ECDSA is considered safe. People rather don't like to reuse to preserve anonymity or make coins harder to steal.</p>

<p>This is because addresses in Bitcoin are not published directly in terms of the public key, but a hash of it. This way nobody can link the hash to the corresponding public key as long as the contained coins are not spend in an transaction. Then the holder of the coins needs to prove ownership by revealing the public key in order to enable others to validate the signature.</p>

CC BY-SA 3.0
2014-01-26T23:54:36.213Z
Why? Could you please elaborate more this answer? Thank you.
Felipe
CC BY-SA 3.0
2014-02-19T10:34:52.883Z
Yes, I'd appreciate if you'd elaborate on that.
Luca Matteis
CC BY-SA 3.0
2016-01-15T14:23:42.167Z
I downvoted because the answer does not explain position in enough detail.
Jonathan Cross
CC BY-SA 4.0
2021-03-11T21:56:49.643Z
"as long as the contained coins are not spent in a transaction" - why?
Rebroad
CC BY-SA 4.0
2014-01-15T19:56:42.650Z
2018-08-31T22:11:08.513Z
2018-08-31T22:11:08.513Z
John T
<p>There are both security and privacy related issues that arise from address reuse. Based upon your question you are less concerned with the privacy implications and more concerned with the security implications in this question. I will discuss security first before briefly mentioning why the privacy implications are greater than the security implications.</p>
<p><strong>Address Security</strong></p>
<p>Bitcoin addresses are derived randomly by generating a private and public key pair. When an address is generated both the private and public keys are secret to everyone except the owner of the wallet. At this point your address has 100% security assuming the device that it is stored on is not compromised already. When you provide someone with your bitcoin address to send you funds they do not learn anything about the public or private keys even though the address is derived from the public key. So far so good, right?</p>
<p>The first issue/security risk I will discuss is a specific implementation issue in a mobile wallet library. It is worth knowing how a <a href="https://en.bitcoin.it/wiki/Protocol_documentation" rel="nofollow noreferrer">bitcoin transaction is structured</a> to understand this issue but without getting too technical you may want to read this article about what happened when <a href="http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html" rel="nofollow noreferrer">the same K value is used in multiple signatures</a>. When this issue arose it was trivial to derive the private key protecting the funds in question and <a href="https://bitcoinmagazine.com/articles/critical-vulnerability-found-in-android-wallets-1376273924" rel="nofollow noreferrer">attackers were able to steal a reported 55+ bitcoins</a>. As part of a bitcoin transaction the public key associated with the address is revealed to the network.  This allows the blockchain to validate that indeed that public key is associated with the address sending funds. It also validates that the signature provided could only be generated by the private key associated with the public key which was now revealed. If the user that were attacked did not reuse addresses and sent all of the funds stored out of this address to a new address after spending some of the funds, the new address would be 100% secret again. This issue has been fixed and should only represent a concern if you are using a wallet that has not had a proper cryptographic audit.</p>
<p>The next class of security issues I will touch upon is <a href="https://en.wikipedia.org/wiki/Side-channel_attack" rel="nofollow noreferrer">side channel attacks</a>. These kind of attacks can become technical in discussion very fast so I will not go into details but essentially specific hardware platforms can be made to leak information about their current state thus allowing an attacker to determine random values the CPU will generate in the future. This again allows the k value (also known as the ephemeral key) to be leaked and private keys can be recreated. One such side channel attack know to target ECDSA is the <a href="https://eprint.iacr.org/2014/140.pdf" rel="nofollow noreferrer">FLUSH and RELOAD</a> attack.</p>
<p>Although side channel attacks are unlikely to be performed on someone randomly without targeting it would be much easier to attack someone that is not using privacy preserving techniques. Which leads me to briefly touch on the privacy aspects of address reuse.</p>
<p><strong>Privacy Concerns</strong></p>
<p>The first thing to consider when deciding whether or not to reuse your bitcoin address is that privacy not only impacts yourself when using bitcoin it also impacts everyone else that you transact with. Using blockchain analysis it is trivial to determine which companies you may be doing business with, how much money you could be holding, as well as your complete ledger history of everyone that your address has transacted with.</p>
<p>There has been tracking attempts that also work to associate addresses with each other and &quot;collapse identities&quot; based upon transactions that are public for everyone to see on the blockchain. Addresses that are downstream from your known address could be used to make illegal or purchases that could catch the interest of law enforcement and this could lead them to your doorstep because of association with particular transactions.</p>
<p>Read more about <a href="https://en.bitcoin.it/wiki/Address_reuse" rel="nofollow noreferrer">why you should not reuse addresses</a> including 2 real world examples of unscrupulous activity that could occur if someone knew how much money you had stored or earned over a regular schedule (such as payroll).</p>

CC BY-SA 4.0
2021-03-25T21:46:12.017Z
I think both attacks affecting security here are a bit besides the point: correct implementations aren't going to be vulnerable to either. Vulnerabilities are of course something to be wary of in any case, but it's far more complex than that. Certain types of side-channel attacks are going to be an issue regardless of address reuse (because even when not reusing addresses, keys will be derived from the same seed - and if that derivation has side-channel weaknesses, they apply regardless).
Pieter Wuille
CC BY-SA 4.0
2016-01-15T16:15:33.867Z
2022-12-15T22:31:57.577Z
2022-12-15T22:31:57.577Z
Mark S.
<p>Besides the obvious privacy implications, and (according to a <a href="https://bitcointalk.org/index.php?topic=139381.0">bitcointalk.org forum post</a>) the fact that once an address is used your coins that rest on it safety depend entirely on the ECDSA safety (as opposed to your coins being secure if at least two of ECDSA, SHA256 and RIPEMD are secure for any address that were never used to send BTC) - are there any other reasons why it is a bad idea to reuse the same address (for sending as well as receiving BTCs) frequently?</p>

<wallet-security><address-reuse>
Is it safe to reuse a Bitcoin address?
Felipe
# Is it safe to reuse a Bitcoin address?

(Asked by: username_0 on 2014-01-15)

Besides the obvious privacy implications, and (according to a [bitcointalk.org forum post](https://bitcointalk.org/index.php?topic=139381.0)) the fact that once an address is used your coins that rest on it safety depend entirely on the ECDSA safety (as opposed to your coins being secure if at least two of ECDSA, SHA256 and RIPEMD are secure for any address that were never used to send BTC) - are there any other reasons why it is a bad idea to reuse the same address (for sending as well as receiving BTCs) frequently?

**Tags:** wallet-security, address-reuse


---

## 3 answers

### Answer by username_5 on 2016-01-15. Score: 19 | Accepted answer

There are both security and privacy related issues that arise from address reuse. Based upon your question you are less concerned with the privacy implications and more concerned with the security implications in this question. I will discuss security first before briefly mentioning why the privacy implications are greater than the security implications.

**Address Security**

Bitcoin addresses are derived randomly by generating a private and public key pair. When an address is generated both the private and public keys are secret to everyone except the owner of the wallet. At this point your address has 100% security assuming the device that it is stored on is not compromised already. When you provide someone with your bitcoin address to send you funds they do not learn anything about the public or private keys even though the address is derived from the public key. So far so good, right?

The first issue/security risk I will discuss is a specific implementation issue in a mobile wallet library. It is worth knowing how a [bitcoin transaction is structured](https://en.bitcoin.it/wiki/Protocol_documentation) to understand this issue but without getting too technical you may want to read this article about what happened when [the same K value is used in multiple signatures](http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html). When this issue arose it was trivial to derive the private key protecting the funds in question and [attackers were able to steal a reported 55+ bitcoins](https://bitcoinmagazine.com/articles/critical-vulnerability-found-in-android-wallets-1376273924). As part of a bitcoin transaction the public key associated with the address is revealed to the network. This allows the blockchain to validate that indeed that public key is associated with the address sending funds. It also validates that the signature provided could only be generated by the private key associated with the public key which was now revealed. If the user that were attacked did not reuse addresses and sent all of the funds stored out of this address to a new address after spending some of the funds, the new address would be 100% secret again. This issue has been fixed and should only represent a concern if you are using a wallet that has not had a proper cryptographic audit.

The next class of security issues I will touch upon is [side channel attacks](https://en.wikipedia.org/wiki/Side-channel_attack). These kind of attacks can become technical in discussion very fast so I will not go into details but essentially specific hardware platforms can be made to leak information about their current state thus allowing an attacker to determine random values the CPU will generate in the future. This again allows the k value (also known as the ephemeral key) to be leaked and private keys can be recreated. One such side channel attack know to target ECDSA is the [FLUSH and RELOAD](https://eprint.iacr.org/2014/140.pdf) attack.

Although side channel attacks are unlikely to be performed on someone randomly without targeting it would be much easier to attack someone that is not using privacy preserving techniques. Which leads me to briefly touch on the privacy aspects of address reuse.

**Privacy Concerns**

The first thing to consider when deciding whether or not to reuse your bitcoin address is that privacy not only impacts yourself when using bitcoin it also impacts everyone else that you transact with. Using blockchain analysis it is trivial to determine which companies you may be doing business with, how much money you could be holding, as well as your complete ledger history of everyone that your address has transacted with.

There has been tracking attempts that also work to associate addresses with each other and "collapse identities" based upon transactions that are public for everyone to see on the blockchain. Addresses that are downstream from your known address could be used to make illegal or purchases that could catch the interest of law enforcement and this could lead them to your doorstep because of association with particular transactions.

Read more about [why you should not reuse addresses](https://en.bitcoin.it/wiki/Address_reuse) including 2 real world examples of unscrupulous activity that could occur if someone knew how much money you had stored or earned over a regular schedule (such as payroll).

> **Comments:**
> **username_6**: I think both attacks affecting security here are a bit besides the point: correct implementations aren't going to be vulnerable to either. Vulnerabilities are of course something to be wary of in any case, but it's far more complex than that. Certain types of side-channel attacks are going to be an issue regardless of address reuse (because even when not reusing addresses, keys will be derived from the same seed - and if that derivation has side-channel weaknesses, they apply regardless).  

---

### Answer by username_1 on 2016-01-15. Score: 7

Why address reuse is discouraged:

1. **Reduced security** An unused address is protected by [ECDSA](https://en.bitcoin.it/wiki/Elliptic_Curve_Digital_Signature_Algorithm) **AND** several [SHA-256](https://en.wikipedia.org/wiki/SHA-256) and [RIPEMD-160](https://en.bitcoin.it/wiki/RIPEMD-160) operations, but only ECDSA after being used because the public key must be revealed during spending. This has been shown to open up several possible attacks in the past.[1]
2. **Reduced privacy** All participants who you give the address to know it is yours obviously. They can use this information to analyze incoming and outgoing transactions to identify other addresses you own and who you are interacting with, not to mention how much bitcoin you have. This can be serious for businesses in competition or in situations where a payment might put someone into harms way ([politically unpopular donations](https://shop.wikileaks.org/donate#db3) or as a means for extortion, etc).

[1] More info: <https://en.bitcoin.it/wiki/Address_reuse>


---

### Answer by username_2 on 2014-01-15. Score: 2

It is absolutely safe at the moment since ECDSA is considered safe. People rather don't like to reuse to preserve anonymity or make coins harder to steal.

This is because addresses in Bitcoin are not published directly in terms of the public key, but a hash of it. This way nobody can link the hash to the corresponding public key as long as the contained coins are not spend in an transaction. Then the holder of the coins needs to prove ownership by revealing the public key in order to enable others to validate the signature.

> **Comments:**
> **username_0**: Why? Could you please elaborate more this answer? Thank you.  
> **username_3**: Yes, I'd appreciate if you'd elaborate on that.  
> **username_1**: I downvoted because the answer does not explain position in enough detail.  
> **username_4**: "as long as the contained coins are not spent in a transaction" - why?  

---

