0

I was going through some old posts regarding address reuse and came across a few remarks I wasn't aware of, and want to make sure I understood correctly.

I knew address reuse wasn't the best for privacy reasons, but I learned today that apparently it's also not good for security IF you've spend your bitcoins.

Let's consider the following situation: I have a brand new hardware wallet, generated a new seed with it, alongside a new address. I send from an exchange 1 BTC to it, and I decide to use this address as cold storage, meaning I'll regularly send BTC from exchanges to it, this specific address.

First of all, is it considered as address reuse if the address is only for cold storage, there's no transaction out but only UTXO's?

Now, let's say after a year of doing so this address has 50 UTXO's. I know this might cause an issue if the mempool gets full and tx fees rise, so I decide during a calm period to do some UTXO management and I do a "send all" to a new address that I generated from the same seed (so same private key). I effectively have a brand new address with only one UTXO.

My question: since i've used the same private key to both send a transaction (a big one, 50 utxo's) and generate a new address to send that to, does that expose me to security risks? (referring to this). If yes, how bad is it really and does that mean that to achieve full security I would need to generate a brand new seed on my hardware wallet and send once again the full balance to a new address?

Improve this question
7
  • The hardware wallets that I am aware of will all allow you to generate a new address to receive to every time you want to transfer in from an exchange (or any other reason). You don't need to generate a new seed, one seed can be used to generate an unfathomable amount of addresses. Even if your UTXO's are associated to different addresses on that wallet, you can still do a "send all".
    – Prince M
    Mar 25, 2021 at 21:26
  • 1
    Sure but that doesn't really answer my questions. I know I can do it, but since so many exchanges have address whitelisting nowadays, it's a little bit painful to do so (some exchanges require you to wait 48h / a week for each address whitelisted). I'm still wondering about the security issue I raised too.
    – Solal
    Mar 25, 2021 at 21:29
  • 1
    But in short, yes that would count as “address reuse”
    – Prince M
    Mar 25, 2021 at 21:38
  • 1
    Here's the thing I read that lead me to make this thread: bitcoin.stackexchange.com/a/42380/96844 A wallet that never performed a send has both its pubkey and private key secret to everyone. Not the case in my situation describe above. bitcoin.stackexchange.com/a/42376/96844
    – Solal
    Mar 25, 2021 at 21:39
  • 1
    I see. I wasn't sure if it was only related to software/hardware since this was a rather old thread. Thanks Pieter (grandmaster!) and Prince for your detailed responses.
    – Solal
    Mar 25, 2021 at 21:48

1 Answer 1

Reset to default
0

Not sure if I got your question right.

If you pay to the same address multiple times that is address reuse. Even if you never spend from that address. But if you don't spend from that address the issue would "only" be privacy related not security related.

When you spend from an address the ECDSA public key becomes publicly known. As far as I know this is only a security issue if ECDSA breaks. So it would not really be a problem as of today but it migth be 10 years from now. Therefore it's not advised to do so.

A bitcoin address is only the hash value of the ecdsa public key. That leads to the fact that you could not sign a transaction from that address even if you could break ECDSA because you don't even know the ECDSA public key.

BUT in the scenario you described you would not reuse the address after sending from it. The way a seed works is that you generate an arbitrary amount of pairs of private keys and corresponding addresses from it. So in your scenario you would generate privk_1 and address_1. Then you would make multiple payments to address_1. Later you would generate a second pair privk_2 and address_2 from the seed and send all your money from address_1 to address_2.

So if I got you right, I don't see any security problems with this. It's just that everyone would know that all the money belongs to a single entity. That is the afore mentioned privacy issue. I don't see the benefit of reusing that first address for receiving payments because you could simply generate a new address with your hardware wallet every time you want to receive bitcoin. Therefore I would not advice to receive everything on the same address.

Improve this answer
1
  • Thank you for this very detailed response. I think I got something wrong from the start: for some reason, I thought that the seed was the private key, and all addresses were generated from the same private key. But from what I understood from your response (and after double checking online), a new private key is indeed generated for each address. Embarrassing mistake on my part.
    – Solal
    Mar 26, 2021 at 17:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.