Probability of Generating a Bitcoin Address with Specific Starting and Ending Characters

Question

I've recently come across a situation where scammers are generating (bitcoin) addresses that have the same starting and ending characters. This is concerning as many people, including myself, often check the starting and ending characters of an address when making a transfer. Furthermore, many wallets hide the middle part of the address with an ellipsis for a cleaner UI, making this scam even more effective.

I understand that a collision in bitcoin addresses is virtually impossible due to the vast address space, and there are already several discussions on this topic. However, I am interested in a slightly different question: What is the probability of someone being able to generate a Bitcoin address that has the same last four characters? Or, to take it a step further, what is the probability of generating an address that has the same first four and last four characters?

Related: Best way to calculate difficulty of generating specific vanity address?

I am looking for a detailed explanation of how to calculate these probabilities, as well as the results of these calculations. Any help would be greatly appreciated.

Answer 1

base58check

For addresses that use base58check, only the first character is a prefix, and each other character encodes one of 58 values. To generate an address that matches at least the first four and last four characters exactly, the attacker would have to generate an expected over 2 trillion addresses (58⁷ ≈ 2.2080×10¹²).

If you compare the first six and last six it’s already almost 25 quintillion.

However, base58check addresses use both upper and lowercase characters, so it might be easier to produce an address that is similar enough to fool the victim by allowing some replacements (e.g. uppercase S instead of lowercase s).

bech32(m)

In bech32(m) addresses, the first 3 characters are fixed bc1, the next character encodes the version (currently bc1q for version 0 and bc1p for version 1 are in use). The attacker can match that by using the appropriate output type as well.

Beyond that each character encodes five bits (32 possibilities). So, I would expect that each additional character to match would reduce the probability by a factor of 32, i.e. if you are trying to find an address that matches in three additional characters, you’d need to generate an expected 32³ or 2^5×3 different witness programs.

So, to produce an address that matches in the first four (e.g. bc1p) and last four characters, an attacker would only need to generate about 1 million (2^5×4) addresses to get a match.

To match the first six and last six, it would be about a trillion (2^5×8 ≈ 1.0995×10¹²).

To match the first eight and last eight, it would be about a quintillion (2^5×12 ≈ 1.1529×10¹⁸).

I would recommend that you at the very least compare the first six and last six characters.

Recommendation

For any presentation of addresses that hides the middle with an ellipsis, I would recommend that it shows at least eight characters before and after the ellipsis. Four characters before and after the ellipsis would definitely be unsafe.