Probability of Generating a Bitcoin Address with Specific Starting and Ending Characters

I've recently come across a situation where scammers are generating (bitcoin) addresses that have the same starting and ending characters. This is concerning as many people, including myself, often check the starting and ending characters of an address when making a transfer. Furthermore, many wallets hide the middle part of the address with an ellipsis for a cleaner UI, making this scam even more effective.

I understand that a collision in bitcoin addresses is virtually impossible due to the vast address space, and there are already several discussions on this topic. However, I am interested in a slightly different question: What is the probability of someone being able to generate a Bitcoin address that has the same last four characters? Or, to take it a step further, what is the probability of generating an address that has the same first four and last four characters?

I am looking for a detailed explanation of how to calculate these probabilities, as well as the results of these calculations. Any help would be greatly appreciated.

• Did you want to take into account the prescribed initial characters like `bc1`? a lot of addresses start with that of course. So the probability changes over time with adoption of new address types. Aug 3, 2023 at 16:11

base58check

For addresses that use base58check, only the first character is a prefix, and each other character encodes one of 58 values. To generate an address that matches at least the first four and last four characters exactly, the attacker would have to generate an expected over 2 trillion addresses (587 ≈ 2.2080×1012).

If you compare the first six and last six it’s already almost 25 quintillion.

However, base58check addresses use both upper and lowercase characters, so it might be easier to produce an address that is similar enough to fool the victim by allowing some replacements (e.g. uppercase S instead of lowercase s).

bech32(m)

In bech32(m) addresses, the first 3 characters are fixed `bc1`, the next character encodes the version (currently `bc1q` for version 0 and `bc1p` for version 1 are in use). The attacker can match that by using the appropriate output type as well.

Beyond that each character encodes five bits (32 possibilities). So, I would expect that each additional character to match would reduce the probability by a factor of 32, i.e. if you are trying to find an address that matches in three additional characters, you’d need to generate an expected 323 or 25×3 different witness programs.

So, to produce an address that matches in the first four (e.g. `bc1p`) and last four characters, an attacker would only need to generate about 1 million (25×4) addresses to get a match.

To match the first six and last six, it would be about a trillion (25×8 ≈ 1.0995×1012).

To match the first eight and last eight, it would be about a quintillion (25×12 ≈ 1.1529×1018).

I would recommend that you at the very least compare the first six and last six characters.

Recommendation

For any presentation of addresses that hides the middle with an ellipsis, I would recommend that it shows at least eight characters before and after the ellipsis. Four characters before and after the ellipsis would definitely be unsafe.

• W.r.t your final recommendation, I'd love to see some numbers i.e. why is 1:trillion easy to crack but 1:quintillion impossible? Aug 7, 2023 at 18:11
• I think there is a misunderstanding, because that's not what I wrote. It's too little to look at so few letters that generating a million addresses is enough to fool you. You should look at enough letters that an attacker would need to generate at least a trillion addresses. OTOH, if you're defining a representation, it should have at least a quintillion possibilities.
– Murch
Aug 8, 2023 at 1:48
• I would expect that it's more or less trivial to generate and test more than a million addresses per second (see e.g. this answer from 2011) bitcoin.stackexchange.com/a/2088/5406) even when you're attacking many users. Generating a trillion addresses per potential target is 1000000 the effort. Even if 12 years later we could do about 250× the computations, it would be expensive to attack many in this manner. A quintillion would be even one million times harder, which would require some serious targeted effort. It might actually be getting a bit low.
– Murch
Aug 8, 2023 at 1:56