42

For example I have an address (A) with 20 BTC and send 9 BTC to address (B). Bitcoin will create a "change" portion of the transaction where the remaining 11 BTC goes to address (C).

Why not send the change back to A?

Instead of:

Initial balance: 
A: 20 BTC 
B: 0 BTC 
C: 0 BTC

Transaction Pair: 
A -> B 9 BTC 
A -> C 11 BTC

End result 
A: 0 BTC 
B: 9 BTC 
C: 11 BTC

Why not?

Initial balance:
A: 20 BTC
B: 0 BTC

Transaction Pair:
A -> B 9 BTC
A -> A 11 BTC

End result
A: 11 BTC
B: 9 BTC
  • 7
    and is there an option in the client to turn this off (i.e. send back to the original address)? – Thilo Oct 20 '11 at 1:14
  • 1
    Related: bitcoin.stackexchange.com/questions/736/… – Thilo Oct 20 '11 at 1:16
  • 5
    I've got a 'noprivacy' branch at github.com/gavinandresen/bitcoin-git that sends change back to the funding address, but it confuses the heck out of the 'accounts' code and makes for confusing-looking transaction lists. – gavinandresen Oct 21 '11 at 18:58
  • 1
    Is there any solution than? I would also prefer when the change come back to the original address. – user1059931 Dec 9 '13 at 13:18
38

Two reasons:

  1. So whoever sent to your "A" address can't claim to have sent you 31 bitcoins ("See! Look on block explorer, there are two transactions sending to "A", one for 20 bitcoins and one for 11-- send me back the extra 11!")

  2. Using a new change address makes it more difficult for other people to track of how many bitcoins you have or where you're spending them.

  • 22
    It also conceals which output is the "spend" and which is the "change". – David Schwartz Oct 18 '11 at 22:41
  • 25
    The preventing a false claims would be of dubious value. Transactions are irreversable anyways and the transaction will clearly indicate the coins went from A to A. The second part of your answer plus David clarification seems most likely rational. – DeathAndTaxes Oct 19 '11 at 13:48
  • 4
    Sending the change somewhere else makes it look like you spend your whole balance, which is not the case. It can be very confusing for beginning users. I think this should be an opt-in option for the default client. – Steven Roose Apr 29 '13 at 13:25
  • 4
    I also think separate change addresses are a very bad "feature". Sending back to the same address would prevent paper wallets becoming obsolete when a part of them is spent. Obfuscating payment flow should also not be part of the "official" bitcoin client. Keeping the ledger straightforward would lend Bitcoin more legitimacy. – yippy_yay Nov 19 '13 at 13:04
  • 1
    @DeathAndTaxes, so basically Gavin's first point is wrong/invalid? – Pacerier Mar 20 '14 at 19:55
17

While the other answers are slightly true, there's another reason. Addresses which have been spent are inherently less secure than unspent addresses. This is because, when spending on an address, you reveal the public key to the address. This means that in order to steal those funds, you only need to find the private key, whereas normally you'd need to break the hash and find the private key.

Both of these tasks are extremely difficult, so for now it's not much of a concern if you send to spent addresses. The problem arises with the theoretical quantum computer. ECDSA, the technology which secures your private key, is extremely easy for quantum computers to reverse. The hash isn't. Therefore, when quantum computers become popular used addresses will become exponentially less secure.

More info at https://bitcoin.stackexchange.com/a/7134/11666

Also: https://bitcointalk.org/index.php?topic=153302.0

In the BitcoinTalk post, the concern brought up about hackers cracking transactions between broadcast and inclusion in blocks is reasonable. Fortunately, honest miners include the first transaction first regardless of fee, so that attack is foiled. It is also prevented by the fact that it would still take quite some time to crack the public key.

  • Why do you believe breaking a key pair is easier than breaking a crypto hash? – Basic Dec 17 '14 at 18:25
  • en.wikipedia.org/wiki/… – Eric Pauley Dec 22 '14 at 3:54
  • @Basic, because the Public key is generated from the Private key via SHA256 algorithm, which is vulnerable to quantum computer attack. While the Bitcoin address is generated from the Publik key by using both SHA256 and RIPEMD160 algorithms and potantial hackers will need to attack 2 different encryptions. – Sulevus Jan 4 '18 at 20:25
  • @Sulevus If you encrypt/hash something multiple times, it doesn't necessarily make it more secure... It depends entirely on how the two systems preserve entropy across multiple operations. – Basic Jan 5 '18 at 14:33
8

The idea of the change addresses is an attempt to make transactions anonymous. Unfortunately, bitcoin transactions are not anonymous, even with the use of change addresses:

When you have a wallet filled with change addresses, transactions will be forced to use some of those change addresses to fill transactions you want to make. The fact that the receiver is the same, and that the time of transaction is the same means that an outside observer will have a high confidence that those addresses belong to the same person. If all of those addresses only received bitcoins from a single address, it will be very clear they are change addresses for that address.

What the above means is that your addresses become deanonymized when they are used. This makes your privacy basically worthless because anyone can look back a couple years and see everyone you paid or received money from.

This is not necessarily a bad thing, as the tracability of transactions will make it harder for governments to justify fighting the adoption of bitcoins.

While you might gain a tiny bit of privacy for a short period of time using change addresses, there is a HUGE downside: it makes backing up your money intractable. If you want to back up an address, you can do that easily. Just encrypt your wallet and copy it to various devices (your phone, external HD, USB drive, paper wallet, etc). If change addresses are used tho, you must copy to all your backups (as painful as printing out a new paper wallet) every time you make a transactions. That is intractable.

That intractability I think is a HUGE problem for bitcoins. People need a secure way of being "their own bank" and change addresses make bitcoins broken for most people.

UPDATE: Deterministic wallets somewhat solve this problem by allowing you to determine all of the wallet's potential addresses from a single seed value. This allows you to backup once, and restore at any later time by using the seed to generate and check addresses until you're sure you haven't used any beyond the ones you checked. Armory, Electrum, and CarbonWallet all use deterministic wallets.

  • I really like this answer, but it seems like it would be better provided under another question. Gavin's answer is 100% true, and this answer would be better for a question about the anonymity of change addresses. – Colin Dean Dec 9 '13 at 14:02
  • @BT , so how does Dark Wallet work then? – Pacerier Mar 20 '14 at 19:59
  • @Pacerier I don't know much about Dark Wallet, but there can certainly be much more complicated schemes that keep addresses more anonymous. This would involve things like staggered transactions and sophisticated transaction mixing. These aren't your average transactions. They're complex techniques and they're just as useful without the use of change addresses. – B T Sep 17 '14 at 22:04
  • @ColinDean, Is the "quandary" typo in your profile intentional? – Pacerier Sep 18 '14 at 11:56
  • @BT, However, adding the use of change addresses does increase the cost of unanonymizing right? – Pacerier Sep 18 '14 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.