Why does Bitcoin use separate change addresses?

Question

When you create a wallet, it creates one bitcoin address, correct?

When I send funds, it sends all my funds; the person I sent it to gets what I sent, and the change from the transaction is sent to a second address.

If that last one is true, why does the change get sent to a second address? Why not send it to the original? Wouldn't it be so much simpler if the change was sent back to one address, and you only had that one address?

Answer 1

Change is sent to a new address to improve your privacy and the privacy of the other Bitcoin users you interact with. Let's imagine you receive a payment from Alice in one transaction; then you spend some of that money to Bob and the change is refunded to you. Then, in an unrelated transaction, you send Charlie some bitcoins.

Because you keep all of your bitcoins in a single address and Alice, Bob, and Charlie know who you are, all three of them can now easily use a block explorer to look up how many bitcoins you have. It's like letting your family, friends, bosses (past and present), local businesses, and everyone else you've ever transacted with know your exact current bank balance.

But who cares? If you're like me and you don't have a lot of bitcoins, that may not be a big deal. However, by reusing the same address for everything, you also reduce other people's privacy. For example, lets say Alice pays Charlie (and Charlie also uses the same address for all transactions).

Now Alice knows your address from the previous transaction and Charlie's address for this current transaction, so she can see that you paid Charlie. Charlie can do the reverse and see that Alice paid you---so by using a single address for everything, you may have reduced Alice and Charlie's privacy.

What Bitcoin Core and other high-quality wallets do is try to completely avoid address reuse. That means they prompt you to create a new address for every incoming payment and they always pay change to a new address. This helps keep transactions separate.

_{(broken image, original source)}

If you and Charlie use unique addresses, Alice may not be able to tell that you paid Charlie and Charlie may not be able to tell you received money from Alice. Also, it will be much more difficult for anyone to figure out exactly how many bitcoins you control.

(I say "more difficult" because there are still situations where Alice and Charlie may be able to identify the payments to/from you. Using unique addresses is a significant privacy improvement, but it's not perfect.)

Using separate change addresses costs you nothing extra over returning change to the same address (that is, the transaction will be the same size either way, so you pay the same fee) and it may have a slight security advantage when used with software that is broken in particular ways. However, the major advantage is that you improve your privacy and the privacy of everyone you transact with---and as someone who might trade with you some day, I thank you for using software that uses unique change addresses.

Note: Bitcoin.org's Choose Your Wallet page indicates whether a wallet uses unique change addresses by default, so anyone else reading this may want to use that page to select a wallet that improves their privacy.