Accidentally reused bitcoin address

Question

I've understood that address reuse undermines privacy and potentially also security in the future. Recently though, I accidentally reused the same public address when receiving funds from an exchange. Is there a way to fix this and future proof the security of my funds? Would it perhaps be sufficient to send all the funds to a new public address under the same private key or would I need to generate a totally new wallet?

Answer 1

There's no perfect answer for this question and it depends on individual.

You had used address A (one of the outputs) in a transaction 1 where inputs are from X.

You used the address A (one of the outputs) again in a transaction 2 where inputs are from Exchange Y.

IF someone is trying to analyze transaction 1 to know the owner of address A, he can look at transaction 2 to assume owner has an account on Exchange Y. Most of the withdrawal transactions from exchanges are done in batches with lots of inputs and outputs involved so it won't be easier to know more information about the owner except if one of the below tries to investigate:

Exchange, chain analysis companies, government agencies (in case of centralized exchanges) etc.

You have two options in my opinion:

1. Ignore and avoid reuse in future
2. Coinjoin

Answer 2

Is there a way to fix this and future proof the security of my funds?

Your funds are secure, its just your privacy that has been damaged slightly.

The 'security worry' isn't really a worry at all. It comes from the fact that when you spend one of the two inputs locked to that address, the public key will become known to the network. Thus, if anyone discovers a technique to calculate private keys from public keys (breaking the discrete logarithm problem (DLP)), then they could perhaps steal funds still residing in addresses that have exposed public keys.

This isn't really a worry, for a couple reasons:

• the DLP is considered computationally intractable, there is no known method for breaking it, and thus a lot of modern day cryptography relies on it to remain secure
• if the DLP is broken, then millions of coins which reside in addresses with exposed public keys will be vulnerable, as will any coins which a user attempts to spend normally. The network will likely become ~worthless unless (until?) a fix can be deployed, as will many other cryptographic systems which also rely on the DLP. The 'security gain' of not having your coins stolen is thus not really worth much at all

Would it perhaps be sufficient to send all the funds to a new public address under the same private key or would I need to generate a totally new wallet?

Nothing can undo the transactions which were already confirmed, anybody watching the chain and tracking the funds in order to attack your privacy will already have knowledge of the address re-use. Sending both UTXOs to a new address won't accomplish anything in this regard. Starting a new wallet also won't matter, as each address a wallet creates looks the same to a third party observer (there is no way to discern whether an arbitrary address belongs to the same wallet as any other address). In fact, if you started a new wallet and transferred all funds to it in one transaction, that would likely be worse for your privacy (due to a consolidation of funds).

Your best course of action is just to continue on as normal, and try not to reuse funds in the future. As Prayank mentioned, you could consider participating in a coinjoin transaction, to obfuscate the history of your coins. Wallets such as Joinmarket or wasabi can help to accomplish this (disclaimer: I am not associated with either project. Do your own research before using this software).

Answer 3

1. Fund is safe.
2. Your hardware wallet supporting Hierarchical deterministic wallet will take care of it.BIP32, BIP44. In fact, it can generate new private key and public key for every subsequent transaction. The wallet will have a master key generated by the random seed. 512 bits. This 512 bit is used to generate your private key for every transaction.