Address reuse

Bitcoin addresses are free and effectively unlimited, and nothing in the protocol stops you from using one twice. Satoshi's whitepaper argued against it in section 10, recommending a new key pair for each transaction so payments cannot be tied to a common owner. Reuse is what turns a pseudonymous ledger into a searchable record of your finances.

How it works

The blockchain is a public index, and an address is the key it is indexed by. Every block explorer offers an address search box that returns the whole history on one page: each payment in, each payment out, the running balance, and the timestamps. Loading that page costs nothing and requires nobody's permission.

Using an address once produces a single row. Using it forty times produces forty rows that provably belong to the same recipient, and each payer can read the other thirty-nine. Nothing was broken to learn this. The ledger is public by construction, and the only privacy available is the difficulty of attaching a name to a string.

Reuse also changes what is known about the key behind the address. In a pay-to-public-key-hash or pay-to-witness-public-key-hash output, the address commits to a hash and the public key stays unpublished until the first spend. Spend once and that key is on chain forever. Keep receiving at the same address afterward and every later coin sits behind an exposed public key rather than a hidden one, which is a weaker position for no benefit at all.

Wallets solved this years ago without asking you to think about it. A BIP-32 account holds 2,147,483,648 addresses on its receiving branch alone, and the receive screen advances to the next unused one after every payment. Bitcoin Core marks addresses as used and declines to hand them out again. Reusing an address on purpose today generally means copying an old one out of your own history.

Why this matters when you buy bitcoin

Every exchange that verified your identity holds your withdrawal address in a compliance record, and reuse is what lets that one record cover everything you own.

Withdraw to the same address 52 times over a year and you hand the exchange, its analytics vendor, and anyone who subpoenas either of them a single thread that unwinds your entire savings position. Withdraw to a fresh address each time and those same parties see 52 unconnected outputs whose relationship must be inferred rather than read off a page. Inference is often possible. It is also work, and it is not proof.

Withdrawal whitelists complicate the advice, and pretending otherwise would be dishonest. Kraken, Binance and most large venues let you restrict withdrawals to a saved list of addresses, which is a strong defense against somebody who takes over your account, and it pushes you toward reuse. The workable compromise is to whitelist several addresses from the same wallet rather than one, and to keep the whitelist. Account takeover empties more wallets than chain analysis does.

Businesses face the blunt version of the problem. A shop that prints one QR code and tapes it to the counter is showing every customer its daily takings and its balance. Payment processors derive a fresh address per invoice from an extended public key for precisely this reason, and a donation page that publishes one static address has chosen publicity over privacy, sometimes without realizing it.

What a reused donation address reveals

Publish one address in a public profile, leave it there for a year, and the readable result is uncomfortable.

Anyone can total the amount received to the satoshi, count the individual payments, and read the minute each one landed. A donor who paid straight out of a verified exchange account can be matched to their own contribution and then see every other contribution beside it. When you eventually spend, the transaction reveals which coins you picked, how much came back as change, and where it went, to an audience that already knows the address belongs to you by name.

Silent payments, specified in BIP-352, are the modern answer to that trade-off. You publish one static string exactly as before, and each sender uses it to compute a different on-chain address, so the public identifier stays constant while the chain shows nothing in common between the payments. It needs no consensus change, only support in both wallets, which is why availability is patchy rather than universal.

Address reuse vs merging inputs

Address reuse links payments arriving at one address; merging links coins that arrived at several. A merge happens whenever one transaction spends two or more inputs together, which tells every observer that a single party held the keys to all of them, a rule chain analysis firms call the common input ownership heuristic. The two problems compound. Careful address hygiene is undone by one sweep that spends everything at once, and coin control is the answer to the second problem, not the first.

Address reuse vs a dusting attack

Address reuse is self-inflicted; a dusting attack is done to you. An attacker sends a few hundred satoshis to thousands of addresses and waits for recipients to merge that dust into a larger transaction, which links the dusted address to the rest of their coins. Reuse needs no attacker and leaks considerably more, since it exposes a full payment history rather than one link. Both are handled the same way: fresh addresses on the way in, deliberate input selection on the way out.