Glossary / Addresses & keys
Vanity address
- Definition
- A vanity address spells out a chosen word or prefix in its own characters, found by grinding through random keys until one of them encodes the pattern.
Nothing clever is happening. A program generates a key, derives the address, checks whether the string starts the way you wanted, and repeats, billions of times if necessary. Each extra character you demand multiplies the work by 58 for a legacy address or by 32 for a bech32 one, so a six-character prefix on a legacy address means roughly 38 billion attempts.
How it works
Vanity generation is brute force against an encoding, never against the cryptography. A bitcoin address is a hash wrapped in a checksum and rendered in a restricted alphabet, so the only way to influence how it reads is to keep drawing fresh keys until one lands on a string you like. Working backward from a desired address to a key is not possible.
The arithmetic is unforgiving. Base58 uses 58 characters, so matching five characters after the leading 1 takes 656,356,768 attempts on average and six takes 38,068,692,544. Bech32 uses a 32-character alphabet, which is kinder: six characters after bc1q is 1,073,741,824 attempts. Tools such as vanitygen and its GPU forks chew through those rates at hundreds of millions of keys per second, which is why short prefixes are a novelty and long ones are a hardware budget.
Split-key generation exists for people who want the look without handing over a key. You generate a private key and send only the matching public key to whoever is doing the search. They grind for a partial key that combines with yours to produce the pattern, and you add the two halves together yourself. The searcher never learns the finished key. Any service that emails you a complete private key has already seen it.
Where you see it
Vanity addresses turn up wherever an address gets printed rather than scanned.
Donation pages, conference posters, exchange cold wallet addresses published as proof of reserves, and the burn addresses spelling out phrases that nobody holds a key to at all. Every one of those is a static, deliberately reused address, which means the owner has traded away the privacy a fresh address would give and accepted that the balance is a public figure anybody can read.
The cautionary tale comes from Ethereum and transfers directly. Profanity, a widely used vanity address tool, seeded its search from 32 bits of randomness, collapsing the space of possible keys to 4,294,967,296. The 1inch team disclosed the flaw in September 2022, and on September 20, 2022 the market maker Wintermute lost roughly 160 million dollars from an address that tool had produced. A vanity generator is a program whose entire job is manufacturing private keys, and you are trusting its randomness with everything the address will ever hold.
Vanity address vs address poisoning
A vanity address is chosen by its owner; a poisoned address is manufactured by an attacker to resemble yours. Address poisoning uses the same grinding technique to match the first and last four characters of an address you have already paid, then sends a token amount so the lookalike sits in your transaction history waiting to be copied by mistake. The habit vanity addresses encourage, reading a few characters and trusting the rest, is exactly the habit the attack depends on. Compare the entire string, or confirm it on a hardware wallet screen the computer cannot edit.