Bitcoin Forum

If i send someone btc, can they see what kind of wallet i use?

Can they tell for example if i use a blockchain wallet or electrum?

From what little i understand depending on adress format they can only see if i use legacy or segwit wallet, nothing more than that. Is this true?

Thanks guys i really need some quick help here !

Looking at the raw transaction, no. You'd have to probably do an indepth analysis of the spending behaviour. There could be some behaviours that could give clues to what kind of wallet it is. It's by no means accurate though. For example, a transaction without opt-in RBF and with a legacy address could be a Blockchain.com wallet but it could also be someone intentionally disabling opt-in RBF or just spending from an old Bitcoin Core client.

You can also spend Segwit inputs together with P2SH(3...) or P2PKH(1...) inputs on most wallets so a transaction won't be indicative of what kind of wallet it is primarily.

Ok thank you so much Ranochigo ! Im really grateful for your reply !

So in other words, i probably can send btc from a blockchain wallet and still claim that i have used electrum? There is no way to be 100% sure that im using a blockchain wallet right?

Yes, Blockchain.com actually do have a lot of features missing so that could leave some clues but it won't be concrete. Though I'm not sure why that would be an issue at all. I don't use Blockchain.com wallet as the features that it has pales in comparison to Electrum. Consider switching to Electrum nonetheless.

I too will suggest you to use electrum for bitcoin because it is one of the best wallet to save bitcoin, but why are you asking such a question? In my opinion, someone can only guess if you send from a particular wallet, the guess can be correct or completely wrong because there is no evidence they will have to know the wallet you sent from because there are many Bitcoin wallets that are existing and the wallets sent from is not included on blockchain.

Yes, not accurate especially if the transaction does not support RBF because there are many wallet that do not support RBF while the RBF can be disabled on the wallets that support it, also there are many wallets that support legacy addresses which also not supporting RBF.

electrum doesn't let you mix and match address types except for imported private keys. usually you can tell which address is the change address and which one is the recipient's.

as for other things they usually stick to bips. for example lexicographic ordering:

https://en.bitcoin.it/wiki/BIP_0069

Depending on the service the sender used, you can often (but not always) tell if someone has sent from an exchange or other custodial-type service... as your transaction will be "batched" up and included in a "Pay2Many" type transaction (ie. 1 or 2 very large value inputs and then 10s/100s of smaller outputs). However, even a scenario like this is not "100% guaranteed", as software like Electrum and even Bitcoin Core allow users to send "Pay2Many" transactions... and some online services don't batch transactions.

Sometimes, it is possible to lookup the spending addresses on walletexplorer.com and you will see the name of the exchange/website (for the bigger, more popular ones).

But in general, it's pretty much impossible to identify with any real certainty what wallet a transaction originated from...


May I ask, why you want to know and/or care? ???

No.
The correct answer is: It depends.

There are multiple characteristics which might give it away.
It also depends on who we are talking about. A random person on the internet? No, he won't know which wallet you used.
A powerful institution (maybe with contact to your ISP)? Yes, they will know what kind of wallet you used, for sure.

But why do you even ask that question? Who cares what wallet you are using?
The only one caring should be someone who cares about you. And lying to them is... not a nice thing to do..

P.s. Web wallets are horrible. There is not a single good reason to use them. You should consider switching to a real wallet.

For personal wallet, a wallet that you own the seed, the receiver would not know what wallet you are using.

I guess it's easier to determine who owns the addresses than determining what type of wallet you are using.

For example, if you send bitcoin from exchanges or vice versa, there are ways to determine who owns the address, I guess there are sites that you can check on that, I just can't remember it, might this one not too relevant but I just want to add it in case you are interested to know.

With a VPN, the VPN provider for sure knows what kind of wallet you are using.
Without, the ISP does.

While Tor definitely might help here, a full node could be prohibited from connecting to the bitcoin network via Tor by exploiting the built-in DoS protection. Resulting in either a clear net connection, a tor-only connection (excluding the clear-net bitcoin nodes, resulting in 2 separated networks, at least for a maximum of 24 hours which would be easier to "control" privacy-wise) or no connection at all.
SPV wallets via Tor are a different story again. If we are talking about a SPV wallet building on top of bitcoinj, that's probably the only thing one could determine using the privacy leaking bloom filter.

I am not saying that it is definitely possible to find it out. Especially not with Tor. But it's not impossible.

However, since OP asked whether someone can find out if he is using blockchain.com or electrum, i heavily doubt he even ever heard of Tor.
And in his case.. an institution definitely could find out which wallet he is using. A random stranger on the internet, can't.

---

If you don't know anything about the topic, better don't talk about it.
Or at least don't make it sound as if you know anything.

You said it literally, "if you use a vpn or an ISP they can find out about that and Tor in individual cases", and this is what I meant in my post "Internet Provider".
Please don't be stupid with me :)

You missed the crucial point.
My statement is that the ISP can find this out / knows this.
Your statement is that only the ISP can.

That's a huge difference.

You can't answer this question with a generic "only X can do Y".
It depends on the whole situation. In some theoretical circumstances every single person could find out which wallet is being used (e.g. weird individual locktime set).

This most probably is not the case for OP, but a generic answer to such a question is simply wrong.

We have 3 options ISP, VPN and TOR. You say now only ISP can. and here you say vpn can too.


so what do you mean specifically since in any internet situation, provider will know it?

You are right but the receiver will know the wallet is a personal wallet and in this case I usually advise the use of a wasabi wallet even when privacy is not the top priority (when not using the coinjoin) cause the wallet cant be found by walletexplorer.com

Sort of, cause it is easy to know if the wallet use belongs to an exchange site while personal can be identified as personal the wallet provider cant be known.

walletexplorer.com but OXT research and chainanalysis also offer in-depth research service in this kind of situation.

Where did is say that?
I gave you an theoretical example where any 3rd person can do that?

And if you are using a VPN, yes.. obviously the VPN provider knows everything about you (and they do make money off your data).




?

You can safely just ignore Bob and his 'Theories' if you want to make any progress at all.

There is no wallet type stored if you send BTC.
Only a address type and that does not reveal anything about any wallet that was or was not used.

I am shocked to see that much ignorance and stubborn behavior.

If you read the topic closely (i know you can do it!), you will see that the question never was if there is any "wallet type stored".

You might want to first learn about address types and how they work. And then you could stop writing stupid things (https://bitcointalk.org/index.php?topic=5309665.msg56119686#msg56119686).
Afterwards, you can start to actually contribute to discussions which are currently way above your knowledge. Until then, it is all spam.

You are right. But I'm curious why would you lie about what kind of wallet you are using? Because in a sense of sending a payment to them there would be no difference when it comes to what they receive may it be from an Electrum wallet or on a custodial wallet like Coinbase. Or is this guy trying to force you to install Electrum just to send a payment? If this is the case then maybe its a good time to run away because he might just be there trying to scam your BTC.

Wallets are not traceable you can only see what address used on blockchain explorer, if for instance you use no replace by fee on replace by fee wallet, it will be impossible to know because alnostball wallets can not replace fee. What people can still try to be able to track is your balance, it is not also easy work to do this, but this can be know during certain  unspent output transactions.

If you're worried about privacy, Blockchair's Privacy-o-meter (as displayed on under every transaction (https://blockchair.com/bitcoin/transaction/60a3c62d4db8d128bc68669b86c182f6d60327110733902d74a3046f72e7ab70)) might be interesting:
https://loyce.club/other/Privacy-o-meter.png

See the Documentation (https://blockchair.com/api/docs#link_M6).
You can also use this to fake data, for instance setting a round fee when that's not typical for the wallet you're using. Or sending a round amount to your change address, so it looks like that's the main transaction you were making.

If that is the case, how does anyone able to tell where some of the stolen bitcoin were sent? For example, there are some hacking incidents to an exchange platform, then investigators was able to tell that some of the stolen funds were sent to binance, and some some was sent to coinbase. How's that? How did they knew it was sent to those trading platforms? AFAIK they can also be considered as bitcoin wallets.

Custodial wallets are completely different from the wallets that OP mentioned. Those wallets usually have definitive behaviors, like spending to a central wallets and for which Binance posts theirs publicly but it wouldn't be hard to determine which are the common addresses belonging to the various exchanges. As said in my reply, if you want to determine those kinds of transactions, you'll be looking at the spending habits, periodic spending to specific addresses, batched transactions to known addresses, etc.

If you're using a custodial "wallet", then this shouldn't be a topic at all.

I'm using non-custodial one. I just wonder how those people able trackdown where does those stolen funds was sent. So if the hacker who stole the funds sent it to a secured wallet, like trezor, would those people who investigates the incident still be able to know that it was sent to a trezor wallet? As I understood, they won't, since it isn't centralized. Thanks for the inputs.

Depends. If you use Trezor with a wallet like Electrum, the server will be able to see the addresses associated with the origin IP. It could be requested through a VPN, Tor or proxy. If you were to see it through the transactions associated with the addresses alone, you probably won't know. Unlike custodial wallets, they tend to not have any obvious heuristics that would leave any clues.

Not just by looking at blockchain records, no.

When investigators say that coins ended up on Binance, for example, this conclusion is usually done by tracking coin movements as opposed to looking at transaction properties and heuristics. For example, if we see some stolen bitcoin move from one address to another address in a 1-input-2-output transaction, and then we see it move from that second address in a transaction with 100 inputs all from different addresses in to a single address, then we can reasonably assume that the first transaction was the bitcoin being deposited to a centralized service, and the second transaction was that centralized service sweeping a bunch of deposits from different customers in to their own main wallet. If we can identify that main wallet address, (for example, since you mentioned Binance, we know one of Binance's main wallet addresses is 34xp4vRoCGJym3xR7yCVPFHoCNxv4Twseo), then we can identify which exchange or service it was that those coins were deposited to.

If on the other hand, we see the stolen coins move to a new address and just sit there indefinitely, then we can assume that the attacker has simply moved them to another wallet to hold for a period of time, but we cannot say what kind of wallet that is just by looking at the blockchain.

Signature payments are batched in that way and campaign managers use the Pay2Many feature to pay all the participants at once. If the address the funds are sent from contains a lot of bitcoin originally, you would get exactly those results you explained. 1 larger input and x number of smaller outputs with same or similar amounts, depending on the payment structure of the campaign.   

The difference with signature campaign payments is that they pay (mostly) the same addresses on a weekly basis, and that each output is exactly the same size (if fixed payment per week) or below a fixed cap (if paid per post). Conversely, batched exchange withdrawals pay different addresses each time at different times each week, and outputs will range from anything between a few tens of thousands of sats up to several bitcoin. It is generally fairly easy to differentiate the two.

Not always true about VPNs though. Some VPNs have a no-log policy, and many of them have been shown to actually maintain it and this has also been tested in court multiple times. These are the VPNs that do not store your data, so neither do they make money off of your data, nor can they provide info to law enforcement even if their hand is forced, as they simply cannot. How do they earn money? By taking a monthly fee from you and making sure that they are true to their word so they do not lose customers. One example for this has been PIA (their claims have held up in court pretty well), but idk if that will be the case anymore since Kape Technologies has bought them out.

Source: PIA No-log claims held up in court (https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/)

My point is, not every VPN sells your data off to make money, its mostly the ones that aren't vetted and generally have poor privacy practices. The free ones all DO sell your data, thats how they are free and they shouldn't be used anyways if privacy is your concern.

You don't know for sure that the VPN provider isn't logging your data, though. Yes, some of them have no log policies, and yes, some of the good ones have either been tested in court or undergone independent audits and have proven that they do not keep logs. However, that only definitively proves they were not keeping logs at that time. Saying that they are not keeping logs now is an extrapolation from that data and is not verifiable.

The point about PIA is an important one. They have previously been tested in court, but since then have been bought out by a very unethical company with very dubious business practices, and so I would not trust that they are still not keeping logs of some form, despite what they may tell you.

Yes, there are good VPNs out there which do not log traffic, but since your data passes through their servers unencrypted, then you can never be 100% sure you are not being logged, either by the VPN provider themselves or a malicious third party exploiting some vulnerability.