Bitcoin Forum

if I made a mistake in a BTC address, where my BTC will go?

http://www.nrao.edu/images/supermassiveBlackHoleRip510.jpg

A picture is worth more than a thousand words, they say...

 ;D
pretty clear answer!

There's a certain number of parity bits in Bitcoin addresses, so if you're only one letter off, a sane client should be able to detect that and warn you.

But if the parity bits check out... yeah, those coins are basically destroyed.

There is a checksum in the Bitcoin address.  The network will reject funds sent to INVALID addresses (not to be confused with "VALID but not the one I intended to send it to" addresses).

The odds of accidentally mistyping an address and it still be valid is roughly 1 in 4 billion.  So while the risk exists it is not really something to worry about.  It is more common that funds are lost because they are accidentally sent to the wrong (properly typed and valid but not intended) address.

Don't think of them as existing or not existing, think of them as being valid or invalid.

And since the Satoshi client(and most if not all others) allows you to only make a transaction using a valid Bitcoin address, you couldn't have sent it to an invalid one. The only question remaining now is whether you have the private key corresponding to the valid address you sent your bitcoins to, and if you don't does someone else.. and if no one does the bitcoins are lost just as if you deleted your wallet file with all your other private keys.

Here's an address:
1BitcoinEaterAddressDontSendf59kuE
While the checksum is valid, it's pretty safe to say that nobody owns the private key for 2 reasons:
-The probability of generating a case-sensitive vanity address that long is incredibly low
-All of its inputs are unspent

There are 2 choices:

First choice: Is the address valid?
Bitcoin adresses (similar to credit card numbers for example) have certain criteria they have to fulfill to be a valid address. Most clients will stop you from sending anything to an invalid address and no coins will ever be actually sent (= transaction included in a block) to an invalid address.

Second choice: Does someone actually own the private key to a valid address?
See the example with the "1BitcoinEater..." address above: it's a valid address, but very very VERY likely nobody will ever find a private key to be able to actually spend any coins sent there. You can send funds to any valid address you can think of (and there are many!), but only with a corresponding private key people will be able to actually spend these funds. Think of it like a bank deposit box, where you can (through a hole or something) deposit envelopes filled with cash - but only if somebody actually has the key to the box, he'll be able to get the money out and spend it. Bitcoin has a LOT of these boxes - so many, that you can simply generate your own key and claim the one box that fits as yours. It's practically impossible that anyone else would choose the same key, as there are so many boxes (addresses) out there.

Nope



There's a checksum. Just cause it starts with 1 and is the 'right' length doesn't mean it's always valid.

Edit: I checked this forgetting that I was on testnet. haha nevermind me....  :-[

Unless you are typing an address by hand this is not likely. Even if you make a typo or a few and they end up correcting themselves and making a valid key, the chances are pretty slim.

Here's a mathematically, cryptographically proven process for recovering bitcoins sent to a valid but otherwise unintended address. A vanity address generator can be used to reverse-engineer the private key from the (public) address. Take the Bitcoin address you accidentally mistyped (which now owns your bitcoins) and put it into a vanity address generator. The generator will create and test private keys until it finds one that produces a public address matching the one you're looking for, at which point you have the private key to reclaim your funds. Of course, you may need to wait several thousand years to find a match. The upside is that, by that time, Bitcoin will surely be the dominant currency in the local extra-solar economy, and your small sum today will certainly be worth quite a bit more due to deflation (only 21 million bitcoins being spread over a multi-planetary market).

Hope this helps.

FYPFY.  Baring a cryptographic flaw being discovered in ECDSA there is no possibility of ever recovering lost bitcoins.  Well not until man is able to harness power sources many hundreds of magnitudes more powerful than our star.

Awesome!

In a single word YES

This is indeed amazing!
Do you have any sources for that?

And what about that story that ECDSA is not quantum-proof? I suppose that's a "cryptographic flaw" then, meaning that a quantum computer can take a much shorter path than brute force. Is that the case?

This. You may want to get started now.

Above is correct. To elaborate, "sending" bitcoins is a bit of a misnomer. I've even read introductory tutorials that indicate that the recipient must "claim" the receipt. This is inaccurate and misleading. Here's a more accurate portrayal of a transaction: First, presume that you're Bitcoin client has the private key for an address, which has some bitcoin value assigned to it (from some other address, via the very process about to be described). Your client uses that private key to digitally sign a transaction message, assigning some (or all) of that value to another valid address. This transaction message (tx) gets broadcast to the Bitcoin network at large, where it is eventually accepted into a block on the blockchain, effectively setting it in stone for all time. Notice that your client did not require any knowledge of the recipient beyond a valid address, and there is no action taken by the recipient. The transaction is an irrevocable record that the recipient address (and corresponding private key) now "owns" (has control of, or "is able to transfer") the specified bitcoin value. The only way to re-assign that value to yet another address is by following this same procedure, which requires the private key of the "ownership" address.

Under the original post's scenario, that private key may be unknown to anyone. If anyone ever does generate that key pair (against astronomically incomprehensible odds), they mathematically and cryptographically "own" (because this is how the Bitcoin system is defined) any associated bitcoin value assigned to them by a transaction in the blockchain!

That was a bit long-winded, but my goal was to provide a more narrative description of the process. There are many more details about how transactions can be signed over, but I hope this helps explain the fundamental behavior of the network.

This is incorrect, I have been told on good authority that bulanula owns the private key for that address.  ;D

What if there is only a single error (or two) in the address (and I know which character(s)).

Can I vanitygen the key much faster?

Short answer, not at all.

You'd still be searching for one specific address in the full exponential sea of addresses, number of errors don't matter, just the possible solutions to look for (one) of possibilities (all addresses).

Generating key pairs is always a random process. There is no way to predict the length of time it will ever take to find any key/address. Likewise, there is no notion of progress toward finding any key/address. It's like you have a (very, very) big bin of ping-pong-balls whirling around (like for bingo or lottery drawings), each of which is a unique key pair. Generating a key pair (for vanity purposes or otherwise) is effectively like pulling a random ball from the bin. All the vanity generators are doing is pulling them out as fast as possible, looking at the public address for a matching string (your vanity word), and discarding any non-matches.

More precisely, probabilistically speaking, each chosen ball (whether "discarded" or kept in your wallet) are actually thrown back into the bin (they're just numbers and can never go away). The bin is just so big that no one is ever likely to pull that same ball back out.

There is actually one legitimate reason someone might want to send bitcoins to a fake address, thereby destroying them.

People working on alt-coins who want to make sure bitcoin prices rise as the alt-coin is adopted may choose to release some of their coins in exchange for bitcoin destruction.

I proposed this in The Second Bitcoin Whitepaper as a method of ensuring that alt-coin adoptions built on top of bitcoin don't completely leave bitcoin values in the dust (since bitcoins must have enough value to provide incentive to miners to keep the block chain secure).

Also you "get rid of coins" by sending them to the address which received the block reward for block 0 (http://blockexplorer.com/address/1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa). This block starts everything off, and is hard-wired into Bitcoin. It was never actually "mined". As such, the 50 generated coins in that address cannot be redeemed.

Additional payments to that address can be redeemed by Satoshi, if he still possesses the private key for that address. Since the date of that block (3 January 2009), people have sent almost 50 additional payments to that address, increasing its balance by more than 6 bitcoins.

It's kind of like tossing coins into a fountain for good luck. You have lost the coins forever, but you had fun making a wish.

If anyone wants to toss some coins into the Satoshi fountain, here is the address:
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

(edited to correct an error in my original post)

Only the generation transaction to that address can't be redeemed. Other transactions could be redeemed by Satoshi if he still has the private key.

Reference for the sun enough energy in our star to brute force 256 bit keyspace

http://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html

Note that the energy calculated is to count to 2^256 nothing more.

i.e. this code can't be completed even with a computer using all power of our star at perfect theoretical efficiency

Mathematicians overlook that computation is bounded by Physics. Computer Scientists lament it. Cryptographers depend on it. -- Nyhm

(Is it pretentious to quote my own proverbs? Is it tactless to jingle my proverbial tip jar?) 1NYhM2pzT6PDfZyXbyFm3dVcoob4phrGc5

Usually yes, but that one is ok.

Why, thank you for your compliment, fine Sir! ... *eagerly awaits new transactions*

Bitcoin - Ushering in a new era of online begging. -- Nyhm

Thank you theymos for clarifying (again). I'll edit my post to get it right this time.

Why can't the very first 50 bitcoins be spent?

Early versions of the client consider them unspendable to maintain compatibility all current versions also consider them unspendable.   If that were to change now it has the potential to cause a permanent fork in the network where some nodes see a block as valid and some as invalid when it contains block0 coins.  I think it was an oversight in the early code base but it is a "limitation" we are stuck with now. Given the potential for hard fork I doubt it will ever be patched.

I am amazed we worry much about the earliest clients and that there isn't a mechanism to deactivate them.  The earliest clients also allow for the creation of new bitcoins just by summing two numbers together in an overflow, but we assume everyone has upgraded.  I am guessing the original 50 BTC doesn't ever get added to the blkindex.dat and that's the reason it is unspendable.

I think the issue isn't just earliest clients anymore.  The "rule" (unintended or not) of block zero unintended or not has been carried forward this long.  There are now what 8 different clients in active development.  Changing the rule now while possible has the potential for huge disruptions if some/all clients don't implement it.  Given almost all of Satoshi early blocks have never been spent it doesn't seem like a huge issue.  Either Satoshi has no intention of spending them, or the private key is lost.   Even if it was spendable Satoshi (IMHO a group of people) mined thousands of blocks so it isn't like they NEED to spend that particular block.

Given the extremely tiny benefit is simply doesn't warrant disruption to the network. 

I understand this, I just wonder if some rationale was given for this "weird" rule.


For sure, definitely not worth the trouble. Particularly since it was Satoshi himself who created this rule, which only concerns his own coins.

What exactly are those odds? Is there a reference somewhere? I was trying to explain the finer details of Bitcoin to someone with a solid mathematics background, and I was having trouble finding the odds. is it like 1 in 2^50, or 1 in 2^100? Thanks!

IIRC, Bitcoin addresses rely on a hash called RIPEMD-160, giving 160-bit results, so the odds are about 1 in 2^160.

Yeah, it's good enough to refer to at some point. :)

The ECDSA private key behind it all is 256 bits.

Thanks! That's good enough for me!

Yes, but since the end-result is a 160-bit address, there's a certain loss of information. IOW, multiple 256-bit private keys could map to any given 160-bit address, so really only (::)) 2^160 bits worth of work needs to be done to crack any given address.

I'm not a cryptographer, but that's what I've read. Can anyone else confirm (or disprove) this?

That is correct.  The stength of private keys from a brute force attack is 2^160th.  An attacker doesn't need the exact private key they simply need any private key which produces the same address.  Still 2^160th is very large many many many magnitudes larger than what could be brute forced even with all the computing power on the planet AND a century of Moore's law at work.

The bitcoin address is basically a 160-bit hash, yes, but you need the private key to actually spend the bitcoins.

Not trying to be picky, I'm just wanting to know exactly how this works....

Would you need the original private key to spend the coins, or just any private key that ultimately hashes to the address?

You don't need the original private key to spend payments to a bitcoin address.  Any private key with the same bitcoin address will work.

We can see this by looking at the script on a random recent transaction (http://blockexplorer.com/tx/465127cc5bd87341acbbf308557b9eff005fc03dfa3c26b04de297d7277af3b4).  In order to spend the 50 BTC output of that transaction, we need to provide an input such that this script is satisfied:

OP_DUP OP_HASH160 f88b720031b65505f853bce809d4f4641744d2ae OP_EQUALVERIFY OP_CHECKSIG

ie. we need to put two values on the stack, one of which is a public key which has a hash160 of f88b720031b65505f853bce809d4f4641744d2ae, and the other of which is the signature obtained when signing the spending transaction with the corresponding private key.

At no point is there anything to distinguish the sender's private key - all we can see is the 160 bit hash of the sender's public key and so any suitable private key will do.

Any.  To spend coins sent to an address you need a private key which can sign the transaction.  Any private key which produces the same public address can properly sign a transaction.  For all intents and purposes Bitcoin addresses have 160bits of cryptographic strength.  Still there are certain advantages to making the keys 256bit.