Why reusing a bitcoin address can reduce your privacy

[Comeacross]

I have reading about UTXO and consolidation lately and I came across this phrase "Don't reuse addresses" during my exploration. Initially I thought it was just normal FUD for no reason but the more I continue reading, the more it appears. I was left with no choice but to play around with block explorers and then I think I know why it matters.

I maybe wrong but this is what I understand so far.
It links all transactions together publicly. For instance, if I send 3 separate payments to xxx address over a period of time, anyone can look into the chain and see that the address has 3 deposits even if the deposit came from different persons. Now it's obvious you are linked to these 3 people. You can avoid this by using a different deposit address for this 3 different people and the transaction becomes unrelated because block explorer can't identify whether you're the one depositing or other people.

Your wallet balance is basically public once you spend from a reuse address.

Even if you are careful, your associates can still implicate you because if they send to your old address, your previous transaction would be linked to theirs and one slip your address history will be out.

Now I understand why people use new address for each deposit. But for personal cold storage is there anything to worry about if one is not doing anything illegal? Is there anything useful observers gain from seeing that all UTXO belong to me if I just hold and consolidate later during low fees? And does using coin control and never spending reuse address together in the same transaction reduce the risk or the damage is already done once the address appear on chain multiple times? I just want to be clear on this whether it is best practice because it's easy or best practice because it actually protect you in real scenarios.

No wonder my wallet auto generate new address and now I understand why. I would be glad to hear how you people handle this especially from people that have been around since the old days of fee spike.

[Zaguru12]

Now I understand why people use new address for each deposit. But for personal cold storage is there anything to worry about if one is not doing anything illegal? Is there anything useful observers gain from seeing that all UTXO belong to me if I just hold and consolidate later during low fees? And does using coin control and never spending reuse address together in the same transaction reduce the risk or the damage is already done once the address appear on chain multiple times? I just want to be clear on this whether it is best practice because it's easy or best practice because it actually protect you in real scenarios.

I think you have explained your self the reason for why address reuse is always advice even by Satoshi himself and it’s basically for privacy sake. It helps make your privacy better since the blockchain is a public ledger.

But one thing it again is it will provide a great security in case of attacks on your address using your public key against quantum computing. You can see many threads or the ever growing discussion of quantum attacks on the forum. With address not been reuse you risk not losing all your coins on one address in case of quantum computing attacks, this is one security threat of reusing addresses

[Lembo69]

Since Bitcoin is controlled by the blockchain system, when you transact with someone, others can easily see it. In this case, if you transact repeatedly with the same account, you may face many problems. Therefore, instead of transacting repeatedly with the same address, you can be much safer by transacting with different addresses. Currently, hackers can steal your money from the wallet in addition to the seed phrase just by looking at the transaction history. The more secure the wallet can be, the better it will be. It is better not to use the same address twice. It is better not to share your personal information with anyone. The more precautions you take, the safer your wallet will be.

[dkbit98]

This is going to more risky with quantum computers in future, but even Satoshi wrote that bitcoin address should not be reused for privacy reasons.
I guess you could use the same address if you are receiving monthly payments from the same person, but change it for anyone else.
One solution would be if more people started using Silent Payments for receiving coins, it's better for privacy,and you don't have to manually generate new addresses all the time.
More information:
https://silentpayments.xyz/

Wallets currently supporting Silent Payments:

• Cake Wallet ^{full support}
• Silentium wallet ^{web experimental}
• SeedSigner ^test
• Blue Wallet ^{sending only}
• BitBox02 Hardware Wallet ^{sending only}
• Wasabi ^{sending only}
• Sparrow wallet ^{sending only}
• Shakesco wallet ^{full suport}
• Dana wallet ^experimental
• Nunchuk Wallet ^{sending only}

[Mia Chloe]

~snip

Address reuse has been discussed continuously on the forum and the simple way I like to dish this message out to newbies is just use the receive button anytime you want to receive. Literally all wallets are programmed to shuffle addresses that's why HD wallets are the standard today. Just make sure you verify what you copied is right though.

I think more of this discussion should be directed towards how this problem can be fixed likely for campaign participants. A couple nice Ideas won't hurt plus I think it's very much worth discussing. That being said I've seen some places that ask for your public keys claiming to fix this issue but it's even way worse for your privacy.

[Zaguru12]

I think more of this discussion should be directed towards how this problem can be fixed likely for campaign participants. A couple nice Ideas won't hurt plus I think it's very much worth discussing. That being said I've seen some places that ask for your public keys claiming to fix this issue but it's even way worse for your privacy.

I thought about this and sincerely i think the current method of actually having one single address for campaign participants is actually ok in my opinion. The reason is that address reuse is actually a problem when you’re dealing with another person aside the other person.

For example if I want to get paid by A and I give him an address, it is best to actually give maybe B another address different, but if payment is still coming from address A then it’s better to actually still leave him with the first address because once I give him another address he knows it’s from me and can link the two together.

For signature campaign here while it’s actually will cause problems for the managers, in terms of privacy it doesn’t really solve anything because all your addresses will be publicly posted here or on the spreadsheet which all can still be linked to you. The only advantage will be in terms of security checks like the quantum computing since different addresses means your coin will be spread out.

[Mia Chloe]

~snip

This does make sense. Because in Ideal sense we also need to know who that particular address is from plus I just thought around an important factor too, which is when you try to spend, you are eventually going to get a shuffle of those coins to change addresses and the more you spend the more that happens.

The two main factors here are; it has to actually be transparent so the address can be linked back to the user plus we still want it as private as possible so public keys obviously are a big no no.

[noorman0]

-snip-
But for personal cold storage is there anything to worry about if one is not doing anything illegal?

Privacy isn't just about avoiding investigations into illegal activities, which is just a legal risk. There's more to it than just security. Even legally binding services implement this security method by offering multiple deposit address options to maintain your privacy to some levels.

-snip-
Is there anything useful observers gain from seeing that all UTXO belong to me if I just hold and consolidate later during low fees? And does using coin control and never spending reuse address together in the same transaction reduce the risk or the damage is already done once the address appear on chain multiple times?

Yes, and again, it depends on your desired level of privacy and how you consolidate your UTXO: the destination address (permanent or disposable), and other randomization methods that obscure your tracks.

[AVE5]

But for personal cold storage is there anything to worry about if one is not doing anything illegal?

This is where you got it wrong; it's not because of user's involving in illegal activities that brings about this terminology but of course scammers will foresee it useful and safe for them because they wouldn't want to keep trace of being trapped.
The cold storage wallets is just a cryptocurrency provider that enhances the storage security systems from online hackers. Its transaction histories can still be transparent in the blockchain. It's only advanced to protect your wallets with the private keys stored offline unlike the hot wallets that stores your keys online which makes it vulnerable for hackers.

[Patikno]

Now I understand why people use new address for each deposit. But for personal cold storage is there anything to worry about if one is not doing anything illegal? Is there anything useful observers gain from seeing that all UTXO belong to me if I just hold and consolidate later during low fees? And does using coin control and never spending reuse address together in the same transaction reduce the risk or the damage is already done once the address appear on chain multiple times? I just want to be clear on this whether it is best practice because it's easy or best practice because it actually protect you in real scenarios.

I think you have explained your self the reason for why address reuse is always advice even by Satoshi himself and it’s basically for privacy sake. It helps make your privacy better since the blockchain is a public ledger.

But one thing it again is it will provide a great security in case of attacks on your address using your public key against quantum computing. You can see many threads or the ever growing discussion of quantum attacks on the forum. With address not been reuse you risk not losing all your coins on one address in case of quantum computing attacks, this is one security threat of reusing addresses

Several previous discussions have addressed this threat, and one way to avoid it is by using addresses that aren't reused. So, using this method safeguards privacy, and also protects against quantum computer threats. Well, there may not be any cases involving quantum computers yet, but isn't it worth taking precautions, right?

So, I think the usefulness is important, and there is no downside to doing it. It also doesn't take much time, just a short time, and it is worth it for security (both privacy and wallet security).

By the way, I think you should read the discussion regarding this, here : Bitcointalk.org - Bitcoin's Quantum Evolution ( there is a lot of important informations we can find there)

[hosemary]

Since you seem to care about your privacy, it may be worth mentioning that the server you are connected to can link all your addresses together.

Let's say you have a non-custodial HD wallet with multiple addresses. Even if you never reuse addresses and never co-spend your coins in the same transaction, the server you are connected to can still know that all those addresses are all owned by the same person. The server can also link your addreses with your IP address.

[BlackBoss_]

I have reading about UTXO and consolidation lately and I came across this phrase "Don't reuse addresses" during my exploration. Initially I thought it was just normal FUD for no reason but the more I continue reading, the more it appears. I was left with no choice but to play around with block explorers and then I think I know why it matters.

Privacy matters, and reuse address affects your privacy.
Protect your privacy.
Bitcoin privacy guide.
Awesome privacy on blockchains.
General guidelines for sending BTC transactions.
What is the "Change" address on bitcoin wallet ? read to know !

You have better control on your bitcoins and better privacy with Bitcoin Non-Custodial wallets.

[bitbollo]

Yes this could be useful but... please don't be obsessed with it.
If you want to "hide" you're doing wrong and bitcoin couldn't fit if you're not aware of what you're doing

I am seeing people talking about privacy, sharing suggestions and after releasing a video where they show everything of their private life.
There are many many ways to scrutiny any transaction/wallet, and in certain cases this could be done at higher level too...

[Comeacross]

Address reuse has been discussed continuously on the forum and the simple way I like to dish this message out to newbies is just use the receive button anytime you want to receive. Literally all wallets are programmed to shuffle addresses that's why HD wallets are the standard today. Just make sure you verify what you copied is right though.

I think more of this discussion should be directed towards how this problem can be fixed likely for campaign participants. A couple nice Ideas won't hurt plus I think it's very much worth discussing. That being said I've seen some places that ask for your public keys claiming to fix this issue but it's even way worse for your privacy.

Lol the public key stuff is sketchy because I don't understand why anyone would handover something that allow someone to see every address they'll ever generate. I have heard about people offering this service of cleaning up address linkage but it requires you to hand over your xpub.

Thank you for this hint. I do manually copy an address whenever I want to send because I thought it was easier for tracking.

I am not in a campaign yet but I guess I know why it's a problem if everyone is getting paid to the same address for as long as possible. That's basically a privacy leak. But we can not tell whether some of the participants make use of silent payments or managers using LN for pay out to contain this.

Since you seem to care about your privacy, it may be worth mentioning that the server you are connected to can link all your addresses together.

Let's say you have a non-custodial HD wallet with multiple addresses. Even if you never reuse addresses and never co-spend your coins in the same transaction, the server you are connected to can still know that all those addresses are all owned by the same person. The server can also link your addreses with your IP address.

Damn! So you mean even if I do everything right like generating new address each time, no coin join in the same transaction, the server can still see every address I request and can tie them together once I sync with the server? I think this is the part people miss when their privacy is exposed and they feel they did everything right. Practically, the issue of privacy can only be resolved running a personal node through Tor to avoid exposing IP.

[hosemary]

Damn! So you mean even if I do everything right like generating new address each time, no coin join in the same transaction, the server can still see every address I request and can tie them together once I sync with the server?

Yes. When you use a SPV wallet like electrum, you have to rely on a third party to get your balance, transaction history and to broadcast transactions. This makes that third party determines that the addresses all belong to the same person.

Practically, the issue of privacy can only be resolved running a personal node through Tor to avoid exposing IP.

True. This is the best thing you can do.

[coinlary]

Damn! So you mean even if I do everything right like generating new address each time, no coin join in the same transaction, the server can still see every address I request and can tie them together once I sync with the server?

YES when you only depend on third-party servers as already cleared by hosemary.
NO when you run your own full node and set up an Electrum server  which you can connect to, everything stays private I.e your  addresses, IPs e.t.c

There's another option btw,  Enabling proxy.  When you set this up appropriately, the process  hides your real IP but you  will still be subjected to server policies, the server still knows everything about your wallet but not you without an IP.