<p>I’m not particularly familiar with Electrum, so I’ll try to provide some highlevel ideas how to investigate this further.</p>
<p>To recap there are three wallets:</p>
<ul>
<li>A: air-gapped wallet with private key</li>
<li>B: watch-only wallet from master public key</li>
<li>C: watch-only wallet from 20 individual addresses</li>
</ul>
<p>There seem a few plausible sources of a discrepancy:</p>
<ul>
<li>Wallet C does not know either the master public key or the master private key. If Wallet C were asked to generate more addresses, there would be not enough information to extend the prior series. I do not know what the expected behavior would be: my first instinct would be that a watch-only wallet from a set of imported keys would throw an error when asked to create more addresses, but I could see that a wallet might generate a new secret key to extend a watch-only wallet with more addresses when that is requested (although I’d be surprised). If the latter were the case, the private key to those new addresses would obviously not be part of Wallet A.</li>
<li>Wallet B automatically generated the first 20 addresses you saw on Wallet A from the master public key. It would be incredibly odd if it succeeded for the first twenty but then used an unrelated key chain for the next thirty subsequently. This would most likely point towards either Wallet A or Wallet B having been used in a different way for the second batch of addresses than for the first batch of addresses, e.g. there could have been another derivation path added, or Wallet A was switched to hardened derivation.</li>
<li>Alternatively, Wallet A and Wallet B may have generated addresses from the same series but in different index ranges. Wallet A may have had a larger gap limit than the original 20 addresses you saw, and when more addresses were returned, these addresses were actually beyond the first fifty.</li>
</ul>
<p>I would try to look for RPCs that provide detailed information on wallets and addresses. If you can find an RPC that states the master public key and the used derivation paths, you would be able to determine whether the addresses are part of the same series and check on their indices.</p>

CC BY-SA 4.0
2024-08-02T17:28:22.327Z
thnks for the nice distillation, as I am still wrapping my head around all the parts here. Using the master pub key is surely the source of the additional 30 addresses on my work pc. I have subsequently created a new watch-only wallet on the work pc without inputting the master pub key and only importing the 130 addresses that I know for certain are from my cold storage wallet. That seems like the best way atm to add new addresses as required: generate them in the cold storage wallet and then import them to the watch-only wallets.
naphelge
CC BY-SA 4.0
2024-08-02T17:09:28.130Z
2024-08-02T17:14:50.523Z
2024-08-02T17:14:50.523Z
Murch
<p>When I created an Electrum cold storage wallet, I started out with 20 receiving addresses. I quickly burned thru using those, sending BTC to my wallet while wanting to only use any given address once.</p>
<p>In addition to the offline cold storage wallet, I also created two Electrum watch-only wallets, one on my connected PC at home and a second on a connected PC at work. Oddly, when creating the watch-only wallet for my home PC, I simply chose to add the 20 original receiving addresses to the watch-only wallet; but when I created the watch-only wallet on my work PC, I selected the option to use the master pub key (xpub/ypub/zpub), which seemed to populate my original 20 receiving addresses without me having to import them (and now while editing in these additional details I am thinking this is likely the source of the unexpected 30 addresses that just showed up in my watch-only wallet).</p>
<p>So because I was using up my original 20 receiving addresses, I generated 110 more addresses using the console (something like: <code>wallet.change_gap_limit(110)</code>) in my airgapped cold storage wallet. But when I went to add those additional 110 addresses to my Electrum watch-only wallet, I saw that my watch-wallet had an additional 30 addresses already unexpectedly added to my wallet (since the last time I logged in), for a total of 50 (30 + the 20 original), not counting the 110 I generated in my cold storage wallet.</p>
<p>I compared the additional 30 addresses with the 110, and none of them match. So now I am perplexed and a little wary of those additional 30 addresses, since they just showed up in my watching-only wallet, coincidentally when I was just about to import/add the 110 addresses generated by my cold storage wallet.</p>
<p>Although I am wary, I hope there is a perfectly logical answer to explain the unexpected addition of 30 new addresses in my watching-only wallet.</p>

CC BY-SA 4.0
2024-08-02T09:01:08.850Z
Assuming you've sent some transactions from the wallet, have you accounted for change addresses?
Vojtěch Strnad
CC BY-SA 4.0
2024-08-02T09:48:11.853Z
@VojtěchStrnad I haven't sent any transactions "from" my (cold storage) wallet, but have only sent transactions (sats) "to" the addresses generated by my cold storage wallet, and I am using a watch-only wallet to monitor those transactions, keeping my cold storage wallet isolated.
naphelge
CC BY-SA 4.0
2024-08-02T09:50:51.230Z
@VojtěchStrnad and I am not sure what you mean by "accounted for change addresses." Do you mean change addresses as opposed to receiving addresses? I should have clarified that the unexpected additional 30 addresses in my watch-only wallet are receiving addresses. Although there are now a number of change addresses added that were also not previously there; but I wasn't overly concerned about those since I am only using receiving address atm.
naphelge
CC BY-SA 4.0
2024-08-02T13:07:43.407Z
Could you describe in more detail what you did when you "generated 110 more addresses using the console"? Which command did you use with what parameters (please obfuscate any private information please, obviously)? Is it possible that your cold storage wallet already had a bigger gap, e.g. had generated the 100 receive addresses 0–99, and therefore the 110 new addresses are e.g. index 100–209, whereas your watch-only wallet only was tracking 20 and the first 50 are obviously at a lower index?
Murch
CC BY-SA 4.0
2024-08-02T14:14:48.057Z
@Murch yes, I used the console to increase the gap, using a command like: `wallet.change_gap_limit(110)`. Unfortunately I do not know for sure what the gap was before running this command, but I think I read the default was 20. Is there perhaps a file associated, probably with the watch-only wallet, that mint hint at where the unexpected 30 additional addresses came from. For now I am ignoring them because I don't see how to verify they are indeed from or associated with my wallet.
naphelge
CC BY-SA 4.0
2024-08-02T14:18:20.147Z
@Murch one other oddball thing I did regarding my watch-only wallet, before ever creating the 110 addresses, is on my connected machine at home I created an electrum watch-only and added the 20 original addresses; but on my connected machine at work I created another electrum watch-only wallet, but I input my master public key (xpub/ypub/zpub), and I remeber th original 20 addresses got auto-populated in the addresses tab. Perhaps using the master pub key allowed that wallet to increase the available addresses as my original pool of 20 addresses began to get used up?
naphelge
CC BY-SA 4.0
2024-08-02T15:06:45.417Z
Hey naphelge, could you please edit your question post to incorporate the information requested in the comments (also see [comments](https://bitcoin.stackexchange.com/help/privileges/comment))? Could you also clarify, the watch-only wallet that created the 30 additional addresses, was it created by importing 20 individual addresses or was it created by importing an xpub (or something else entirely)?
Murch
CC BY-SA 4.0
2024-08-02T16:02:18.467Z
@Murch Done. Yeah, sorry, I didn't even think of those additional details until you guys started asking helpful questions for clarity.
naphelge
CC BY-SA 4.0
2024-08-02T16:48:44.093Z
So the 30 additional addresses appeared on the work PC that was created with the master pub key?
Murch
<electrum><address-generation><coldstorage><watch-only>
How can I tell if an address belongs to my cold storage wallet?
naphelge
# How can I tell if an address belongs to my cold storage wallet?

(Asked by: username_0 on 2024-08-02)

When I created an Electrum cold storage wallet, I started out with 20 receiving addresses. I quickly burned thru using those, sending BTC to my wallet while wanting to only use any given address once.

In addition to the offline cold storage wallet, I also created two Electrum watch-only wallets, one on my connected PC at home and a second on a connected PC at work. Oddly, when creating the watch-only wallet for my home PC, I simply chose to add the 20 original receiving addresses to the watch-only wallet; but when I created the watch-only wallet on my work PC, I selected the option to use the master pub key (xpub/ypub/zpub), which seemed to populate my original 20 receiving addresses without me having to import them (and now while editing in these additional details I am thinking this is likely the source of the unexpected 30 addresses that just showed up in my watch-only wallet).

So because I was using up my original 20 receiving addresses, I generated 110 more addresses using the console (something like: `wallet.change_gap_limit(110)`) in my airgapped cold storage wallet. But when I went to add those additional 110 addresses to my Electrum watch-only wallet, I saw that my watch-wallet had an additional 30 addresses already unexpectedly added to my wallet (since the last time I logged in), for a total of 50 (30 + the 20 original), not counting the 110 I generated in my cold storage wallet.

I compared the additional 30 addresses with the 110, and none of them match. So now I am perplexed and a little wary of those additional 30 addresses, since they just showed up in my watching-only wallet, coincidentally when I was just about to import/add the 110 addresses generated by my cold storage wallet.

Although I am wary, I hope there is a perfectly logical answer to explain the unexpected addition of 30 new addresses in my watching-only wallet.

**Tags:** electrum, address-generation, coldstorage, watch-only

> **Comments:**
> **username_1**: Assuming you've sent some transactions from the wallet, have you accounted for change addresses?  
> **username_0**: @username_1 I haven't sent any transactions "from" my (cold storage) wallet, but have only sent transactions (sats) "to" the addresses generated by my cold storage wallet, and I am using a watch-only wallet to monitor those transactions, keeping my cold storage wallet isolated.  
> **username_0**: @username_1 and I am not sure what you mean by "accounted for change addresses." Do you mean change addresses as opposed to receiving addresses? I should have clarified that the unexpected additional 30 addresses in my watch-only wallet are receiving addresses. Although there are now a number of change addresses added that were also not previously there; but I wasn't overly concerned about those since I am only using receiving address atm.  
> **username_2**: Could you describe in more detail what you did when you "generated 110 more addresses using the console"? Which command did you use with what parameters (please obfuscate any private information please, obviously)? Is it possible that your cold storage wallet already had a bigger gap, e.g. had generated the 100 receive addresses 0–99, and therefore the 110 new addresses are e.g. index 100–209, whereas your watch-only wallet only was tracking 20 and the first 50 are obviously at a lower index?  
> **username_0**: @username_2 yes, I used the console to increase the gap, using a command like: `wallet.change_gap_limit(110)`. Unfortunately I do not know for sure what the gap was before running this command, but I think I read the default was 20. Is there perhaps a file associated, probably with the watch-only wallet, that mint hint at where the unexpected 30 additional addresses came from. For now I am ignoring them because I don't see how to verify they are indeed from or associated with my wallet.  
> **username_0**: @username_2 one other oddball thing I did regarding my watch-only wallet, before ever creating the 110 addresses, is on my connected machine at home I created an electrum watch-only and added the 20 original addresses; but on my connected machine at work I created another electrum watch-only wallet, but I input my master public key (xpub/ypub/zpub), and I remeber th original 20 addresses got auto-populated in the addresses tab. Perhaps using the master pub key allowed that wallet to increase the available addresses as my original pool of 20 addresses began to get used up?  
> **username_2**: Hey username_0, could you please edit your question post to incorporate the information requested in the comments (also see [comments](https://bitcoin.stackexchange.com/help/privileges/comment))? Could you also clarify, the watch-only wallet that created the 30 additional addresses, was it created by importing 20 individual addresses or was it created by importing an xpub (or something else entirely)?  
> **username_0**: @username_2 Done. Yeah, sorry, I didn't even think of those additional details until you guys started asking helpful questions for clarity.  
> **username_2**: So the 30 additional addresses appeared on the work PC that was created with the master pub key?  

---

## 1 answers

### Answer by username_2 on 2024-08-02. Score: 1 | Accepted answer

I’m not particularly familiar with Electrum, so I’ll try to provide some highlevel ideas how to investigate this further.

To recap there are three wallets:

* A: air-gapped wallet with private key
* B: watch-only wallet from master public key
* C: watch-only wallet from 20 individual addresses

There seem a few plausible sources of a discrepancy:

* Wallet C does not know either the master public key or the master private key. If Wallet C were asked to generate more addresses, there would be not enough information to extend the prior series. I do not know what the expected behavior would be: my first instinct would be that a watch-only wallet from a set of imported keys would throw an error when asked to create more addresses, but I could see that a wallet might generate a new secret key to extend a watch-only wallet with more addresses when that is requested (although I’d be surprised). If the latter were the case, the private key to those new addresses would obviously not be part of Wallet A.
* Wallet B automatically generated the first 20 addresses you saw on Wallet A from the master public key. It would be incredibly odd if it succeeded for the first twenty but then used an unrelated key chain for the next thirty subsequently. This would most likely point towards either Wallet A or Wallet B having been used in a different way for the second batch of addresses than for the first batch of addresses, e.g. there could have been another derivation path added, or Wallet A was switched to hardened derivation.
* Alternatively, Wallet A and Wallet B may have generated addresses from the same series but in different index ranges. Wallet A may have had a larger gap limit than the original 20 addresses you saw, and when more addresses were returned, these addresses were actually beyond the first fifty.

I would try to look for RPCs that provide detailed information on wallets and addresses. If you can find an RPC that states the master public key and the used derivation paths, you would be able to determine whether the addresses are part of the same series and check on their indices.

> **Comments:**
> **username_0**: thnks for the nice distillation, as I am still wrapping my head around all the parts here. Using the master pub key is surely the source of the additional 30 addresses on my work pc. I have subsequently created a new watch-only wallet on the work pc without inputting the master pub key and only importing the 130 addresses that I know for certain are from my cold storage wallet. That seems like the best way atm to add new addresses as required: generate them in the cold storage wallet and then import them to the watch-only wallets.  

---

