<p>The size of the key space in Bitcoin is just shy of 2<sup>256</sup>. There are a few different output types with different address schemes, but for most of these, the address space is a lot smaller than the key space. Let's assume you're inquiring about P2WPKH. There are about 2<sup>160</sup> unique addresses for P2WPKH outputs, so about 2<sup>96</sup> keys map to each address.</p>
<p>You are therefore correct that hypothetically two users could each discover a different private key that map to the same address. If that were the case:</p>
<ol>
<li>There is no registration of addresses or other mitigation for key collisions. Simply, either user could spend funds received to the address.</li>
<li>From a protocol perspective, there would not be a problem at all, as a transaction signed with either key would be valid.</li>
<li>If they both notice in time, the users might get into a bidding war, creating conflicting transactions with higher and higher fees to claim the funds.</li>
<li>If transactions from both users surface, other people might notice and be concerned about the key collision. Most likely this would lead to a loss of confidence in the method the corresponding keys were generated, but some users could lose confidence in Bitcoin instead due to misunderstanding the cause of the situation.</li>
</ol>
<p>2<sup>160</sup> is an extremely large number. As long as key generation uses reasonable entropy sources, it's <a href="https://bitcoin.stackexchange.com/a/12740/5406">unlikely that we'll ever see any two addresses collide</a> no matter how long Bitcoin will get used.</p>

CC BY-SA 4.0
2022-02-13T08:38:19.630Z
Suggesting that two users could hypothetically generate the same address and to infer implications for spend-ability of the coin is really just a thought experiment. What really needs to be understood is the sheer scale of 2^256. Without analogies the human brain has trouble comprehending the scale. This video from 3Blue1Brown youtube.com/watch?v=S9JGmA5_unY gives a good explanation of the scale and security of 2^256.
stackaccount
CC BY-SA 4.0
2022-02-13T18:50:39.783Z
@stackaccount: Perhaps you could add another answer that focuses on highlighting the magnitude of 2^160, if you feel that "it's unlikely we'll ever see any two addresses collide" doesn't stress this aspect sufficiently for your taste.—I chose to answer the way I did, because the question was about what happened when the situation occurred, and linked to a prior answer that covers how unlikely that is.
Murch
CC BY-SA 4.0
2022-02-15T04:45:39.890Z
@Murch But isn't 2^256 the maximum amount of hashes that can be generated. A collision could and probably would occur before 2^256. So in theory couldn't a collusion occur today or tomorrow or next week?
Varun W.
CC BY-SA 4.0
2022-02-15T05:09:07.717Z
Most addresses that involve a hash function (P2PKH, P2SH, P2WPKH) have a RIPEMD160 hash step. So while there are just shy of 2^256 keys, there are only 2^160 addresses. This is still plenty that we don't ever expect to see a collision.
Murch
CC BY-SA 4.0
2022-02-15T05:10:02.460Z
See the post I linked in the last paragraph for calculations on that matter.
Murch
CC BY-SA 4.0
2022-02-11T21:43:27.360Z
2022-02-11T21:43:27.360Z
Murch
<p>Since bitcoin uses cryptography algorithms to create private and public keys there is a possibility it could repeat.</p>
<p>Person 1:
L54w...KraG -&gt; bc1...kq4</p>
<p>Person 2:
L3mV...JU8G -&gt; bc1...kq4</p>
<p>So could person 2 single handedly sent bitcoin from bc1...kq4 to a different address. My question is would both of the private keys work to change the funds. If so how will his affect bitcoin as a whole.</p>

CC BY-SA 4.0
2022-02-11T20:33:50.643Z
Does one of these three answer your question in full? https://bitcoin.stackexchange.com/q/8804/5406, https://bitcoin.stackexchange.com/q/43609/5406, https://bitcoin.stackexchange.com/q/22/5406
Murch
<private-key><hash><public-key><economic-theory>
One address 2+ private keys. Bitcoin future
Varun W.
# One address 2+ private keys. Bitcoin future

(Asked by: username_0 on 2022-02-11)

Since bitcoin uses cryptography algorithms to create private and public keys there is a possibility it could repeat.

Person 1:
L54w...KraG -> bc1...kq4

Person 2:
L3mV...JU8G -> bc1...kq4

So could person 2 single handedly sent bitcoin from bc1...kq4 to a different address. My question is would both of the private keys work to change the funds. If so how will his affect bitcoin as a whole.

**Tags:** private-key, hash, public-key, economic-theory

> **Comments:**
> **username_1**: Does one of these three answer your question in full? https://bitcoin.stackexchange.com/q/8804/5406, https://bitcoin.stackexchange.com/q/43609/5406, https://bitcoin.stackexchange.com/q/22/5406  

---

## 1 answers

### Answer by username_1 on 2022-02-11. Score: 1 | Accepted answer

The size of the key space in Bitcoin is just shy of 2256. There are a few different output types with different address schemes, but for most of these, the address space is a lot smaller than the key space. Let's assume you're inquiring about P2WPKH. There are about 2160 unique addresses for P2WPKH outputs, so about 296 keys map to each address.

You are therefore correct that hypothetically two users could each discover a different private key that map to the same address. If that were the case:

1. There is no registration of addresses or other mitigation for key collisions. Simply, either user could spend funds received to the address.
2. From a protocol perspective, there would not be a problem at all, as a transaction signed with either key would be valid.
3. If they both notice in time, the users might get into a bidding war, creating conflicting transactions with higher and higher fees to claim the funds.
4. If transactions from both users surface, other people might notice and be concerned about the key collision. Most likely this would lead to a loss of confidence in the method the corresponding keys were generated, but some users could lose confidence in Bitcoin instead due to misunderstanding the cause of the situation.

2160 is an extremely large number. As long as key generation uses reasonable entropy sources, it's [unlikely that we'll ever see any two addresses collide](https://bitcoin.stackexchange.com/a/12740/5406) no matter how long Bitcoin will get used.

> **Comments:**
> **username_2**: Suggesting that two users could hypothetically generate the same address and to infer implications for spend-ability of the coin is really just a thought experiment. What really needs to be understood is the sheer scale of 2^256. Without analogies the human brain has trouble comprehending the scale. This video from 3Blue1Brown youtube.com/watch?v=S9JGmA5_unY gives a good explanation of the scale and security of 2^256.  
> **username_1**: @username_2: Perhaps you could add another answer that focuses on highlighting the magnitude of 2^160, if you feel that "it's unlikely we'll ever see any two addresses collide" doesn't stress this aspect sufficiently for your taste.—I chose to answer the way I did, because the question was about what happened when the situation occurred, and linked to a prior answer that covers how unlikely that is.  
> **username_0**: @username_1 But isn't 2^256 the maximum amount of hashes that can be generated. A collision could and probably would occur before 2^256. So in theory couldn't a collusion occur today or tomorrow or next week?  
> **username_1**: Most addresses that involve a hash function (P2PKH, P2SH, P2WPKH) have a RIPEMD160 hash step. So while there are just shy of 2^256 keys, there are only 2^160 addresses. This is still plenty that we don't ever expect to see a collision.  
> **username_1**: See the post I linked in the last paragraph for calculations on that matter.  

---

