<p>Not sure if I got your question right.</p>
<p>If you pay to the same address multiple times that is address reuse. Even if you never spend from that address. But if you don't spend from that address the issue would &quot;only&quot; be privacy related not security related.</p>
<p>When you spend from an address the ECDSA public key becomes publicly known. As far as I know this is only a security issue if ECDSA breaks. So it would not really be a problem as of today but it migth be 10 years from now. Therefore it's not advised to do so.</p>
<p>A bitcoin address is only the hash value of the ecdsa public key. That leads to the fact that you could not sign a transaction from that address even if you could break ECDSA because you don't even know the ECDSA public key.</p>
<p>BUT in the scenario you described you would not reuse the address after sending from it. The way a seed works is that you generate an arbitrary amount of pairs of private keys and  corresponding addresses from it. So in your scenario you would generate privk_1 and address_1. Then you would make multiple payments to address_1. Later you would generate a second pair privk_2 and address_2 from the seed and send all your money from address_1 to address_2.</p>
<p>So if I got you right, I don't see any security problems with this. It's just that everyone would know that all the money belongs to a single entity. That is the afore mentioned privacy issue. I don't see the benefit of reusing that first address for receiving payments because you could simply generate a new address with your hardware wallet every time you want to receive bitcoin. Therefore I would not advice to receive everything on the same address.</p>

CC BY-SA 4.0
2021-03-26T17:26:19.157Z
Thank you for this very detailed response. I think I got something wrong from the start: for some reason, I thought that the seed was the private key, and all addresses were generated from the same private key. But from what I understood from your response (and after double checking online), a new private key is indeed generated for each address. Embarrassing mistake on my part.
Solal
CC BY-SA 4.0
2021-03-26T17:15:49.030Z
2021-03-26T17:15:49.030Z
Tr0llware
<p>I was going through some old posts regarding address reuse and came across a few remarks I wasn't aware of, and want to make sure I understood correctly.</p>
<p>I knew address reuse wasn't the best for privacy reasons, but I learned today that apparently it's also not good for security IF you've spend your bitcoins.</p>
<p>Let's consider the following situation: I have a brand new hardware wallet, generated a new seed with it, alongside a new address. I send from an exchange 1 BTC to it, and I decide to use this address as cold storage, meaning I'll regularly send BTC from exchanges to it, this specific address.</p>
<p>First of all, is it considered as address reuse if the address is only for cold storage, there's no transaction out but only UTXO's?</p>
<p>Now, let's say after a year of doing so this address has 50 UTXO's. I know this might cause an issue if the mempool gets full and tx fees rise, so I decide during a calm period to do some UTXO management and I do a &quot;send all&quot; to a new address that I generated from the same seed (so same private key). I effectively have a brand new address with only one UTXO.</p>
<p>My question: since i've used the same private key to both send a transaction (a big one, 50 utxo's) and generate a new address to send that to, does that expose me to security risks? (referring to <a href="https://bitcoin.stackexchange.com/a/62990/96844">this</a>). If yes, how bad is it really and does that mean that to achieve full security I would need to generate a brand new seed on my hardware wallet and send once again the full balance to a new address?</p>

CC BY-SA 4.0
2021-03-25T21:26:20.123Z
The hardware wallets that I am aware of will all allow you to generate a new address to receive to every time you want to transfer in from an exchange (or any other reason). You don't need to generate a new seed, one seed can be used to generate an unfathomable amount of addresses. Even if your UTXO's are associated to different addresses on that wallet, you can still do a "send all".
Prince M
CC BY-SA 4.0
2021-03-25T21:29:39.270Z
Sure but that doesn't really answer my questions. I know I can do it, but since so many exchanges have address whitelisting nowadays, it's a little bit painful to do so (some exchanges require you to wait 48h / a week for each address whitelisted). 
I'm still wondering about the security issue I raised too.
Solal
CC BY-SA 4.0
2021-03-25T21:34:23.583Z
You may have already seen this, but this page may be helpful https://en.bitcoin.it/wiki/Address_reuse. My understanding is that address re-use is typically more associate with being a privacy issue, not a security issue. Though, privacy issues could lead to targeted attacks I suppose, if the amount of btc associated to your address was large.
Prince M
CC BY-SA 4.0
2021-03-25T21:38:28.513Z
But in short, yes that would count as “address reuse”
Prince M
CC BY-SA 4.0
2021-03-25T21:39:30.937Z
Here's the thing I read that lead me to make this thread:
https://bitcoin.stackexchange.com/a/42380/96844

A wallet that never performed a send has both its pubkey and private key secret to everyone. Not the case in my situation describe above. 
https://bitcoin.stackexchange.com/a/42376/96844
Solal
CC BY-SA 4.0
2021-03-25T21:47:47.320Z
@Solal I've commented on that first link; I think it's besides the point if you're asking about address reuse. The second one is a more common misconception (IMHO) I often see appear; I'll try to find the time to write a response about that.
Pieter Wuille
CC BY-SA 4.0
2021-03-25T21:48:34.620Z
I see. I wasn't sure if it was only related to software/hardware since this was a rather old thread. Thanks Pieter (grandmaster!) and Prince for your detailed responses.
Solal
<wallet><address><security>
Address reuse, cold storage and private keys
Solal
# Address reuse, cold storage and private keys

(Asked by: username_0 on 2021-03-25)

I was going through some old posts regarding address reuse and came across a few remarks I wasn't aware of, and want to make sure I understood correctly.

I knew address reuse wasn't the best for privacy reasons, but I learned today that apparently it's also not good for security IF you've spend your bitcoins.

Let's consider the following situation: I have a brand new hardware wallet, generated a new seed with it, alongside a new address. I send from an exchange 1 BTC to it, and I decide to use this address as cold storage, meaning I'll regularly send BTC from exchanges to it, this specific address.

First of all, is it considered as address reuse if the address is only for cold storage, there's no transaction out but only UTXO's?

Now, let's say after a year of doing so this address has 50 UTXO's. I know this might cause an issue if the mempool gets full and tx fees rise, so I decide during a calm period to do some UTXO management and I do a "send all" to a new address that I generated from the same seed (so same private key). I effectively have a brand new address with only one UTXO.

My question: since i've used the same private key to both send a transaction (a big one, 50 utxo's) and generate a new address to send that to, does that expose me to security risks? (referring to [this](https://bitcoin.stackexchange.com/a/62990/96844)). If yes, how bad is it really and does that mean that to achieve full security I would need to generate a brand new seed on my hardware wallet and send once again the full balance to a new address?

**Tags:** wallet, address, security

> **Comments:**
> **username_1**: The hardware wallets that I am aware of will all allow you to generate a new address to receive to every time you want to transfer in from an exchange (or any other reason). You don't need to generate a new seed, one seed can be used to generate an unfathomable amount of addresses. Even if your UTXO's are associated to different addresses on that wallet, you can still do a "send all".  
> **username_0**: Sure but that doesn't really answer my questions. I know I can do it, but since so many exchanges have address whitelisting nowadays, it's a little bit painful to do so (some exchanges require you to wait 48h / a week for each address whitelisted).  I'm still wondering about the security issue I raised too.  
> **username_1**: You may have already seen this, but this page may be helpful https://en.bitcoin.it/wiki/Address_reuse. My understanding is that address re-use is typically more associate with being a privacy issue, not a security issue. Though, privacy issues could lead to targeted attacks I suppose, if the amount of btc associated to your address was large.  
> **username_1**: But in short, yes that would count as “address reuse”  
> **username_0**: Here's the thing I read that lead me to make this thread: https://bitcoin.stackexchange.com/a/42380/96844  A wallet that never performed a send has both its pubkey and private key secret to everyone. Not the case in my situation describe above.  https://bitcoin.stackexchange.com/a/42376/96844  
> **username_2**: @username_0 I've commented on that first link; I think it's besides the point if you're asking about address reuse. The second one is a more common misconception (IMHO) I often see appear; I'll try to find the time to write a response about that.  
> **username_0**: I see. I wasn't sure if it was only related to software/hardware since this was a rather old thread. Thanks username_2 (grandmaster!) and username_1 for your detailed responses.  

---

## 1 answers

### Answer by username_3 on 2021-03-26. Score: 0 | Accepted answer

Not sure if I got your question right.

If you pay to the same address multiple times that is address reuse. Even if you never spend from that address. But if you don't spend from that address the issue would "only" be privacy related not security related.

When you spend from an address the ECDSA public key becomes publicly known. As far as I know this is only a security issue if ECDSA breaks. So it would not really be a problem as of today but it migth be 10 years from now. Therefore it's not advised to do so.

A bitcoin address is only the hash value of the ecdsa public key. That leads to the fact that you could not sign a transaction from that address even if you could break ECDSA because you don't even know the ECDSA public key.

BUT in the scenario you described you would not reuse the address after sending from it. The way a seed works is that you generate an arbitrary amount of pairs of private keys and corresponding addresses from it. So in your scenario you would generate privk\_1 and address\_1. Then you would make multiple payments to address\_1. Later you would generate a second pair privk\_2 and address\_2 from the seed and send all your money from address\_1 to address\_2.

So if I got you right, I don't see any security problems with this. It's just that everyone would know that all the money belongs to a single entity. That is the afore mentioned privacy issue. I don't see the benefit of reusing that first address for receiving payments because you could simply generate a new address with your hardware wallet every time you want to receive bitcoin. Therefore I would not advice to receive everything on the same address.

> **Comments:**
> **username_0**: Thank you for this very detailed response. I think I got something wrong from the start: for some reason, I thought that the seed was the private key, and all addresses were generated from the same private key. But from what I understood from your response (and after double checking online), a new private key is indeed generated for each address. Embarrassing mistake on my part.  

---

