<p>Edit: I have reorganised this post, but it has mostly the same information.</p>

<p>Leakage falls roughly into the following categories: </p>

<ul>
<li>hacking of the server that stores your data, </li>
<li>transfer patterns</li>
<li>currency patterns</li>
<li>weak random numbers </li>
<li>well known addresses</li>
<li>voluntary disclosure</li>
</ul>

<p>If there has never been a transaction on a particular address, and the server has no been hacked, there is no information at all about that address. It is not even possible to verify if someone has that account or not. The only thing you can do is verify is if it is a valid address or not. In fact, it is possible to generate an address on a computer that is not on the internet at all.</p>

<p>Once an address RECEIVES bitcoin, it is possible to see (from the blockchain) where (the address, not physical location) the money came from, directly and indirectly and all other transactions relating to those addresses. </p>

<p>Some addresses are well known, so if you get your money from mtgox, or a gambling site, this will show. </p>

<p>If the transaction is a round number it may be possible to determine the currency with a reasonable amount of confidence. For example if I see a transaction for 350.877193mc right now, I would expect that someone paid US$100 for it at the mtgox exchange rate, rather than Canadian $119.</p>

<p>If the account was generated with weak random numbers, it may be possible (though difficult) to determine information about the computer used to generate it (it would be equally possible to determine the private key and steal the funds).</p>

<p>If money gets moved through several accounts very quickly, then I can deduce with pretty high reliability that all the transactions are under the control of the same person, or that there is an automated system involved.</p>

<p>Usually, if money gets sent in one transaction to more than 2 destination accounts, it's pretty likely that all destination accounts (and probably the source account) are controlled by the same person. The same applies (a little less reliably) if ALL the funds of a particular account are sent to the same place.</p>

<p>Regular "purchase" transactions consist of money from one (or possibly 2) accounts going to exactly 2 destinations - one of the destinations being the "change" (which may or may not go to the account that it came from). </p>

<p>if a third party that keeps your account gets hacked or the like.</p>

<p>voluntary disclosure is just you publish the address on your blog or the like.</p>

CC BY-SA 3.0
2014-02-17T06:56:52.537Z
Yes I'm aware of the basic "leakages" like this. I'm wondering is there any more specific leakage pertaining to `blockchain.info`'s implementation?
Pacerier
CC BY-SA 3.0
2014-02-17T20:19:21.817Z
I have not audited their sourcecode, but their business depends on trust, and keeping private data private. I doubt that they are going to disclose this.
AMADANON Inc.
CC BY-SA 3.0
2014-02-17T03:48:10.433Z
2014-02-17T19:57:07.393Z
2014-02-17T19:57:07.393Z
AMADANON Inc.
<p>I am using <a href="https://blockchain.info/wallet/login" rel="nofollow noreferrer">blockchain wallet</a> to store some BTCs. Blockchain allows us to create multiple addresses as such:</p>

<p><img src="https://i.sstatic.net/7ZW9t.png" alt="enter image description here"></p>

<p>If I give two different addresses in the same account to someone, will he be able to identify that both of the addresses belong to me?</p>

<p>For example, without the image above, if I tell you the addresses:</p>

<ol>
<li><p><a href="https://blockchain.info/address/17bbyAreAzGhenHspBCC6uDmUvqpbHWDF7" rel="nofollow noreferrer">17bbyAreAzGhenHspBCC6uDmUvqpbHWDF7</a></p></li>
<li><p><a href="http://blockchain.info/address/12oVDoEA2DFX84LbVPZ3ZXA7U67JLFmWzX" rel="nofollow noreferrer">12oVDoEA2DFX84LbVPZ3ZXA7U67JLFmWzX</a></p></li>
<li><p><a href="https://blockchain.info/address/1GQME6s1AmPPEYWz2KSuKsCsPp5DDZTCRY" rel="nofollow noreferrer">1GQME6s1AmPPEYWz2KSuKsCsPp5DDZTCRY</a></p></li>
<li><p><a href="https://blockchain.info/address/1Ptxf11p5ZgM4UB7kSSZJ2y68gVPsgUHin" rel="nofollow noreferrer">1Ptxf11p5ZgM4UB7kSSZJ2y68gVPsgUHin</a></p></li>
<li><p><a href="https://blockchain.info/address/13v5W1QN1uR7ndzvfN3JAnVa8wHJcGHhTQ" rel="nofollow noreferrer">13v5W1QN1uR7ndzvfN3JAnVa8wHJcGHhTQ</a></p></li>
<li><p><a href="https://blockchain.info/address/1B9j5KLD1mXRcbDDYRxSXn1SwU1BtCZfZ" rel="nofollow noreferrer">1B9j5KLD1mXRcbDDYRxSXn1SwU1BtCZfZ</a></p></li>
</ol>

<p>Will you know that at least two of the addresses are owned by the same person?</p>

<address><blockchain.info>
Can people associate one blockchain address with another?
Pacerier
# Can people associate one blockchain address with another?

(Asked by: username_0 on 2014-02-17)

I am using [blockchain wallet](https://blockchain.info/wallet/login) to store some BTCs. Blockchain allows us to create multiple addresses as such:

![enter image description here](https://i.sstatic.net/7ZW9t.png)

If I give two different addresses in the same account to someone, will he be able to identify that both of the addresses belong to me?

For example, without the image above, if I tell you the addresses:

1. [17bbyAreAzGhenHspBCC6uDmUvqpbHWDF7](https://blockchain.info/address/17bbyAreAzGhenHspBCC6uDmUvqpbHWDF7)
2. [12oVDoEA2DFX84LbVPZ3ZXA7U67JLFmWzX](http://blockchain.info/address/12oVDoEA2DFX84LbVPZ3ZXA7U67JLFmWzX)
3. [1GQME6s1AmPPEYWz2KSuKsCsPp5DDZTCRY](https://blockchain.info/address/1GQME6s1AmPPEYWz2KSuKsCsPp5DDZTCRY)
4. [1Ptxf11p5ZgM4UB7kSSZJ2y68gVPsgUHin](https://blockchain.info/address/1Ptxf11p5ZgM4UB7kSSZJ2y68gVPsgUHin)
5. [13v5W1QN1uR7ndzvfN3JAnVa8wHJcGHhTQ](https://blockchain.info/address/13v5W1QN1uR7ndzvfN3JAnVa8wHJcGHhTQ)
6. [1B9j5KLD1mXRcbDDYRxSXn1SwU1BtCZfZ](https://blockchain.info/address/1B9j5KLD1mXRcbDDYRxSXn1SwU1BtCZfZ)

Will you know that at least two of the addresses are owned by the same person?

**Tags:** address, blockchain.info


---

## 1 answers

### Answer by username_1 on 2014-02-17. Score: 1 | Accepted answer

Edit: I have reorganised this post, but it has mostly the same information.

Leakage falls roughly into the following categories:

* hacking of the server that stores your data,
* transfer patterns
* currency patterns
* weak random numbers
* well known addresses
* voluntary disclosure

If there has never been a transaction on a particular address, and the server has no been hacked, there is no information at all about that address. It is not even possible to verify if someone has that account or not. The only thing you can do is verify is if it is a valid address or not. In fact, it is possible to generate an address on a computer that is not on the internet at all.

Once an address RECEIVES bitcoin, it is possible to see (from the blockchain) where (the address, not physical location) the money came from, directly and indirectly and all other transactions relating to those addresses.

Some addresses are well known, so if you get your money from mtgox, or a gambling site, this will show.

If the transaction is a round number it may be possible to determine the currency with a reasonable amount of confidence. For example if I see a transaction for 350.877193mc right now, I would expect that someone paid US$100 for it at the mtgox exchange rate, rather than Canadian $119.

If the account was generated with weak random numbers, it may be possible (though difficult) to determine information about the computer used to generate it (it would be equally possible to determine the private key and steal the funds).

If money gets moved through several accounts very quickly, then I can deduce with pretty high reliability that all the transactions are under the control of the same person, or that there is an automated system involved.

Usually, if money gets sent in one transaction to more than 2 destination accounts, it's pretty likely that all destination accounts (and probably the source account) are controlled by the same person. The same applies (a little less reliably) if ALL the funds of a particular account are sent to the same place.

Regular "purchase" transactions consist of money from one (or possibly 2) accounts going to exactly 2 destinations - one of the destinations being the "change" (which may or may not go to the account that it came from).

if a third party that keeps your account gets hacked or the like.

voluntary disclosure is just you publish the address on your blog or the like.

> **Comments:**
> **username_0**: Yes I'm aware of the basic "leakages" like this. I'm wondering is there any more specific leakage pertaining to `blockchain.info`'s implementation?  
> **username_1**: I have not audited their sourcecode, but their business depends on trust, and keeping private data private. I doubt that they are going to disclose this.  

---

