<p>Keep in mind that the marketplace in question may not use <em>bitcoind</em>, and if they do, may not use it in the most sensible way. Some possibilities:</p>

<ul>
<li>A list of addresses was generated. When it reaches the end of the list, it loops back to the beginning and reuses the old addresses, assuming that nobody should reuse their old one again. (this is a poor design: addresses should not be reused for privacy, and so that in case someone sends to an old address, you know whose is whose)</li>
<li>The addresses were generated with such low entropy that the same addresses were created and used again. (this is a <strong>serious</strong> security flaw in their setup)</li>
</ul>

<p>In either case, it's possible that either...</p>

<ul>
<li>the system records <em>both</em> accounts as owning the address (which is very bad, since you can both spend each other's money), or</li>
<li>only <em>one</em> of the accounts as owning the address. Which is very bad if the one owning it is the old one, since new funds are likely to be sent to the wrong person; or only slightly bad if the one owning it is the new one, since the old account owner may be inactive and should not reuse his old address anyway if he makes another deposit.</li>
</ul>

<p>Regardless of the details (which you as a user aren't going to know anyway), it would make me very hesitant to use the marketplace, since it points to a dangerously sloppy design.</p>

CC BY-SA 3.0
2015-04-15T04:05:54.507Z
Thanks for the insight. I have it from a trustworthy source it is in an entropy issue, likely with BIP32 non hardened keys. Though I can't see how one could differentiate between BIP32 keys without having a private key to check all <2^31 indexes (unless of course the generated address pool matched what was actually used). Based on walletexplorer.com there's ~100 addresses reused up to 15 times each, FWIW
Wizard Of Ozzie
CC BY-SA 3.0
2015-04-15T04:15:33.950Z
Also, without making this a "how to run a DNM" fracas, what other possibility for a Bitcoin daemon is there, besides a modified Bitcoincore implementation (*bitcoind*/*bitcoin-cli*)
Wizard Of Ozzie
CC BY-SA 3.0
2015-04-14T20:06:48.297Z
2015-04-14T20:06:48.297Z
Tim S.
<p>Recently, a marketplace was said to have been reusing deposit addresses, such that clicking the <em>"get new address"</em> button would immediately give the user a different address, however, the "new address" was sometimes already funded. </p>

<p>Needless to say, this is terrible OPSEC, but I'm wondering how such an issue could arise. Is it a faulty implementation of BIP32? This seems more likely than reusing keypool addresses for <em>bitcoind</em>, but I'm curious how this issue could arise.</p>

CC BY-SA 3.0
2015-04-14T13:37:38.373Z
Can you point to more details about the alleged incident?
Nate Eldredge
CC BY-SA 3.0
2015-04-14T13:41:45.303Z
I usually try to avoid IDing these services but I think the background information is especially pertinent to the question. Here's the link to Reddit /r/DNM: http://www.reddit.com/r/DarkNetMarkets/comments/322yms/psaarticle_dont_deposit_to_blackbank/
Wizard Of Ozzie
<security><address><wallet-security>
Reuse of addresses by a service ("get new address" returning *funded* addresses)
Wizard Of Ozzie
# Reuse of addresses by a service ("get new address" returning *funded* addresses)

(Asked by: username_0 on 2015-04-14)

Recently, a marketplace was said to have been reusing deposit addresses, such that clicking the *"get new address"* button would immediately give the user a different address, however, the "new address" was sometimes already funded.

Needless to say, this is terrible OPSEC, but I'm wondering how such an issue could arise. Is it a faulty implementation of BIP32? This seems more likely than reusing keypool addresses for *bitcoind*, but I'm curious how this issue could arise.

**Tags:** security, address, wallet-security

> **Comments:**
> **username_1**: Can you point to more details about the alleged incident?  
> **username_0**: I usually try to avoid IDing these services but I think the background information is especially pertinent to the question. Here's the link to Reddit /r/DNM: http://www.reddit.com/r/DarkNetMarkets/comments/322yms/psaarticle_dont_deposit_to_blackbank/  

---

## 1 answers

### Answer by username_2 on 2015-04-14. Score: 1 | Accepted answer

Keep in mind that the marketplace in question may not use *bitcoind*, and if they do, may not use it in the most sensible way. Some possibilities:

* A list of addresses was generated. When it reaches the end of the list, it loops back to the beginning and reuses the old addresses, assuming that nobody should reuse their old one again. (this is a poor design: addresses should not be reused for privacy, and so that in case someone sends to an old address, you know whose is whose)
* The addresses were generated with such low entropy that the same addresses were created and used again. (this is a **serious** security flaw in their setup)

In either case, it's possible that either...

* the system records *both* accounts as owning the address (which is very bad, since you can both spend each other's money), or
* only *one* of the accounts as owning the address. Which is very bad if the one owning it is the old one, since new funds are likely to be sent to the wrong person; or only slightly bad if the one owning it is the new one, since the old account owner may be inactive and should not reuse his old address anyway if he makes another deposit.

Regardless of the details (which you as a user aren't going to know anyway), it would make me very hesitant to use the marketplace, since it points to a dangerously sloppy design.

> **Comments:**
> **username_0**: Thanks for the insight. I have it from a trustworthy source it is in an entropy issue, likely with BIP32 non hardened keys. Though I can't see how one could differentiate between BIP32 keys without having a private key to check all <2^31 indexes (unless of course the generated address pool matched what was actually used). Based on walletexplorer.com there's ~100 addresses reused up to 15 times each, FWIW  
> **username_0**: Also, without making this a "how to run a DNM" fracas, what other possibility for a Bitcoin daemon is there, besides a modified Bitcoincore implementation (*bitcoind*/*bitcoin-cli*)  

---

