<p>Yes.</p>

<p>After the <strong>spending</strong> multisig transaction is on the blockchain (not the funding transaction), you can see the public keys used to spend those multisig funds.</p>

<p>These public keys are found in the full redeemScript provided in the spending transaction. See a <a href="http://www.soroushjp.com/2014/12/20/bitcoin-multisig-the-hard-way-understanding-raw-multisignature-bitcoin-transactions/#spendingtx" rel="nofollow">breakdown of a multisig spending transaction here</a>, which shows that a redeemScript is indeed included in the spending transaction. See a <a href="http://www.soroushjp.com/2014/12/20/bitcoin-multisig-the-hard-way-understanding-raw-multisignature-bitcoin-transactions/#redeemscript" rel="nofollow">breakdown of the full redeemScript here</a>, which shows that the public keys are included in this full redeemScript.</p>

<p>Let me clarify that the public keys are not seen in the <strong>funding</strong> transaction because only the redeemScript <strong>hash</strong> is revealed here, not the full redeem script.</p>

<p>Note: In the explanation above, I'm assuming you are talking about the Pay to Script Hash (P2SH) form of multisig, which is the more common and modern form of multisig. The answer to your question would still be <em>yes</em> for a non-P2SH multisig transaction, except that the public keys are visible in the <strong>funding</strong> transaction, rather than the spending transaction. The public keys are revealed in the scriptPubKey of the funding transaction, which looks like:</p>

<pre><code>&lt;m&gt; &lt;A pubkey&gt; [B pubkey] [C pubkey...] &lt;n&gt; OP_CHECKMULTISIG
</code></pre>

<p>Source: <a href="https://bitcoin.org/en/developer-guide#multisig" rel="nofollow">https://bitcoin.org/en/developer-guide#multisig</a></p>

CC BY-SA 3.0
2015-03-24T23:26:43.787Z
2015-03-24T23:26:43.787Z
soroushjp
<p>A P2SH multisig Tx (which first appeared in <a href="https://blockchain.info/tx-index/9c08a4d78931342b37fd5f72900fb9983087e6f46c4a097d8a1f52c74e28eaf6" rel="nofollow noreferrer">9c08a4d78931342b37fd5f72900fb9983087e6f46c4a097d8a1f52c74e28eaf6</a>) is comparable to P2PKH (pay to pubkeyhash) in that the hash is what is being referenced by the spending Tx's scriptSig (ie the Tx which eventually "unlocks" the multisig funds).</p>

<p>If you're interested in seeing how this the P2SH address is calculated, there's Python 2.7 code showing that below. Note that the general form (as mentioned by @soroushjp) of a multisig Tx is <code>&lt;m&gt; &lt;A pubkey&gt; [B pubkey] [C pubkey...] &lt;n&gt; OP_CHECKMULTISIG</code> and the redemption script <strong>MUST</strong> run the signatures <strong>in order</strong> and the script <strong>MUST</strong> begin with <code>OP_0</code>/<code>0x00</code> due to an <em>off by 1 error</em> which pops an extra value from the stack.</p>

<p>PYTHON CODE:</p>

<h1>I'll use pybitcointools</h1>

<p>from bitcoin import * # this is importing all pybitcointools functions</p>

<pre><code>privkeys, pubkeys, addrs = [], [], []
privkeys = [random_key() for x in range(0, 3)]
pubkeys = [privtopub(x) for x in privkeys]
addrs = [privtoaddr(x, magicbyte=0) for x in privkeys] # magicbyte = 0x6f for testnet
mykeys = zip(privkeys, pubkeys, addrs)

print mykeys
&gt;&gt;&gt; [('b24b72423d008a252f47bcfcb270dcd71a364a91a574adb266e1aa22d3d2543d', '04eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be36', '18oYZEBqN2xPsiWvbmvSNVQDaS49RK2wCq'), ('f0764f256ad87129fbbc77af32b016680bce7e91be236231ee08ab4b66a6de84', '049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd', '1DkBSD6pCRrNbWAkhxTbppnRPe42ciu2jB'), ('62666580151ada2dbf70d2a80c94a2bc20f5cc2f871a9aabb0eb11c6af24464b', '04982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f', '1E7gn9B82hXmawmeyY7sJ9BPoSfYCXkxh7')]

   # making the raw script
   rawscript = mk_multisig_script(pubkeys, 2)  # means make a 2 of 3 multisig redeemScript
   descript = deserialize_script(script) # shows the op_codes pushed to stack
   print descript
   print script

[2, '04eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be36', '049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd', '04982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f', 3, 174]

524104eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be3641049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd4104982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f53ae

# cheating here, but see comments following
scriptaddress = scriptaddr(script)    # 37TtE1nfm51u6LNkNzzsjuBcuYmhTEmkq6
</code></pre>

<p><code>scriptaddr</code> is doing the following:</p>

<ol>
<li>SHA256 of <code>524104eb...8f53ae</code></li>
<li>RIPEMD160 of #1</li>
<li>Converting #2 from hex ==> Base58</li>
</ol>

<p>It's worth mentioning that a standard Tx (ie accepted by core software, miners) does allow for using the script directly (without using P2SH) however the limit for this method is a 2of3 multisig. Why? Take an example of a m-of-15 using uncompressed public keys, which has a minimum size of <code>15 * 65 = 975 bytes</code> in size just for the outputs. </p>

<p>Some other multisig variations:</p>

<blockquote>
  <p>OP_1 OP_DATA_65 OP_DATA_65 OP_2 OP_CHECK_MULTISIG:
  60a20bd93aa49ab4b28d514ec10b06e1829ce6818ec06cd3aabd013ebcdc4bb1 OP_1
  OP_DATA_33 OP_DATA_33 OP_DATA_33 OP_3 OP_CHECK_MULTISIG:
  0109e3f8d2d324b8d0c0fdd34d369ebcc69fbcc5a0cabe781f69867a0ba1dd74 OP_1
  OP_DATA_65 OP_DATA_33 OP_DATA_33 OP_3 OP_CHECK_MULTISIG:
  14015bd586c0c7a28979ca294b114441f23bfc97be17cd6077b9e12e2709fec3 OP_2
  OP_DATA_65 OP_DATA_65 OP_DATA_65 OP_3 OP_CHECK_MULTISIG:
  6d5088c138e2fbf4ea7a8c2cb1b57a76c4b0a5fab5f4c188696aad807a5ba6d8 OP_2
  OP_DATA_65 OP_DATA_65 OP_2 OP_CHECK_MULTISIG:
  947539645c59e6ab0cda61826cbacb55ef97a8178f012f8c18abe504bf66d4ce OP_1
  OP_DATA_33 OP_1 OP_CHECK_MULTISIG:
  b96af3b69b48a82c5eae3e44ebb6ef93f30d7764b1d5b40243e11b0d374ac1b7</p>
</blockquote>

CC BY-SA 4.0
2015-03-25T02:25:29.540Z
2018-09-30T16:41:53.410Z
2018-09-30T16:41:53.410Z
Wizard Of Ozzie
<p>Assume we have a 2 of 3 multi signature address and we send some bitcoin to that address.</p>

<p>Then we spend the funds from that address by signing and broadcasting a transaction.</p>

<p>Just by looking at that transaction, can you tell the public keys whose private keys were used to sign that transaction?</p>

<multi-signature>
How to find the Bitcoin addresses used to create a Multi Signature address
Emre K.
# How to find the Bitcoin addresses used to create a Multi Signature address

(Asked by: username_0 on 2015-03-24)

Assume we have a 2 of 3 multi signature address and we send some bitcoin to that address.

Then we spend the funds from that address by signing and broadcasting a transaction.

Just by looking at that transaction, can you tell the public keys whose private keys were used to sign that transaction?

**Tags:** multi-signature


---

## 2 answers

### Answer by username_1 on 2015-03-24. Score: 2

Yes.

After the **spending** multisig transaction is on the blockchain (not the funding transaction), you can see the public keys used to spend those multisig funds.

These public keys are found in the full redeemScript provided in the spending transaction. See a [breakdown of a multisig spending transaction here](http://www.username_1.com/2014/12/20/bitcoin-multisig-the-hard-way-understanding-raw-multisignature-bitcoin-transactions/#spendingtx), which shows that a redeemScript is indeed included in the spending transaction. See a [breakdown of the full redeemScript here](http://www.username_1.com/2014/12/20/bitcoin-multisig-the-hard-way-understanding-raw-multisignature-bitcoin-transactions/#redeemscript), which shows that the public keys are included in this full redeemScript.

Let me clarify that the public keys are not seen in the **funding** transaction because only the redeemScript **hash** is revealed here, not the full redeem script.

Note: In the explanation above, I'm assuming you are talking about the Pay to Script Hash (P2SH) form of multisig, which is the more common and modern form of multisig. The answer to your question would still be *yes* for a non-P2SH multisig transaction, except that the public keys are visible in the **funding** transaction, rather than the spending transaction. The public keys are revealed in the scriptPubKey of the funding transaction, which looks like:

```
<m> <A pubkey> [B pubkey] [C pubkey...] <n> OP_CHECKMULTISIG

```

Source: <https://bitcoin.org/en/developer-guide#multisig>


---

### Answer by username_2 on 2015-03-25. Score: 1

A P2SH multisig Tx (which first appeared in [9c08a4d78931342b37fd5f72900fb9983087e6f46c4a097d8a1f52c74e28eaf6](https://blockchain.info/tx-index/9c08a4d78931342b37fd5f72900fb9983087e6f46c4a097d8a1f52c74e28eaf6)) is comparable to P2PKH (pay to pubkeyhash) in that the hash is what is being referenced by the spending Tx's scriptSig (ie the Tx which eventually "unlocks" the multisig funds).

If you're interested in seeing how this the P2SH address is calculated, there's Python 2.7 code showing that below. Note that the general form (as mentioned by @username_1) of a multisig Tx is `<m> <A pubkey> [B pubkey] [C pubkey...] <n> OP_CHECKMULTISIG` and the redemption script **MUST** run the signatures **in order** and the script **MUST** begin with `OP_0`/`0x00` due to an *off by 1 error* which pops an extra value from the stack.

PYTHON CODE:

# I'll use pybitcointools

from bitcoin import \* # this is importing all pybitcointools functions

```
privkeys, pubkeys, addrs = [], [], []
privkeys = [random_key() for x in range(0, 3)]
pubkeys = [privtopub(x) for x in privkeys]
addrs = [privtoaddr(x, magicbyte=0) for x in privkeys] # magicbyte = 0x6f for testnet
mykeys = zip(privkeys, pubkeys, addrs)

print mykeys
>>> [('b24b72423d008a252f47bcfcb270dcd71a364a91a574adb266e1aa22d3d2543d', '04eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be36', '18oYZEBqN2xPsiWvbmvSNVQDaS49RK2wCq'), ('f0764f256ad87129fbbc77af32b016680bce7e91be236231ee08ab4b66a6de84', '049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd', '1DkBSD6pCRrNbWAkhxTbppnRPe42ciu2jB'), ('62666580151ada2dbf70d2a80c94a2bc20f5cc2f871a9aabb0eb11c6af24464b', '04982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f', '1E7gn9B82hXmawmeyY7sJ9BPoSfYCXkxh7')]

   # making the raw script
   rawscript = mk_multisig_script(pubkeys, 2)  # means make a 2 of 3 multisig redeemScript
   descript = deserialize_script(script) # shows the op_codes pushed to stack
   print descript
   print script

[2, '04eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be36', '049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd', '04982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f', 3, 174]

524104eba461feced2a3d86aae5ca726c4d41f6d2a84f68fb83b5d91ead68fb0f9974886b0f24032db18a1603530c4039b54095acc460f84e47f192ee001230171be3641049ca1fa12b955f2fc1b6dab2e3138946f2d9ba6cb0c477c47bf3397f21d5709e100040d9675cef90cc1a0389293ec8ffdb2487093265290cbe66390dee36dcadd4104982b9b7c004edc76cbedd363dd198fb4bcb6140e2bd589b4e33c9ecb741ed28c2ca3a6a54907d6d27f18be8898e88095cec7a7dc8cdffe7e5900794fa782ee8f53ae

# cheating here, but see comments following
scriptaddress = scriptaddr(script)    # 37TtE1nfm51u6LNkNzzsjuBcuYmhTEmkq6

```

`scriptaddr` is doing the following:

1. SHA256 of `524104eb...8f53ae`
2. RIPEMD160 of #1
3. Converting #2 from hex ==> Base58

It's worth mentioning that a standard Tx (ie accepted by core software, miners) does allow for using the script directly (without using P2SH) however the limit for this method is a 2of3 multisig. Why? Take an example of a m-of-15 using uncompressed public keys, which has a minimum size of `15 * 65 = 975 bytes` in size just for the outputs.

Some other multisig variations:

> OP\_1 OP\_DATA\_65 OP\_DATA\_65 OP\_2 OP\_CHECK\_MULTISIG:
> 60a20bd93aa49ab4b28d514ec10b06e1829ce6818ec06cd3aabd013ebcdc4bb1 OP\_1
> OP\_DATA\_33 OP\_DATA\_33 OP\_DATA\_33 OP\_3 OP\_CHECK\_MULTISIG:
> 0109e3f8d2d324b8d0c0fdd34d369ebcc69fbcc5a0cabe781f69867a0ba1dd74 OP\_1
> OP\_DATA\_65 OP\_DATA\_33 OP\_DATA\_33 OP\_3 OP\_CHECK\_MULTISIG:
> 14015bd586c0c7a28979ca294b114441f23bfc97be17cd6077b9e12e2709fec3 OP\_2
> OP\_DATA\_65 OP\_DATA\_65 OP\_DATA\_65 OP\_3 OP\_CHECK\_MULTISIG:
> 6d5088c138e2fbf4ea7a8c2cb1b57a76c4b0a5fab5f4c188696aad807a5ba6d8 OP\_2
> OP\_DATA\_65 OP\_DATA\_65 OP\_2 OP\_CHECK\_MULTISIG:
> 947539645c59e6ab0cda61826cbacb55ef97a8178f012f8c18abe504bf66d4ce OP\_1
> OP\_DATA\_33 OP\_1 OP\_CHECK\_MULTISIG:
> b96af3b69b48a82c5eae3e44ebb6ef93f30d7764b1d5b40243e11b0d374ac1b7


---

