<p>No. The point of HD wallets is to create a deterministically generated sequence of addresses but which look random and not related to one another. So unless BIP32 is fundamentally broken, you should not be able to distinguish between a HD wallet and a wallet that simply generates addresses at random.</p>
<p>The only way you can know a HD wallet was used is if its owner gives you its extended public (or private) key.</p>

CC BY-SA 4.0
2022-09-21T13:48:06.713Z
I don't think that's relevant. It could be the case that it is impossible to know which addresses were derived from the same seed, but it could be recognized that a transaction was created by a specific wallet. For example, I don't think a wallet that follows BIP32, but adds a "created by wallet X" to the payload of transactions breaks BIP32 in any way. Of course that would be a stupid thing to do, but the point is that different wallets *do* output transactions with different aesthetics as pointed out by Pieter Wuille.
Shai Deshe
CC BY-SA 4.0
2022-09-21T13:51:12.620Z
(To make it clear: what you said *does* hold for the public-key hashes themselves, but transactions contain more data than just that, and this data might leak information about the wallet used. That was the essence of my question.)
Shai Deshe
CC BY-SA 4.0
2022-09-21T14:12:19.913Z
From just looking at a transaction, its output scripts, signatures etc. you really cannot tell if it was created by a HD wallet. What you can do is guess which wallet software created the transaction and go from there, but that requires information beyond what is available in the blockchain, and isn't always going to be accurate (two wallets might create similar looking transactions, your list of wallets won't include proprietary wallet software etc.).
Vojtěch Strnad
CC BY-SA 4.0
2022-09-21T14:32:23.570Z
Yeah, I understand. The mere fact that the transaction data can be used to infer anything about the likelihood that the transaction was created by an HD wallet is very problematic for me, and I am trying to understand the extent. Especially for transactions from 2013-2015, and I suspect it might be "easy" to identify transactions created by wallets known to not implement HD yet (which were abundant at this time).
Shai Deshe
CC BY-SA 4.0
2022-09-21T12:54:35.907Z
2022-09-21T12:54:35.907Z
Vojtěch Strnad
<p>Almost every wallet today uses HD key derivation. You'd need to go back to software from 2016 or earlier to find any that don't. So I'd say your question is moot.</p>
<p>That said, there certainly are signals in on-chain transaction data that let you make informed guesses about what software may have created them, though they're not correlated with HD or not in practical implementations:</p>
<ul>
<li>Order of transaction inputs and outputs. Some wallets follow <a href="https://github.com/bitcoin/bips/blob/master/bip-0069.mediawiki" rel="noreferrer">BIP69</a> which specifies sorting the inputs and outputs; other wallets order them randomly.</li>
<li>Types of inputs used: if a transaction is spending a P2WPKH or P2TR UTXO, it was almost certainly created by a <a href="https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki" rel="noreferrer">segwit</a> resp. <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="noreferrer">taproot</a> wallet (or it was a CoinJoin transaction with another one that does).</li>
<li>Types of outputs used: if a transaction has a P2WPKH or P2TR output, it's almost certainly created by a wallet that <a href="https://en.bitcoin.it/wiki/Bech32_adoption" rel="noreferrer">supports</a> <a href="https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki" rel="noreferrer">BIP173</a> resp. <a href="https://github.com/bitcoin/bips/blob/master/bip-0350.mediawiki" rel="noreferrer">BIP350</a> (which specify the address formats for such outputs).</li>
<li>Coin selection: there are many algorithms in used for selecting which UTXOs to spend to fund any given created transaction, including oldest-first, branch-and-bound, single-random-draw, knapsack, ... . Not every wallet implements the same ones, or implements them identically. From the set of inputs a transaction has it may be possible to infer something about which selection algorithm was used this way.</li>
<li>Anti fee-sniping: some wallets timelock their transactions so they can only be included in the current block height or later most of the time, which prevents a 51% attacker which creates a deep reorg from including the transaction there (making it harder for those to get the fee from the transaction).</li>
</ul>

CC BY-SA 4.0
2022-09-21T13:49:16.530Z
Thank you for a very elaborate answer!
Shai Deshe
CC BY-SA 4.0
2022-09-21T16:55:23.980Z
I just noticed: "You'd need to go back to software from 2016 or earlier to find any that don't. So I'd say your question is moot.". The truth is that I am particularly interested in old UTXOs, that is, UTXOs from between 2013 (when HD wallets were first introduced) and 2016 (when they were already pretty much universally adopted). I assume the fraction of current non HD UTXOs is negligible if not exactly zero.
Shai Deshe
CC BY-SA 4.0
2022-09-21T12:57:54.890Z
2022-09-21T13:07:51.363Z
2022-09-21T13:07:51.363Z
Pieter Wuille
<p>I was wondering if the fact that a transaction was created by an HD wallet can be somehow read off from the UTXO, or any other data available in the blockchain.</p>
<p>Theoretically, it is not required in any way to leak the fact that an HD wallet was used to create a transaction. However, this does not imply that this data is not leaked in currently used wallets.</p>
<p>Is there any information available on that? Thanks.</p>

<bip32-hd-wallets><privacy><utxo-set>
Is it possible to identify UTXOs signed by HD wallets?
Shai Deshe
# Is it possible to identify UTXOs signed by HD wallets?

(Asked by: username_0 on 2022-09-21)

I was wondering if the fact that a transaction was created by an HD wallet can be somehow read off from the UTXO, or any other data available in the blockchain.

Theoretically, it is not required in any way to leak the fact that an HD wallet was used to create a transaction. However, this does not imply that this data is not leaked in currently used wallets.

Is there any information available on that? Thanks.

**Tags:** bip32-hd-wallets, privacy, utxo-set


---

## 2 answers

### Answer by username_2 on 2022-09-21. Score: 7 | Accepted answer

Almost every wallet today uses HD key derivation. You'd need to go back to software from 2016 or earlier to find any that don't. So I'd say your question is moot.

That said, there certainly are signals in on-chain transaction data that let you make informed guesses about what software may have created them, though they're not correlated with HD or not in practical implementations:

* Order of transaction inputs and outputs. Some wallets follow [BIP69](https://github.com/bitcoin/bips/blob/master/bip-0069.mediawiki) which specifies sorting the inputs and outputs; other wallets order them randomly.
* Types of inputs used: if a transaction is spending a P2WPKH or P2TR UTXO, it was almost certainly created by a [segwit](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki) resp. [taproot](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) wallet (or it was a CoinJoin transaction with another one that does).
* Types of outputs used: if a transaction has a P2WPKH or P2TR output, it's almost certainly created by a wallet that [supports](https://en.bitcoin.it/wiki/Bech32_adoption) [BIP173](https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki) resp. [BIP350](https://github.com/bitcoin/bips/blob/master/bip-0350.mediawiki) (which specify the address formats for such outputs).
* Coin selection: there are many algorithms in used for selecting which UTXOs to spend to fund any given created transaction, including oldest-first, branch-and-bound, single-random-draw, knapsack, ... . Not every wallet implements the same ones, or implements them identically. From the set of inputs a transaction has it may be possible to infer something about which selection algorithm was used this way.
* Anti fee-sniping: some wallets timelock their transactions so they can only be included in the current block height or later most of the time, which prevents a 51% attacker which creates a deep reorg from including the transaction there (making it harder for those to get the fee from the transaction).

> **Comments:**
> **username_0**: Thank you for a very elaborate answer!  
> **username_0**: I just noticed: "You'd need to go back to software from 2016 or earlier to find any that don't. So I'd say your question is moot.". The truth is that I am particularly interested in old UTXOs, that is, UTXOs from between 2013 (when HD wallets were first introduced) and 2016 (when they were already pretty much universally adopted). I assume the fraction of current non HD UTXOs is negligible if not exactly zero.  

---

### Answer by username_1 on 2022-09-21. Score: 2

No. The point of HD wallets is to create a deterministically generated sequence of addresses but which look random and not related to one another. So unless BIP32 is fundamentally broken, you should not be able to distinguish between a HD wallet and a wallet that simply generates addresses at random.

The only way you can know a HD wallet was used is if its owner gives you its extended public (or private) key.

> **Comments:**
> **username_0**: I don't think that's relevant. It could be the case that it is impossible to know which addresses were derived from the same seed, but it could be recognized that a transaction was created by a specific wallet. For example, I don't think a wallet that follows BIP32, but adds a "created by wallet X" to the payload of transactions breaks BIP32 in any way. Of course that would be a stupid thing to do, but the point is that different wallets *do* output transactions with different aesthetics as pointed out by username_2 username_2.  
> **username_0**: (To make it clear: what you said *does* hold for the public-key hashes themselves, but transactions contain more data than just that, and this data might leak information about the wallet used. That was the essence of my question.)  
> **username_1**: From just looking at a transaction, its output scripts, signatures etc. you really cannot tell if it was created by a HD wallet. What you can do is guess which wallet software created the transaction and go from there, but that requires information beyond what is available in the blockchain, and isn't always going to be accurate (two wallets might create similar looking transactions, your list of wallets won't include proprietary wallet software etc.).  
> **username_0**: Yeah, I understand. The mere fact that the transaction data can be used to infer anything about the likelihood that the transaction was created by an HD wallet is very problematic for me, and I am trying to understand the extent. Especially for transactions from 2013-2015, and I suspect it might be "easy" to identify transactions created by wallets known to not implement HD yet (which were abundant at this time).  

---

