<p>This is the way I see it. The total number of bitcoins that will ever be mined is 21 million. The smallest bitcoin unit is a satoshi (0.00000001 BTC). If we place all possible satoshis into a wallet of their own, we would get the maximum number of wallets that could have any balance to them (so the actual number of wallets with bitcoins is obviously less). This is 21x10^6(BTC) x 10^8 (satoshi/BTC) = 21 x10^14 wallets. It's a huge number, but it's eclipsed by 2^256 possible wallets. So in this worst case scenario, the probability of guessing a wallet with one satoshi is 21x10^14/(2^256)=1.813595x10^-62. An incredibly small number.</p>

CC BY-SA 3.0
2013-05-03T07:08:18.120Z
By the Birthday Problem, the odds of two people have the same address in that situation would be about 1-e**(-((21*10**14)**2)/(2*(2**256))) .  That's like 1 atom compared to the number of atoms in the Earth.  Quite small.
Eyal
CC BY-SA 3.0
2014-03-24T12:51:28.603Z
This answer doesn't address the main question "What would happen if two users generated the same address?", rather just evaluates the likelihood of the question being relevant, which the asker already seems to have been aware of. This answer would be a better fit on e.g. [How many Bitcoin addresses are there?](http://bitcoin.stackexchange.com/q/10850/5406) or [Is it possible to brute force bitcoin address creation in order to steal money?](http://bitcoin.stackexchange.com/q/22/5406).
Murch
CC BY-SA 3.0
2015-09-29T04:51:56.730Z
+1 for details on how unlikely (unprofitable) brute forcing an existing address is
Ron
CC BY-SA 3.0
2016-11-12T20:45:27.020Z
Actually, there are only `2^160` possible addresses. More than one private key (of which there are `2^256` possible ones) would hash to the same address.
jeteon
CC BY-SA 3.0
2013-05-03T02:48:10.910Z
2013-05-03T02:48:10.910Z
user4805
<p>A slight addition to the existing answers:</p>

<p>If B has not downloaded enough of the block chain to see A's transaction, then the situation will be as described above.  When blocks are downloaded by a wallet client, the transactions therein are checked to see whether any of them send coins to addresses held in this wallet.  If so, those coins are added to the wallet's balance.  So B will see an extra 25 BTC appear in his wallet.  As mentioned in the other answers, he'll be able to spend them as if they were his own.  So it's a race between A and B to see who spends them first - either can do it.</p>

<p>If B has already downloaded the relevant transactions before generating the colliding address, the situation is a little different.  As far as I know, most Bitcoin clients, when generating a fresh random address, will not rescan the block chain to see whether it contains any transactions sending coins to that address.  (As described above, the probability of this happening is infinitesimally small, so for all practical purposes, such a scan would just be a waste of time and resources.)  So although B now has a private key which can spend A's bitcoins, he will not be aware of it, unless/until he manually forces a block chain rescan (e.g. with Bitcoin Core's <code>-rescan</code> option), or checks his address balance using an online block explorer, or something of the kind.  </p>

<p>Of course, barring RNG faults, this question is sort of like asking "If all 50 US state governors were simultaneously struck by lightning, how would the stock market be affected?"  It's based on such an improbable assumption that it's kind of absurd to draw any conclusion.</p>

CC BY-SA 4.0
2022-12-29T23:17:12.130Z
This answer actually answers the question the OP asked, rather than a completely different question that answerer wants to answer. But even this answer could not resist throwing in a disclaimer about why it is dumb to even ask such a question, despite the fact that the OP *explicitly* acknowledged the "the astonishing improbability" in the question. Such is the level of discourse in the bitcoin universe (which, everyone must chime will not exist long enough for any undesirable bitcoin thing to ever happen).
bigjosh
CC BY-SA 3.0
2015-07-08T06:48:08.900Z
2015-07-08T06:48:08.900Z
Nate Eldredge
<p>I suspect the simple answer is that Person B would be able to spend Person A's bitcoins, as he would show up in the ledger as owning them. Not dissimilar from simply giving someone your wallet.</p>

CC BY-SA 3.0
2013-05-03T13:20:03.583Z
I'm not sure that this is fundamentally different than [Nicolai](http://bitcoin.stackexchange.com/users/2785/nicolai)'s answer. Nicolai just goes into more details. i.e. whether it was just a public key hash that collided or a true duplicate key pair. As well as details on the improbability of that happening.
David Ogren
CC BY-SA 3.0
2013-05-03T10:54:45.970Z
2013-05-03T12:39:29.007Z
2013-05-03T12:39:29.007Z
Karl
<p>Funny how people claiming to know about crypto can't calculate probabilities.</p>

<p>The address space of 2<sup>128</sup> is not the probability or "strength" of anything (other than the probability of picking a value in the address space).</p>

<p>The probability of 2 people having the same bitcoin address is actually a lot higher than people may suspect by (faulty) intuition.</p>

<p>In fact, the likelihood of collision is related to the <a href="https://en.wikipedia.org/wiki/Birthday_problem" rel="nofollow">Birthday Problem</a> (read about it).</p>

<p>As the number of people and addresses generated increases, likelihood of a collision increases close to exponentially.</p>

<p>Given a few million users each generating a new address per month, the likelihood of a collision is such that it could occur several times in a lifetime, especially as we're dealing with hashes (or hashes of hashes).</p>

<p>Make it a billion users and you have regular stories of collisions appearing.</p>

CC BY-SA 3.0
2013-02-17T06:47:20.453Z
Actually, the probability of a collision goes up as the square (i.e. quadratically) of the number of bitcoin addresses used.  Not exponentially.  Now, with that correction the probability of a collision is approximately zero in the lifetime of the solar system.
Neal Gafter
CC BY-SA 3.0
2013-02-18T03:05:25.197Z
I believe that I am reading wikipedia there needs to be `~2.2×10^19` bitcoin address until there is a 50% probability that there has been at least one collision. So basically don't worry.
placeybordeaux
CC BY-SA 3.0
2013-03-19T11:57:03.040Z
Birthday problem on 160 bit bitcoin addresses doesn't apply, since collisions are irrelevant. It's a second pre-image attack which has cost (2^160)/n where n is the number of targets. So if all 21 million bitcoins are already mined, you need to calculate (2^160)/(21*10^6) = 7*10^40 = 2^135 hashes per stolen bitcoin. Which is not profitable (by far), even if you assume bitcoin is used for all of our economy.
CodesInChaos
CC BY-SA 3.0
2013-02-17T02:22:18.083Z
2013-03-19T07:09:14.630Z
2013-03-19T07:09:14.630Z
vishnuchips
<p>If this happens, then Person B will be able to spend person A's bitcoins. However, there are only two ways this can happen:</p>

<p>a) Person B generates the same keypair (private key) as person A</p>

<p>or b) Person B generates a different keypair, which (public key) hashes to person A's address (a hash collision)</p>

<p>Take a look at the specification for at bitcoin address: <a href="https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses">https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses</a></p>

<blockquote>
  <p>A Bitcoin address is a 160-bit hash of the public portion of a
  public/private ECDSA keypair</p>
</blockquote>

<p>For "a" to happen, person B would need to break "secp256k1".
I am no expert on this field, but from what I can find on <a href="https://bitcointalk.org/index.php?topic=92423.msg1048511#msg1048511">bitcointalk.org</a>, then the "strength" of this is 2^128 bits. And if you're wondering how strong that is, then look for the video "Exhaustive search attacks" from <a href="https://www.coursera.org/course/crypto">Dan Boneh</a>. 11 minutes in the video he says "<em>anything that's bigger than 2^90 is considered sufficiently secure</em>" (its about attacking 3DES, which is a symmetric block cipher so I'm not sure it actually apply to secp256k1, but I really have no better argument for why 2^128 is "<em>so secure that you won't never, ever, ever generate the same key as someone else</em>"</p>

<p>And for "b" to happen, you would need to find a collision on RIPEMD-160(SHA-256(pk)). As far as I know, then neither RIPEMD-160 nor SHA-256 is known to have any vulnerabilities to hash collision attacks. So somehow breaking both or randomly generation a key which hashes is exactly the same as another bitcoin address, is highly unlikely.</p>

<p>There is also a chance for you computer to catch on fire, and some of the materials to melt together into a lotto coupon with winning numbers on (and a valid barcode), but it just won't happen because of the chance is so unbelievably small (it's the same with the "<em>click and generate another persons bitcoin address</em>").</p>

<p>EDIT Woops, one important thing: This all assumes that all bitcoin addresses are properly generated using "true random". All <em>brain-addresses</em> and addresses generated using a bad PRG, might be easy to find by either using a flaw in the PRG or exploit the (flaws in the) human brain.</p>

CC BY-SA 3.0
2013-03-19T11:51:04.150Z
Your case "b" is a (multi target) second pre-image, not a collision. You want to match the hash of an existing message you can't influence. A collision would be Person B creating two distinct inputs with the same hash.
CodesInChaos
CC BY-SA 3.0
2013-10-20T12:16:47.100Z
But are all addresses verified to check for duplicates when the blockchain is synchronised by your address generating client? If there is an address collision, wouldn't it cause serious confusion and possibly substantial financial loss (if funds are transferred to person b's account since they were under the illusion they controlled it?) Can we avoid person b losing funds by alerting them an address they generated, has actually since been detected while they caught up with the blockchain? At least then person b knows to wait for sync before asking for payments to this address.
deed02392
CC BY-SA 3.0
2014-03-24T13:09:27.577Z
I believe case A will be far more common once Bitcoin becomes mainstream. Lots of people will use weak private keys, and plenty of them will use the same as another random guy, resulting in them both spending each other's coins :(
Joe Pineda
CC BY-SA 3.0
2014-08-07T11:54:23.023Z
How can you calculate odds without taking into account processing power and its exponential increase? Yes, bitcoin has some protection against that... but it's a significant factor. An alien civilization with black-hole-like-dense quantum computers have probably already stolen all your coins in some infinity of paralellel universes... http://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin
Dagelf
CC BY-SA 4.0
2019-05-08T04:09:03.073Z
Here are some cases of "a)" on mainnet :)) https://lbc.cryptoguru.org/trophies
charlie137
CC BY-SA 3.0
2013-02-16T23:55:29.667Z
2014-01-24T07:27:19.983Z
2014-01-24T07:27:19.983Z
Nicolai
<p>Here's a what-if scenario:</p>

<p>Person A has a Bitcoin address with 25BTC.
Person B opens up their Bitcoin client:</p>

<ul>
<li>which may or may not have the complete blockchain (the latter would
mean no copies of Person A's transactions)</li>
</ul>

<p>Person B presses "New Address", and Person A's address happens to somehow be generated. Now, the blockchain finishes synchronizing.</p>

<p>What happens? Is this a possibilty, sans the astonishing improbability? After all, random number generation can be influenced.</p>

CC BY-SA 3.0
2013-02-16T20:54:11.577Z
They'd be able to spend each other's coins.
Nick ODell
CC BY-SA 3.0
2014-03-24T12:51:49.053Z
related: [How many Bitcoin addresses are there?](http://bitcoin.stackexchange.com/q/10850/5406), [Is it possible to brute force bitcoin address creation in order to steal money?](http://bitcoin.stackexchange.com/q/22/5406)
Murch
CC BY-SA 3.0
2014-03-24T22:28:36.213Z
@rponder No, the labels you attach to some addresses are just on your own computer.
Murch
CC BY-SA 3.0
2016-04-06T19:14:22.187Z
Generate the same keypair hash (AKA collision) equals the chances of Chloë Grace Moretz be my gf, 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976 of possible addresses, how many chances do you think you have?
D.Snap
CC BY-SA 3.0
2015-10-09T02:50:12.790Z
@SaintHill oh wow, that's bad
Austin Burk
<address><address-generation><key-collision>
What happens if your bitcoin client generates an address identical to another person's?
Austin Burk
# What happens if your bitcoin client generates an address identical to another person's?

(Asked by: username_0 on 2013-02-16)

Here's a what-if scenario:

Person A has a Bitcoin address with 25BTC.
Person B opens up their Bitcoin client:

* which may or may not have the complete blockchain (the latter would
  mean no copies of Person A's transactions)

Person B presses "New Address", and Person A's address happens to somehow be generated. Now, the blockchain finishes synchronizing.

What happens? Is this a possibilty, sans the astonishing improbability? After all, random number generation can be influenced.

**Tags:** address, address-generation, key-collision

> **Comments:**
> **username_1**: They'd be able to spend each other's coins.  
> **username_2**: related: [How many Bitcoin addresses are there?](http://bitcoin.stackexchange.com/q/10850/5406), [Is it possible to brute force bitcoin address creation in order to steal money?](http://bitcoin.stackexchange.com/q/22/5406)  
> **username_2**: @rponder No, the labels you attach to some addresses are just on your own computer.  
> **username_0**: @SaintHill oh wow, that's bad  
> **username_3**: Generate the same keypair hash (AKA collision) equals the chances of Chloë Grace Moretz be my gf, 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976 of possible addresses, how many chances do you think you have?  

---

## 5 answers

### Answer by username_16 on 2013-02-16. Score: 40 | Accepted answer

If this happens, then Person B will be able to spend person A's bitcoins. However, there are only two ways this can happen:

a) Person B generates the same keypair (private key) as person A

or b) Person B generates a different keypair, which (public key) hashes to person A's address (a hash collision)

Take a look at the specification for at bitcoin address: <https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses>

> A Bitcoin address is a 160-bit hash of the public portion of a
> public/private ECDSA keypair

For "a" to happen, person B would need to break "secp256k1".
I am no expert on this field, but from what I can find on [bitcointalk.org](https://bitcointalk.org/index.php?topic=92423.msg1048511#msg1048511), then the "strength" of this is 2^128 bits. And if you're wondering how strong that is, then look for the video "Exhaustive search attacks" from [Dan Boneh](https://www.coursera.org/course/crypto). 11 minutes in the video he says "*anything that's bigger than 2^90 is considered sufficiently secure*" (its about attacking 3DES, which is a symmetric block cipher so I'm not sure it actually apply to secp256k1, but I really have no better argument for why 2^128 is "*so secure that you won't never, ever, ever generate the same key as someone else*"

And for "b" to happen, you would need to find a collision on RIPEMD-160(SHA-256(pk)). As far as I know, then neither RIPEMD-160 nor SHA-256 is known to have any vulnerabilities to hash collision attacks. So somehow breaking both or randomly generation a key which hashes is exactly the same as another bitcoin address, is highly unlikely.

There is also a chance for you computer to catch on fire, and some of the materials to melt together into a lotto coupon with winning numbers on (and a valid barcode), but it just won't happen because of the chance is so unbelievably small (it's the same with the "*click and generate another persons bitcoin address*").

EDIT Woops, one important thing: This all assumes that all bitcoin addresses are properly generated using "true random". All *brain-addresses* and addresses generated using a bad PRG, might be easy to find by either using a flaw in the PRG or exploit the (flaws in the) human brain.

> **Comments:**
> **username_15**: Your case "b" is a (multi target) second pre-image, not a collision. You want to match the hash of an existing message you can't influence. A collision would be Person B creating two distinct inputs with the same hash.  
> **username_17**: But are all addresses verified to check for duplicates when the blockchain is synchronised by your address generating client? If there is an address collision, wouldn't it cause serious confusion and possibly substantial financial loss (if funds are transferred to person b's account since they were under the illusion they controlled it?) Can we avoid person b losing funds by alerting them an address they generated, has actually since been detected while they caught up with the blockchain? At least then person b knows to wait for sync before asking for payments to this address.  
> **username_18**: I believe case A will be far more common once Bitcoin becomes mainstream. Lots of people will use weak private keys, and plenty of them will use the same as another random guy, resulting in them both spending each other's coins :(  
> **username_19**: How can you calculate odds without taking into account processing power and its exponential increase? Yes, bitcoin has some protection against that... but it's a significant factor. An alien civilization with black-hole-like-dense quantum computers have probably already stolen all your coins in some infinity of paralellel universes... http://bitcoin.stackexchange.com/questions/6062/what-effects-would-a-scalable-quantum-computer-have-on-bitcoin  
> **username_20**: Here are some cases of "a)" on mainnet :)) https://lbc.cryptoguru.org/trophies  

---

### Answer by username_4 on 2013-05-03. Score: 30

This is the way I see it. The total number of bitcoins that will ever be mined is 21 million. The smallest bitcoin unit is a satoshi (0.00000001 BTC). If we place all possible satoshis into a wallet of their own, we would get the maximum number of wallets that could have any balance to them (so the actual number of wallets with bitcoins is obviously less). This is 21x10^6(BTC) x 10^8 (satoshi/BTC) = 21 x10^14 wallets. It's a huge number, but it's eclipsed by 2^256 possible wallets. So in this worst case scenario, the probability of guessing a wallet with one satoshi is 21x10^14/(2^256)=1.813595x10^-62. An incredibly small number.

> **Comments:**
> **username_5**: By the Birthday Problem, the odds of two people have the same address in that situation would be about 1-e**(-((21*10**14)**2)/(2*(2**256))) .  That's like 1 atom compared to the number of atoms in the Earth.  Quite small.  
> **username_2**: This answer doesn't address the main question "What would happen if two users generated the same address?", rather just evaluates the likelihood of the question being relevant, which the asker already seems to have been aware of. This answer would be a better fit on e.g. [How many Bitcoin addresses are there?](http://bitcoin.stackexchange.com/q/10850/5406) or [Is it possible to brute force bitcoin address creation in order to steal money?](http://bitcoin.stackexchange.com/q/22/5406).  
> **username_6**: +1 for details on how unlikely (unprofitable) brute forcing an existing address is  
> **username_7**: Actually, there are only `2^160` possible addresses. More than one private key (of which there are `2^256` possible ones) would hash to the same address.  

---

### Answer by username_8 on 2015-07-08. Score: 3

A slight addition to the existing answers:

If B has not downloaded enough of the block chain to see A's transaction, then the situation will be as described above. When blocks are downloaded by a wallet client, the transactions therein are checked to see whether any of them send coins to addresses held in this wallet. If so, those coins are added to the wallet's balance. So B will see an extra 25 BTC appear in his wallet. As mentioned in the other answers, he'll be able to spend them as if they were his own. So it's a race between A and B to see who spends them first - either can do it.

If B has already downloaded the relevant transactions before generating the colliding address, the situation is a little different. As far as I know, most Bitcoin clients, when generating a fresh random address, will not rescan the block chain to see whether it contains any transactions sending coins to that address. (As described above, the probability of this happening is infinitesimally small, so for all practical purposes, such a scan would just be a waste of time and resources.) So although B now has a private key which can spend A's bitcoins, he will not be aware of it, unless/until he manually forces a block chain rescan (e.g. with Bitcoin Core's `-rescan` option), or checks his address balance using an online block explorer, or something of the kind.

Of course, barring RNG faults, this question is sort of like asking "If all 50 US state governors were simultaneously struck by lightning, how would the stock market be affected?" It's based on such an improbable assumption that it's kind of absurd to draw any conclusion.

> **Comments:**
> **username_9**: This answer actually answers the question the OP asked, rather than a completely different question that answerer wants to answer. But even this answer could not resist throwing in a disclaimer about why it is dumb to even ask such a question, despite the fact that the OP *explicitly* acknowledged the "the astonishing improbability" in the question. Such is the level of discourse in the bitcoin universe (which, everyone must chime will not exist long enough for any undesirable bitcoin thing to ever happen).  

---

### Answer by username_10 on 2013-05-03. Score: 1

I suspect the simple answer is that Person B would be able to spend Person A's bitcoins, as he would show up in the ledger as owning them. Not dissimilar from simply giving someone your wallet.

> **Comments:**
> **username_11**: I'm not sure that this is fundamentally different than [username_16](http://bitcoin.stackexchange.com/users/2785/username_16)'s answer. username_16 just goes into more details. i.e. whether it was just a public key hash that collided or a true duplicate key pair. As well as details on the improbability of that happening.  

---

### Answer by username_12 on 2013-02-17. Score: -5

Funny how people claiming to know about crypto can't calculate probabilities.

The address space of 2128 is not the probability or "strength" of anything (other than the probability of picking a value in the address space).

The probability of 2 people having the same bitcoin address is actually a lot higher than people may suspect by (faulty) intuition.

In fact, the likelihood of collision is related to the [Birthday Problem](https://en.wikipedia.org/wiki/Birthday_problem) (read about it).

As the number of people and addresses generated increases, likelihood of a collision increases close to exponentially.

Given a few million users each generating a new address per month, the likelihood of a collision is such that it could occur several times in a lifetime, especially as we're dealing with hashes (or hashes of hashes).

Make it a billion users and you have regular stories of collisions appearing.

> **Comments:**
> **username_13**: Actually, the probability of a collision goes up as the square (i.e. quadratically) of the number of bitcoin addresses used.  Not exponentially.  Now, with that correction the probability of a collision is approximately zero in the lifetime of the solar system.  
> **username_14**: I believe that I am reading wikipedia there needs to be `~2.2×10^19` bitcoin address until there is a 50% probability that there has been at least one collision. So basically don't worry.  
> **username_15**: Birthday problem on 160 bit bitcoin addresses doesn't apply, since collisions are irrelevant. It's a second pre-image attack which has cost (2^160)/n where n is the number of targets. So if all 21 million bitcoins are already mined, you need to calculate (2^160)/(21*10^6) = 7*10^40 = 2^135 hashes per stolen bitcoin. Which is not profitable (by far), even if you assume bitcoin is used for all of our economy.  

---

