What Information Does Address Reuse Leak?
Reusing the same crypto address reveals your total asset size, complete transaction history, social connections, and may even expose your real-world identity. If you've been receiving funds to the same address repeatedly, your on-chain financial privacy is essentially public.
What Address Reuse Reveals
Your total assets and balance
Anyone who knows your address can see how much you hold using a block explorer. Every incoming transaction and your current balance are visible to anyone who looks up that address.
Full transaction history and income/expense records
Every receipt and transfer is permanently recorded on-chain. Outsiders can see exactly when you received how much, who you sent funds to, and from where you received them.
Counterparties you interact with
When your address repeatedly transacts with specific addresses, who those addresses belong to (exchange, project, individual) can be analyzed. If those counterparties also reuse addresses, the financial relationship chain is exposed.
Linking multiple addresses that belong to you
When a wallet extension queries a server for balances and includes multiple addresses in a single request, the server learns that those addresses are controlled by the same person. Research found that among 85 mainstream browser wallets, 17 leak this information, covering about 23 million users.
Exposing your real-world identity
If a website knows both your wallet address and your email or name (e.g., from registration), it can link your on-chain anonymous identity to your real identity. This can lead to targeted phishing, scams, or even physical threats.
Cross-chain address linkage
Bitcoin and Ethereum addresses use different formats, but both rely on the same elliptic curve algorithm (secp256k1). Research found 1,604,614 keys reused cross-chain, among which 497,178 appear on both Bitcoin and Ethereum. This means if you manage Bitcoin and Ethereum addresses with the same private key, activity on both chains can be linked to the same person.
A Quick Way to Check if You're Reusing Addresses
Open your wallet and check your receiving history or transaction records:
Case A: Multiple different receive addresses all point to the same transaction or you always use the same address to receive all incoming funds. Risk is high.
Case B: Your wallet generates a new address each time you request a payment, and old addresses are not reused. This aligns with better privacy practices.
What counts as done: You've confirmed how many of your addresses have been reused and which public channels (social media, blog, GitHub) have posted your receiving address.
What to Do If You've Already Reused Addresses
Step 1: Stop using old addresses
Immediately stop receiving new assets to any old address. Use a new address generated by your wallet for every new incoming payment (one address per transaction).
Step 2: Clean up publicly posted address information
Check where you've posted your receiving address — social media, forums, blog posts, project profiles. Delete them if possible; if not, add a note stating "This address is no longer in use."
Step 3: Consider migrating assets
If you still hold assets in old addresses and privacy matters to you, move assets to a completely new set of wallet addresses (created with a new seed phrase). Keep in mind:
Transfer assets in batches to new wallets; don't send everything in one transaction, or the link between old and new addresses will be obvious on-chain.
Use a fresh, never-before-used address generated by the new wallet for each batch.
Step 4: Review wallet permissions (for browser extension users)
Open your browser wallet extension, go to the "Connected sites" or "Permissions" list, and manually remove authorization for any sites you no longer use. Research shows that even if you click "Disconnect" on a webpage, permissions remain active in 22 mainstream wallets until you remove them manually in wallet settings.
What counts as done: Old addresses no longer receive new assets, new addresses are used one-time-only without reuse, and publicly posted address information has been handled.
Risk Reminder
The biggest risk of address reuse is not a technical vulnerability, but the chain reaction after privacy is exposed: attackers can decide if you're worth targeting based on your asset size; they can design precise phishing content based on your transaction habits; if you're involved in sensitive donations or political activities, on-chain records can be traced and used for doxxing.
This is not something you can postpone until you "have more money." Once transaction history is on-chain, it cannot be undone. An address you think is irrelevant today might, three years later, expose your entire financial activity through a single chain analysis.
How to Confirm You've Fixed It
Create a new receiving address and send the minimum practical amount (consider gas fees) from another wallet. Then search your old address on a block explorer — you should see no new balance or transaction activity. Search the new address — you should see only that test transaction. There should be no obvious on-chain link between the two.
