Stealth Address

A stealth address is a privacy technique in which a recipient publishes a single static address, yet every payment to it lands at a different, unlinkable one-time address on the blockchain. An outside observer scanning the chain cannot tell that the separate outputs all belong to the same person, which defeats the address-reuse and clustering heuristics that ordinary reused addresses leak to every chain-analysis firm. It is the conceptual ancestor of Bitcoin's modern reusable-address schemes, and the cleanest illustration of a powerful idea: a public identifier that never appears on-chain.

How it works

The recipient publishes public key material — typically a scan key and a spend key. To pay, the sender performs an Elliptic-Curve Diffie-Hellman (ECDH) calculation between their own key and the recipient's published key to derive a shared secret, then uses that secret to compute a fresh one-time output address that only the two of them can associate with the static identifier. Only the recipient, holding the matching private keys, can detect and spend funds sent to these derived addresses. The split between scan and spend keys enables a useful delegation: a watching device can hold the scan key to find incoming payments without any ability to spend them — a natural fit for the watch-only patterns used with a hardware wallet.

The detection problem

The elegance has a cost: because nothing on-chain points at the recipient, the recipient must discover payments by scanning candidate transactions and testing each against the scan key. That workload shaped every descendant of the idea. BIP47 payment codes (PayNyms) sidestepped scanning by having the sender announce the relationship once via a notification transaction — cheap detection, at the price of a visible on-chain hint that some relationship exists. Silent Payments (BIP352) took the opposite trade: no notification at all, with the scanning cost engineered down by restricting which transactions need checking and leaning on full-node infrastructure. Same ECDH core, two different answers to "how does the recipient find out?"

In Bitcoin and beyond

Stealth addresses were proposed for Bitcoin early on but never adopted at the protocol level; on Bitcoin the idea lives on through those reusable-address standards rather than as a native feature, while some privacy-focused chains use one-time output derivation natively for every payment. For a sovereign Bitcoiner the practical takeaway is simple: never hand out a raw address twice — publish a reusable code built on this math instead, and let cryptography do the unlinking. For the working Bitcoin implementations of this concept, compare Silent Payments and BIP47; the shared-secret math is the same ECDH used in Nostr encrypted messaging.

Limits worth understanding

One-time addresses solve linkability at the address layer, but they do not launder the coins themselves: amounts, timing, and the transaction graph still carry signal, and a payment received unlinkably can still be deanonymized later by careless spending — consolidating it with identified coins being the classic mistake. Stealth-style schemes therefore compose with, rather than replace, the rest of the privacy toolbox: coin control to keep contexts separated, mindful change handling, and collaborative techniques where the threat model calls for them. The other practical limit is ecosystem support — a reusable code only helps when wallets on both ends implement the standard correctly, so check support before publishing one as your donation address. The math is the easy part; the discipline around it is where privacy is actually won or lost. Treat one-time addresses as the foundation of receiving privacy, then build the spending habits on top — because an observer who cannot link your incoming payments can still learn plenty from how you spend them, and the chain forgets nothing.