#Tutorial. Why does your Bitcoin address keep changing?

Why does your Bitcoin address keep changing? This is a common situation: you receive bitcoin into your wallet and everything arrives as expected. A week later, you open the wallet to receive more and see a completely different address. The old one is no longer on the screen. For many people, the first reaction is the same: something must be broken, or the funds might go to the wrong place.

Nothing is broken. In modern HD wallets, address rotation is normal behavior built into the Bitcoin wallet standards. But “don’t worry, it’s normal” does not explain much. Below, we go all the way down to the protocol level: how addresses relate to keys, why a wallet can derive so many of them, where change goes, how blockchain analysts link addresses together, what the gap limit is, and what to do if you genuinely need one permanent address.

This guide is not tied to any particular wallet or manufacturer. The underlying mechanics come from Bitcoin standards, although the exact moment an app displays a new address depends on the wallet implementation.

The short answer

If you came here from search and only want to make sure your funds are safe:

• An HD wallet does not rely on a single address. It uses a deterministic tree of keys derived from one seed. A single seed can produce a practically unlimited number of addresses.
• After a receiving address has been used, the wallet will usually offer the next unused address. Some wallets can generate a new one earlier, for example when you explicitly request another address.
• All previous addresses derived from the same seed and derivation path remain under your wallet’s control. Bitcoin addresses do not expire, so funds sent to an old address do not disappear.
• The balance you see is the total value of the coins controlled across the entire account, not the balance of one address.
• If a transaction you sent shows a second output going to an unfamiliar address, that output is very often change returning to your own wallet.

Now for the mechanics. This is worth understanding once, because it answers a surprising number of practical questions about privacy, wallet recovery, and withdrawals from exchanges.

What a Bitcoin address actually is

The most important point in this entire topic is that the Bitcoin protocol itself does not really have a concept called an “address.” Blocks contain spending conditions in the form of scripts, or scriptPubKeys. An address is a human-readable representation of such a script: a wallet-level wrapper that is easier for people to copy and share. There is no global registry of Bitcoin addresses, and nothing about your address appears on-chain until it is actually used in a transaction.

That leads to an important consequence: a Bitcoin address does not need to be “created” or “registered.” A wallet can calculate addresses offline, by the millions, without an internet connection or permission from anyone.

From a private key to an address

The chain of transformations looks like this:

1. A private key is a secret number within the valid range of the secp256k1 curve, commonly represented as a 256-bit value.
2. The public key is calculated from the private key using the secp256k1 elliptic curve. Recovering the private key from the public key is considered computationally infeasible on classical computers.
3. What happens next depends on the output type. P2PKH and P2WPKH use HASH160 of the public key — RIPEMD-160(SHA-256(pubkey)). P2SH and P2WSH hash a script, while P2TR uses a tweaked x-only public key.
4. The result is then encoded into a human-readable address with a checksum: Base58Check for older formats, Bech32 for SegWit v0, and Bech32m for witness versions 1 and above, including Taproot.

The key detail is that not every Bitcoin address commits to the same kind of object. P2PKH and P2WPKH contain a public-key hash, P2SH contains the hash of a redeem script, and P2TR commits directly to an x-only output key. This distinction matters later when we discuss address reuse and public-key exposure.

Why addresses have checksums

An address is a string people copy, scan from a QR code, and sometimes type manually. Without validation, a typo could result in an invalid or unintended destination. Bitcoin address formats therefore include checksums, which means wallets can reject most accidental typing errors before a transaction is created or signed.

Base58Check, used by addresses beginning with 1 and 3, uses a checksum based on double SHA-256 and a reduced alphabet that excludes 0, O, I, and l because those characters are easy to confuse.

Bech32 (BIP173) uses a BCH code and provides strong guarantees for detecting common errors. Bitcoin addresses in this format are normally written in lowercase, and mixed case is invalid. Implementations can also use the checksum structure to help locate an error, although automatically “correcting” an address is unsafe.

Two separate ideas are easy to mix up here. The bc1q prefix corresponds to witness version 0, while bc1p corresponds to witness version 1, which is used by Taproot. Separately, the original Bech32 design was found to have an unexpected weakness: under specific conditions, inserting or deleting certain numbers of “q” characters immediately before a final “p” could leave the checksum valid. This was not a practical problem for SegWit v0 because of its length restrictions, but future witness versions needed a fix.

That is why BIP350 introduced Bech32m, which changes the constant used in the final checksum calculation. Witness version 0 remains on Bech32, while witness versions 1 and above use Bech32m. Older software that understands only Bech32 should reject such an address as invalid rather than silently interpret it as a normal SegWit v0 address.

One seed, countless addresses: BIP32

Early wallets often stored a collection of unrelated private keys. That meant a backup became outdated every time the wallet generated a new key. People really did lose coins this way: the backup existed, but it had been made before the key controlling a later receiving address was created.

In 2012, Pieter Wuille proposed BIP32, the standard for hierarchical deterministic wallets, or HD wallets, which solved this problem.

How the key tree is built

If you use a BIP39 seed phrase, it is first converted into a binary seed. BIP32 then uses HMAC-SHA512 to generate a master private key and a chain code. From there, the child-key derivation function takes a parent key, its chain code, and an index to create the next node in the tree.

The tree is deterministic: the same seed, used with the same derivation rules, produces the same keys in the same order. For a standard single-sig HD wallet, the seed phrase is the foundation of recovery, but you still need the correct script type and derivation path. More complex setups, such as multisig wallets, may also require additional information.

Hardened vs non-hardened derivation

This distinction is essential for understanding xpubs — extended public keys used to derive account addresses — as well as watch-only wallets and some of the risks that come with them.

There are two child-key derivation modes. With normal, or non-hardened, derivation, a child public key can be calculated from the parent extended public key without access to the private key. Hardened derivation uses indexes from 2³¹ upward, usually written with an apostrophe or the letter h, and requires the parent private key.

The practical difference is important. Non-hardened derivation makes a watch-only wallet possible: an app with the extended public key can derive addresses and monitor balances, but it cannot sign transactions. Hardened derivation prevents someone from recovering a parent or sibling private key from a single hardened child private key.

Derivation paths: how a wallet finds the right branch

The BIP32 tree by itself does not specify where “your” addresses are located. That structure is defined by BIP44, together with BIP43, which introduced the purpose field. A typical path looks like this:

m / purpose' / coin_type' / account' / change / address_index

The first three levels are hardened; the last two are not. This is deliberate: it allows an account-level extended public key to derive every receiving address and every change address in that account without exposing any private key.

Breaking down the path

• purpose: which address standard is being used. 44 is legacy (BIP44), 49 is nested SegWit (BIP49), 84 is Native SegWit (BIP84), and 86 is Taproot (BIP86).
• coin_type: the asset identifier from the SLIP-44 registry. Bitcoin uses 0; Bitcoin test networks use 1. Different assets live on separate branches so their key spaces do not overlap.
• account: the account number within the asset. Think of it as a logical sub-wallet with its own history and balance.
• change: 0 for the external chain — addresses you give to other people — and 1 for the internal chain, which is normally used for change.
• address_index: the sequential address number within that chain, starting at 0.

For example, m/84’/0’/0’/0/5 is the sixth receiving address, index 5, of the first Native SegWit Bitcoin account.

One seed can contain several account types

Because purpose is part of the derivation path, the same seed can produce separate address sets for legacy, nested SegWit, Native SegWit, and Taproot. These are not “different ways of writing the same address.” They are different branches with different keys and separate UTXOs. They are not independent from a backup perspective, however: compromising the master seed compromises all of those branches.

UTXOs: why change goes to a new address

This is the second, much less obvious reason new addresses appear. It tends to scare people more because, in a block explorer, it can look as though part of the money has disappeared.

What is a UTXO?

Bitcoin does not use account balances. Instead, it tracks unspent transaction outputs, or UTXOs. A UTXO is an indivisible chunk of bitcoin locked by a set of spending conditions. Your “balance” is the total value of all UTXOs your wallet can spend.

The closest everyday analogy is physical cash. You do not have one abstract number in your pocket; you have individual banknotes. You cannot cut a banknote in half and spend only part of it.

Coin selection and the change output

When you make a payment, the wallet performs coin selection: it chooses enough of your UTXOs to cover the payment amount plus the transaction fee. A UTXO cannot be spent partially; it is consumed in full.

If the wallet spends a 0.1 BTC UTXO to send 0.03 BTC, the transaction consumes the entire 0.1 BTC input and will usually create at least two outputs: 0.03 BTC to the recipient, and the remaining amount, minus the fee, back to your wallet. That remainder is the change. A modern HD wallet will usually send it to a fresh address on the internal chain.

For a Taproot account, for example, receiving addresses might follow m/86’/0’/0’/0/0, then /0/1, /0/2, while change returns to m/86’/0’/0’/1/0, then /1/1, /1/2. One tree, two separate branches.

A transaction does not always have exactly two outputs. If the potential change amount is too small, a wallet may choose not to create a separate change output at all, effectively adding that difference to the fee. Some coin-selection algorithms, including Branch and Bound in Bitcoin Core, deliberately search for no-change transactions when possible. That can be useful for both privacy and future fee efficiency.

So why does the address change? Three different reasons

The confusion comes from treating three separate mechanisms as if they were the same thing:

1. You receive coins and the wallet may move on to the next address on the external chain (change = 0). The exact timing depends on the software. Some wallets keep displaying the current unused address, while others let you generate another one manually before any funds arrive.
2. You send coins and the change returns to an address on the internal chain (change = 1). The normal Receive interface usually does not show these addresses.
3. You are looking at a different account type: legacy, nested SegWit, Native SegWit, or Taproot. Each type uses its own derivation branch and has its own set of UTXOs.

Do old Bitcoin addresses still work?

Yes. A Bitcoin address has no built-in expiration date and there is no revocation mechanism. As long as your wallet still has the private key or script data required to spend the corresponding output, funds sent to an old address remain spendable exactly as before.

The real edge case is not that an address “expires,” but that a wallet may fail to discover a far-away derived address when you restore the seed.

Gap limit: how far a wallet scans during recovery

When you restore a seed in a new wallet, the software does not know how many addresses you previously used. It scans them in order and eventually needs a stopping point because the derivation tree is effectively endless.

BIP44 defines an address gap limit: if discovery encounters 20 consecutive unused addresses on the external chain, the standard discovery algorithm may stop scanning. “Used” is determined from transaction history, not from the current balance.

BIP44 applies a similar idea at the account level. During account discovery, software stops looking for later accounts once the previous account has no transaction history. The standard also recommends that wallets not create another account while the previous one remains unused.

In the BIP44 account-discovery procedure, the wallet scans the external chain because the internal chain is intended for change generated by activity in the same account. Actual recovery behavior and keypool sizes can vary between wallet implementations.

The problematic case looks like this: you generate many receiving addresses in a row without using the earlier ones, then receive funds at an address far beyond the standard gap limit. During recovery, some wallets may stop scanning before they reach that address and temporarily fail to show the funds.

The coins are not lost. They are still on the blockchain and can reappear after increasing the gap limit or performing the correct rescan in software that supports it. The practical rule is simple: do not generate dozens of receiving addresses “just in case” unless you actually need them.

Why an xpub alone may not be enough: output descriptors

An extended public key (xpub) does not always describe the full wallet context by itself. You also need to know its origin or derivation path and the script type. The same derived public keys can be wrapped in different output types, so one bare xpub string may not be enough to reconstruct the wallet metadata reliably years later.

Wallet developers initially worked around this with SLIP-132 prefixes such as ypub and zpub, which hint at the intended address type. This is not a Bitcoin consensus standard and support is inconsistent, which is why users sometimes run into situations where one wallet exports zpub while another service asks for xpub.

The cleaner solution is output descriptors, defined by BIP380 and related standards. A descriptor is a string that explicitly specifies the script type, master-key fingerprint, derivation path, extended key, and its own checksum. A simplified example looks like this:

wpkh([d34db33f/84h/0h/0h]xpub6.../0/*)#checksum

Output descriptor support appeared in Bitcoin Core 0.17, and descriptor wallets became the default wallet type in Bitcoin Core 23.0. If your wallet can export a descriptor, it is useful to keep it as additional documentation of the wallet structure. But a descriptor containing an xpub does not replace the seed or private keys and, by itself, cannot spend funds.

Why Bitcoin wallets rotate addresses: privacy

Address rotation is not just a cosmetic wallet feature. Bitcoin is public: every transaction remains visible to anyone. The privacy question is how easily those transactions can be linked together and then linked to you.

What address reuse reveals

If you use one address for every payment you receive, anyone who knows that address can directly see every UTXO and transaction associated with it in a block explorer. Instead of exposing one payment, you expose a much larger slice of your financial history.

A fresh address has no previous history of its own, so it does not directly reveal your other incoming payments. This improves privacy, although blockchain analysis can still connect separate addresses through behavioral and transaction-level heuristics.

The common-input-ownership heuristic

This is one of the main tools used in blockchain analysis. If several addresses appear as inputs to the same transaction, an analyst may assume they belong to the same owner, because spending all of those inputs normally requires access to all of the corresponding private keys.

The assumption is probabilistic, not absolute. CoinJoin and other collaborative transactions can break it because their inputs belong to multiple unrelated participants. For ordinary single-user transactions, however, the heuristic often remains useful.

How analysts identify change outputs

This is another major technique in blockchain forensics. In a transaction with two outputs, the protocol does not label one “payment” and the other “change.” They look the same on-chain. Analysts try to distinguish them using a collection of heuristics:

• Matching script types. Wallets often send change back to the same script type they are spending from. If every input is P2WPKH and one output is P2WPKH while the other is P2TR (Taproot), the P2WPKH output may be more likely to be change.
• Round amounts. A payment of exactly 0.05 BTC next to an output of 0.03847291 BTC makes the round output look more like the intended payment and the irregular amount more like change.
• A fresh address. An output to an address with no previous history may be more likely to be a new change address generated by the sender’s HD wallet.
• An unnecessary input. If the transaction could have been funded with fewer inputs, the extra input can sometimes provide clues about which output is change.
• RBF replacements. Replace-by-Fee allows a transaction to be reissued with a higher fee. Many wallets fund that fee increase by reducing the change output, so comparing multiple versions of an RBF transaction can help identify which output is change. This is not universal across every wallet implementation.
• Wallet fingerprints. Different wallets sort outputs differently, set nLockTime in characteristic ways, and choose different script types. These patterns can help analysts identify the software and recognize later transactions created by the same wallet.

Each heuristic is uncertain on its own, but together they can produce high confidence. The result is often a so-called peeling chain: a long sequence in which smaller payments are “peeled off” from a larger amount while the remainder keeps moving through new change addresses. This pattern is especially visible in large exchange, marketplace, and mining-pool flows.

Address rotation makes analysis harder, but it does not make you anonymous. With additional information — for example, exchange records or later UTXO consolidation — an analyst may still reconnect separate addresses.

An xpub defeats address rotation for the observer who has it

An account-level xpub in a standard HD setup can derive all non-hardened receiving and change addresses for that account. Anyone who obtains that xpub together with the correct derivation context can monitor the entire account history and balance.

An xpub alone cannot spend your bitcoin because it contains no private keys. The dangerous exception is when the corresponding xpub leaks together with even one non-hardened child private key. Under BIP32, that combination can be used to recover the parent private key.

Third-party services sometimes request an xpub for watch-only monitoring or accounting. That is a legitimate use case, but only share it with someone you are comfortable giving a complete view of that account. A better approach is to create a separate account specifically for that purpose.

Public-key exposure and the Taproot exception

This is a more technical argument, and it is often oversimplified in popular explanations.

In P2PKH (1…) and P2WPKH (bc1q…), the output commits to a hash of the public key, so the public key itself becomes visible only when the output is spent, where it appears in the scriptSig or witness next to the signature. P2SH (3…) instead commits to the hash of a redeem script, so the exact behavior depends on the script being wrapped.

For P2PKH and P2WPKH, receiving new funds to an address that has already been spent from means those new coins are again tied to a public key that has already been revealed on-chain. This does not create a practical theft risk today, but it removes one layer of “public key hidden behind a hash.”

The security of these outputs relies on the hardness of the elliptic-curve discrete logarithm problem on secp256k1. Classical computers do not have a practical way to recover the private key from the public key. The quantum-computing concern remains theoretical: no sufficiently powerful quantum computer capable of attacking these keys in practice exists today.

For ordinary users, this is not a reason to avoid Taproot. Address rotation still helps against simple clustering in both cases, and Taproot brings its own advantages. It is simply inaccurate to present delayed public-key exposure as a universal argument against address reuse.

Why Ethereum usually keeps one address per account

Bitcoin and several Bitcoin-family networks, including Litecoin, Bitcoin Cash, Dogecoin, and Dash, use the UTXO model. Cardano uses the related eUTXO model, and transparent Zcash transactions also use a UTXO-style design. Ethereum, Solana, Tron, Cosmos, and Polkadot use account-based models.

In an account model, one specific address represents one account. There is no separate change output, and the balance is part of the network’s account state. One seed can still derive many separate accounts and addresses, of course; the difference is that the wallet does not automatically rotate through addresses in the same way a Bitcoin HD wallet does.

The privacy consequence is straightforward. If you receive USDT at the same address for two years, anyone who knows that address can immediately see the complete history of incoming and outgoing activity associated with it, along with the current balance. No clustering heuristic is required.

Bitcoin makes this kind of direct tracking harder by rotating addresses by default. In account-based systems, separating activity usually means creating different accounts manually: one for exchange withdrawals, one for receiving payments, and another for long-term storage. That is a practical reason not to keep your main stablecoin balance on the same address you post in chats or public profiles.

What if you need one permanent Bitcoin address?

Sometimes address rotation genuinely gets in the way: an exchange withdrawal whitelist, a mining-pool payout address, or a donation address posted publicly. There are several ways to handle this, with different trade-offs and levels of wallet support.

Intentional address reuse

This is the simplest option, and it is not always a bad one. If you are withdrawing from an exchange that has already completed KYC on you, you do not have privacy from that exchange anyway. Reusing one whitelisted address for regular withdrawals from that specific exchange can be a reasonable compromise.

The minimum privacy hygiene is to create a separate account for that flow — not just a separate address, but an account with its own xpub — and avoid spending those coins together with your other UTXOs in the same transaction.

BIP47: reusable payment codes

The idea is that you publish one static payment code. The sender uses a one-time notification transaction to establish a shared secret with you, and future payments derive new addresses from that relationship. On-chain, the payments appear as normal outputs to different addresses.

BIP47 never achieved broad wallet support. Its most visible implementation was PayNym in Samourai Wallet, and after that project shut down in 2024, parts of the PayNym infrastructure became unavailable. Before relying on BIP47, check the current support status in the wallet you plan to use. The design also requires a notification transaction before the first payment, which adds both a fee and an on-chain footprint.

Silent Payments (BIP352)

Silent Payments let you publish one reusable payment address beginning with sp1. Each payment to it creates a unique Taproot output, while the protocol avoids leaving a direct on-chain link between the published Silent Payment address and the individual outputs you receive. No separate notification transaction is required before the first payment.

At a high level, the sender calculates a shared secret from the aggregated public keys of the transaction inputs and the scan key encoded in your address. The recipient discovers payments by scanning transactions and performing the corresponding ECDH calculation — elliptic-curve Diffie–Hellman, where two parties derive the same secret without transmitting that secret over the network.

The trade-off is scanning. The recipient must inspect eligible transactions and perform the calculations needed to detect their payments. That is more practical for a full node, while efficient light-client support remains a separate engineering challenge. Silent Payment outputs themselves use P2TR.

As of August 2026, BIP352 is at version 1.1.1, dated April 16, 2026. Sparrow Wallet supports sending to Silent Payment addresses from version 2.3.0 and receiving from version 2.5.0, including support for air-gapped hardware signers. Bitcoin Core integration is still ongoing work; full wallet-level send and receive functionality is not yet a completed feature in a released version.

Lightning

If the goal is to receive recurring payments rather than store everything directly on-chain, Lightning can remove part of the problem. BOLT12 defines reusable offers: a recipient can publish one offer, and a payer can use it to obtain the invoice needed for a specific payment. This is a different layer with its own trade-offs around liquidity, availability, and backups, so it is not a replacement for cold on-chain storage.

When changing Bitcoin addresses becomes inconvenient

Exchange whitelists and wallet verification

Many exchanges let you add withdrawal addresses to a whitelist and then impose a waiting period before the first withdrawal. If your wallet is already showing a new receiving address by then, it can be tempting to keep updating the whitelist. In this situation, intentionally reusing one verified address for that particular exchange can be acceptable as long as you understand the privacy trade-off.

Some ownership-verification procedures are also tied to a specific address. If the address changes between verification and the transaction, the process can fail. When possible, complete the verification and the transaction in the same session instead of leaving a long gap between them.

Mining pools and services with fixed payout addresses

Mining pools, staking services, and some payment processors allow only one payout address. In that case there may be no choice. The same solution applies: use a separate account for that flow so repeated address use does not expose the rest of your wallet activity.

Donations and public payment addresses

A publicly posted donation address will be reused by definition, and from a privacy perspective that is one of the worst cases because the address is publicly tied to an identity. This is common with fundraising and volunteer wallets: once an address is posted on social media, it may remain permanently associated with the person or organization collecting funds. Silent Payments or BIP47 are especially valuable here. If neither is practical, the minimum is a separate account and no consolidation of those coins with your main holdings.

Accounting and watch-only access

If someone needs read-only access to a balance, do not send them addresses one by one. Create a separate account and share the descriptor or xpub for that account only. They will get a complete and continuously updated view of the relevant activity without learning anything about your other accounts.

Common mistakes

• Checking the address only on your computer screen. Malware can replace an address in the clipboard. If you use a hardware wallet, one of its core advantages is the ability to verify the receiving address on the trusted screen of the device itself before you use it.
• Confusing address rotation with address poisoning. Address poisoning is a separate attack in which someone sends you a tiny amount from an address made to look visually similar to one you use, often matching the first and last characters. The attacker hopes you will later copy that address from your transaction history. Never copy a recipient address from transaction history.
• Generating batches of addresses “for later.” This is an easy way to create a large unused gap and run into discovery limits during wallet recovery.
• Keeping only an xpub as your backup. Without the script type and derivation path, an xpub can be ambiguous. Save a descriptor as well if your wallet supports exporting one.
• Treating address rotation as full anonymity. It only makes analysis more expensive. UTXO consolidation, round amounts, and address reuse elsewhere can undo much of the privacy benefit.
• Panicking when your transaction has a second output. It may simply be your own change.

Conclusion

A Bitcoin address is not a permanent bank account number. In an HD wallet, addresses are derived from a deterministic key tree, and the wallet can rotate receiving addresses without creating a new seed.

Old Bitcoin addresses do not expire. Your wallet balance is built from all the UTXOs it controls, while change normally returns through the internal branch. Legacy, nested SegWit, Native SegWit, and Taproot may use different derivation paths, which is why choosing the correct account type matters during recovery.

One practical edge case is the gap limit. If you create a large run of unused receiving addresses, some wallets may stop their default recovery scan before reaching an address that actually received funds.

If your wallet keeps showing the same BTC address, that does not automatically mean anything is wrong. Check the documentation for that specific wallet: it may be an interface choice, an imported single key, or a different address-management model.

Further reading

• Lost Your Seed Phrase but Your Wallet Still Works: What to Do
• How to Store a Seed Phrase: 5 Safe Methods in 2026
• Hardware Wallet vs Exchange: Where Is It Actually Safer to Store Crypto?
• Withdraw Crypto to Card from Binance, OKX, Bybit in 2026

Sources

Standards:

• BIP32: Hierarchical Deterministic Wallets
• BIP39: Mnemonic code for generating deterministic keys
• BIP43: Purpose Field for Deterministic Wallets
• BIP44: Multi-Account Hierarchy for Deterministic Wallets — account discovery and the gap limit.
• BIP49 / BIP84 / BIP86: derivation for nested SegWit, Native SegWit, and Taproot.
• BIP173: Base32 address format for native v0-16 witness outputs (Bech32)
• BIP350: Bech32m format for v1+ witness addresses
• BIP352: Silent Payments
• BIP380: Output Script Descriptors General Operation
• SLIP-44 and SLIP-132

Other resources:

• Bitcoin Optech: Bech32 / Bech32m and Silent Payments.
• Bitcoin Wiki: Privacy
• M. Möser, A. Narayanan. Resurrecting Address Clustering in Bitcoin. Financial Cryptography 2022
• Learn Me A Bitcoin: HD Wallets and Derivation Paths.
• Wallets Recovery: wallet derivation paths and export formats.
• Silent Payments: BIP352 specification and support tracker.