Stealth Address

What Is a Stealth Address?

A stealth address is a privacy technique that lets a recipient publish a single, static meta-address while receiving every payment at a fresh, unlinkable on-chain address. The sender generates this one-time address using the recipient's public keys and an ephemeral key pair, ensuring that no outside observer can connect the payment to the recipient's identity or link two payments to the same person.

The concept was first proposed on Bitcointalk in 2011 and later formalized in the CryptoNote protocol (2013). Peter Todd introduced the Dual-Key Stealth Address Protocol (DKSAP) for Bitcoin in 2014, separating viewing and spending keys. Monero became the first major blockchain to implement stealth addresses at the protocol level. More recently, Ethereum standardized the approach through ERC-5564, and Bitcoin introduced silent payments via BIP-352.

Without stealth addresses, a recipient who shares a single address (for donations, invoicing, or receiving salary) exposes their entire transaction history to anyone who knows that address. Blockchain explorers can trivially aggregate all incoming payments, revealing balances and spending patterns. Stealth addresses break this link by ensuring each payment goes to a cryptographically unique destination.

How It Works

Stealth addresses rely on a cryptographic primitive called Elliptic Curve Diffie-Hellman (ECDH). The protocol involves two key pairs on the recipient side: a spending key and a viewing key. This separation allows the recipient to delegate payment detection (using the viewing key) without granting spending authority.

Setup: The Stealth Meta-Address

The recipient generates two elliptic curve key pairs on the secp256k1 curve:

• A spending key pair (b, B) where B = b × G (G is the curve's generator point)
• A viewing key pair (p, P) where P = p × G

The recipient publishes the stealth meta-address, which combines both public keys (P, B). This meta-address is shared publicly: on a website, in a profile, or registered on-chain.

Sending: Deriving the One-Time Address

When the sender wants to pay the recipient, they perform the following steps:

1. Generate a random ephemeral key pair (r, R) where R = r × G
2. Compute a shared secret using ECDH: s = r × P (the recipient's viewing public key multiplied by the sender's ephemeral private key)
3. Hash the shared secret: s_h = hash(s)
4. Derive the stealth public key: P_stealth = B + (s_h × G)
5. Compute the stealth address from P_stealth and send funds to it
6. Publish the ephemeral public key R (on-chain or via an announcement contract)

# Stealth address derivation (simplified pseudocode)
r = random_scalar()                    # Sender's ephemeral private key
R = r * G                              # Ephemeral public key (published)
s = r * P_view                         # ECDH shared secret
s_h = SHA256(s)                        # Hashed shared secret
P_stealth = P_spend + (s_h * G)       # One-time stealth public key
stealth_address = to_address(P_stealth)

Receiving: Detecting and Spending

The recipient scans published ephemeral keys to find payments addressed to them:

1. For each ephemeral public key R, compute the shared secret: s = p × R (the recipient's viewing private key multiplied by the sender's ephemeral public key)
2. Hash the shared secret: s_h = hash(s)
3. Derive the candidate stealth public key: P_stealth = B + (s_h × G)
4. If this matches the address that received funds, the payment belongs to the recipient
5. To spend, compute the stealth private key: k_stealth = b + s_h

The ECDH symmetry is what makes this work: r × P = r × (p × G) = p × (r × G) = p × R. Both parties arrive at the same shared secret independently.

Stealth Addresses on Ethereum: ERC-5564

ERC-5564 standardizes stealth address generation, announcement, and detection for Ethereum and EVM-compatible chains. The standard reached Final status and defines a singleton announcer contract deployed at a deterministic address.

When a sender creates a stealth payment, they call the announcer contract, which emits an event containing the ephemeral public key, the stealth address, and metadata (transfer type, token contract, and amount). Recipients monitor this single contract for announcements rather than scanning the entire chain.

View Tag Optimization

To reduce scanning overhead, ERC-5564 introduces a view tag: the first byte of the hashed shared secret. Recipients check this single byte before performing a full elliptic curve point multiplication, filtering out approximately 99.6% of irrelevant announcements. This reduces computational cost by roughly 6x while reducing the privacy margin from 128 bits to 124 bits: a negligible trade-off.

The Withdrawal Problem

A freshly generated stealth address on Ethereum contains no ETH, creating a bootstrapping problem: the recipient cannot pay gas fees to move received ERC-20 tokens without first funding the stealth address from a known wallet, which would break privacy. Solutions include relayer services (as used by the Umbra protocol), EIP-4337 account abstraction bundlers that accept token-based gas payments, and zero-knowledge proof systems that let the recipient prove ownership without revealing their identity.

Bitcoin Silent Payments: BIP-352

Silent payments achieve similar privacy goals to stealth addresses but are designed specifically for Bitcoin's UTXO model. The key difference: instead of generating a separate ephemeral key and publishing it on-chain, silent payments reuse the public keys already present in the sender's transaction inputs.

The recipient publishes a silent payment address (prefixed sp1q... on mainnet) containing their scan and spend public keys. The sender sums the private keys from all qualifying inputs and uses the result for the ECDH computation, then derives a Taproot (P2TR) output. This eliminates the need for an announcement transaction, reducing overhead to zero for the sender.

For a deeper technical comparison, see the research article on silent payments and Bitcoin privacy.

Comparison with Other Privacy Approaches

Stealth addresses protect recipient privacy: they prevent observers from linking payments to a known address. Other privacy techniques address different aspects of transaction privacy:

Stealth addresses are comparatively lightweight: they add meaningful recipient privacy without requiring multi-party coordination or complex proof systems. For a broader look at the state of on-chain privacy techniques, see the Bitcoin privacy landscape research.

Use Cases

Public Donation Addresses

Organizations and individuals who accept donations often publish a single Bitcoin or Ethereum address. Every donor can see the full balance and all other donations. With a stealth meta-address, each donation goes to a unique address, preserving donor and recipient privacy while keeping the donation process simple: share one address, receive at many.

Payroll and Recurring Payments

An employer paying salaries in cryptocurrency can use a stealth meta-address for each employee. Every paycheck arrives at a new address, preventing coworkers or chain analysts from tracking compensation amounts or spending habits. The employee's wallet automatically detects all incoming payments using the viewing key.

Merchant Payments

Merchants who accept cryptocurrency benefit from stealth addresses because customers cannot look up total revenue or other customers' purchases. This is particularly relevant for stablecoin payments where transaction values are transparent and denominated in recognizable units.

Regulatory-Compatible Privacy

The dual-key architecture enables a compliance-friendly design: the viewing key can be shared with auditors or regulators to prove incoming payment history without granting spending access. This separation supports privacy for users while meeting transparency requirements where applicable.

Why It Matters

Address reuse is one of the most common privacy failures in cryptocurrency. When a single address is shared publicly or used across multiple transactions, blockchain analytics can aggregate activity and profile the address holder. Stealth addresses solve this at the protocol level: the recipient shares one address, but no two payments ever go to the same on-chain destination.

As stablecoin payments grow and blockchain-based payroll and invoicing become more common, the need for recipient privacy increases. Dollar-denominated transactions make amounts immediately meaningful to any observer, amplifying the privacy risks of address reuse. Privacy-preserving infrastructure like stealth addresses will be a foundational layer for mainstream cryptocurrency adoption.

Adoption and Ecosystem

On Ethereum, the Umbra protocol (built by ScopeLift) is the largest stealth address implementation, with over 350,000 transactions processed across Ethereum, Polygon, Optimism, Base, and Arbitrum. Fluidkey integrates stealth addresses with ENS, generating per-transaction self-custodial addresses linked to a single ENS name.

On Bitcoin, silent payment support has expanded steadily since BIP-352 was finalized. Cake Wallet and Sparrow Wallet support both sending and receiving. BitBox02 became the first hardware wallet to support sending to silent payment addresses. Bitcoin Core integration remains under active development.

Risks and Considerations

Scanning Overhead

Unlike standard wallets that watch a fixed set of addresses, stealth address recipients must scan every relevant transaction or announcement to detect payments. On Bitcoin, this means processing every qualifying transaction on-chain. On Ethereum, the announcer contract and view tags reduce the burden, but the computational cost of elliptic curve operations for each candidate remains significant. Light clients face additional challenges: delegating scanning to a server requires sharing the viewing key, which creates a trust and privacy trade-off.

Withdrawal and Gas Costs

On Ethereum, each stealth address starts empty. Moving tokens from a stealth address requires ETH for gas, and funding the address from a known wallet links it to the recipient. Relayer services and account abstraction offer workarounds, but they add complexity and potential failure points. On Bitcoin, this issue does not arise because the UTXO model does not require gas payments.

Post-Quantum Vulnerability

Stealth addresses rely on the elliptic curve discrete logarithm problem. A sufficiently powerful quantum computer could break ECDH, compromising the shared secret derivation. Research into post-quantum stealth address protocols is ongoing, but no widely deployed solution exists yet.

Incomplete Privacy

Stealth addresses protect recipient identity, but they do not hide transaction amounts or sender addresses. An observer can still see how much was sent and from which address. For comprehensive transaction privacy, stealth addresses should be combined with other techniques such as CoinJoin (to obscure the sender) or confidential transactions (to hide amounts).

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.