Address reuse is opening the box twice

Updated September 2026

People talk about address reuse as a privacy habit. It is also an exposure habit. Once a hash-based address has spent, its public key is on the chain. Receiving more coins to that same string does not put the key back in the box.

The first spend

A signature from a P2PKH, P2SH, or SegWit v0 output has to include the public key. That is how the network checks the spend. After confirmation, anyone can read the key from that transaction for as long as the chain exists. The closed versus open distinction is decided at that moment, not when you later change your mind.

Check the address in Schrödinger's Wallet before you treat it as unused. A receive-only history stays closed. One outgoing input opens it.

Reuse does not re-seal anything

If you publish the same receive string on a profile, a tip page, or an invoice for years, every later payment lands in an address whose key may already be public. You have not created a new box. You have topped up an open one. Change outputs that bounce back to the same script have the same shape.

Taproot is different and worse for this particular goal: the key is public on the first receipt, so reuse is not the event that opens it. Receipt already did. Read Taproot and the open-on-arrival rule.

What to do

1. Paste the old address into the checker. If it is open, treat leftover coins as sitting in a published key.
2. Generate a fresh hash-based address you have never spent from. Most wallets do this when you tap receive.
3. Move the full remaining balance in one transaction. Partial sends leave change behind. The walkthrough is how to move coins to a still-closed address.
4. Stop giving out the old string.

This is hygiene, not a rescue. It does not un-publish the old key. It stops adding balance to an already-open output. It is also not urgent in the quantum sense: nothing that exists can use that published key today.