Skip to main content
This article explains how to improve your post-quantum readiness on UTXO-based blockchains like Bitcoin by keeping funds at addresses that have never been spent from. This keeps your public key hidden, which reduces your exposure to future quantum attacks. Fireblocks Bitcoin wallets use address types that commit to a hash of the public key (P2PKH and P2WPKH), computed with SHA-256 followed by RIPEMD-160. Hash functions are not affected by the quantum attacks that threaten elliptic curve signatures, and because only the hash appears on-chain, the public key stays hidden. A new address is therefore not exposed to quantum attacks until its first spend.

How public key reveal works

Bitcoin funds are held as unspent transaction outputs (UTXOs), and each UTXO is locked to an address. The hash protects an address only until its first spend. When you spend a UTXO, the transaction includes the public key of that address, and the key stays on-chain permanently. From that point, the public key is permanently revealed, and the address no longer benefits from the protection that hashing previously provided. This applies to any funds that remain at the address, or that arrive there later. An address’s public key is revealed in any of the following scenarios:
  • Change returns to a spent address. By default, Fireblocks sends the change from an outgoing transaction back to the wallet’s permanent address. After the first spend, that address’s public key is revealed, and every later change output lands there.
  • Partial spends. When a transaction spends only some of the UTXOs at an address, the remaining UTXOs stay at an address that now has its public key revealed.
  • Address reuse for deposits. When deposits keep arriving at an address that has already been spent from, the new funds are sent to an address whose public key has already been exposed.

Keeping funds at addresses with no spend history

Fireblocks provides the following tools to help you stay post-quantum ready:
  • Change address rotation sends the change from every outgoing transaction to a new address instead of back to the wallet’s permanent address.
  • Fresh deposit addresses let you receive each deposit at an address that has never been spent.
  • UTXO selection lets you move funds off addresses that have already been spent.
Feature availability: Change address rotation is a workspace-level setting. When enabled, it applies to all vault accounts in the workspace, and you can’t exclude individual vault accounts. To enable it, contact your Customer Success Manager. Supported assets: all UTXO-based assets except Cardano (ADA). KeyLink wallets are not supported.

Rotate change addresses

When change address rotation is enabled, every outgoing transaction from a UTXO-based asset wallet, such as BTC, sends its change to a new address in the same vault account instead of to the permanent address. The new address appears in the wallet’s address list with the description Change address # x. Change address rotation applies only to transactions created after it is enabled. It doesn’t move existing funds or affect addresses that have already been spent from. To make sure change never lands at a revealed address, enable rotation before your first outgoing transaction. Change address rotation doesn’t create an extra transaction or add fees. The change output is part of the same transaction, and the vault account balance is unchanged. The only visible effect is that the number of addresses in the wallet grows by one for each outgoing transaction. In high-volume workspaces, this adds up to a large number of addresses over time. When your wallet uses the Adaptive selection strategy, Fireblocks may split the change into multiple outputs. With change address rotation enabled, each change output goes to its own new address, so a single transaction can create 2–4 change addresses. For more on selection strategies, see Understanding UTXO selection at Fireblocks. To enable change address rotation, contact your Customer Success Manager.

Use a fresh deposit address for each deposit

For UTXO-based assets, you can create any number of deposit addresses under the same asset wallet. To avoid receiving funds at a revealed address, create a new deposit address for each incoming deposit, rather than reusing an existing one. For more on managing deposit addresses at scale, see Manage deposits at scale.
When you receive Bitcoin or other UTXO-based assets through Fireblocks Network connections, Automatic Address Rotation sends each incoming transfer to a new deposit address. You don’t need to track or share the new addresses, because Network transfers use automated address authentication. For details, see Automatic Address Rotation.

Move funds off a revealed address

Change address rotation and fresh deposit addresses protect new funds. Funds that already sit at revealed addresses aren’t post-quantum ready until you move them. To move them, send the full balance of the revealed address to a new address in the same vault account. Spend all of the UTXOs at the revealed address in one transaction (up to 250 UTXOs per transaction), so that nothing remains behind. Pay the network fee from the same UTXOs, rather than from other addresses, so that the transaction doesn’t spend from (and reveal) any additional address.
Note: This flow uses the List UTXOs endpoint and the utxoSelectionParams field on Create Transaction. Supported assets: BTC, LTC, DOGE, BCH. For details, see Select UTXOs.
The flow:
  1. Create a new deposit address in the same vault account. This is the destination.
  2. Call List UTXOs filtered by the revealed address, and sum the amounts of its unspent outputs.
  3. Call Create Transaction for the full sum with treatAsGrossAmount set to true, a utxoSelectionParams filter for the revealed address, and the MEDIUM fee level. Fireblocks deducts the fee from the amount, so the transaction spends the address’s UTXOs completely and produces no change output.
  4. If the address holds more than 250 UTXOs, repeat the flow after each transaction completes.
Key points:
  • A transaction can spend up to 250 UTXOs. If the revealed address holds more, wait for the transaction to complete, then run the flow again until the address is empty.
  • The flow drains one address at a time. To drain several revealed addresses in one transaction, label their UTXOs and filter by label instead of by address. For details, see Select UTXOs.
  • The destination is the new address, passed as a one-time address. You can’t use the vault account itself as the destination, because a transfer to a vault account lands at its permanent address, which may already be revealed. Transfers to one-time addresses are disabled by default. To allow them, see One-Time Address (OTA) feature. Alternatively, whitelist the new address first, as described in Manage destination addresses.
  • The transaction uses treatAsGrossAmount: true, so Fireblocks deducts the network fee from the amount instead of adding UTXOs from other addresses to pay it. The fee level is MEDIUM, so you don’t need a separate fee estimate.
To move an entire wallet to a new address instead of a single address, you can use the max spendable amount, as described in Consolidate UTXOs, with the new address as the destination.

Identify revealed addresses

An address is revealed once it has been the source of an outgoing transaction. To check whether an address is revealed, review the vault account’s transaction history for any outgoing transaction that was spent from that address. Addresses that have only received funds are not revealed.

Limitations

Keeping funds at addresses that have never been spent from helps, but it doesn’t keep you post-quantum ready at all times:
  • Spending reveals the key. When you spend from an address, its public key is revealed in the pending transaction until the transaction confirms. Addresses that have never been spent from protect funds at rest, not funds in transit.
  • Fast key recovery is not covered. If an attacker could recover a private key within the time a transaction waits for confirmation, hashing the public key would not help. Calls to move funds to fresh addresses assume key recovery would take significantly longer than a typical confirmation window.
  • Bitcoin and other UTXO assets only. These techniques apply to UTXO-based assets. On Cardano (ADA), change address rotation isn’t available, but you can still use fresh deposit addresses and move funds off revealed addresses. On account-based blockchains such as Ethereum, an account’s public key is revealed by its first outgoing transaction, and there is no change output to move the remaining balance to a fresh address. On blockchains where the address is the public key, keeping an address unused doesn’t keep the key hidden.