Everyone knows that spending from an address multiple times is bad, because Winternitz OTS.

But, what does that mean, exactly? What information is leaked in each signature, and how would an attacker exploit that information to discover the private key?

  • I’m voting to close this question because it is about the legacy protocol and given the latest updates it might make sense to only keep recent Shimmer, ShimmerEVM and IOTA Chrysalis questions Commented Apr 28, 2023 at 7:01

3 Answers 3


To expand on CFB's answer, because IOTA uses Lamport signatures, half of the private key is leaked each time. This halves the security level of the address (from 54 trytes of security to 27 trytes for a typical address with security level 2), making it exponentially easier to brute force the remainder of the private key with each key reuse. While after a single use funds are still relatively safe (27 trytes equates to about 128 bits of security), after 2 or 3 reuses, the funds will be in grave danger.

More information:
Lamport signature: How many signatures are needed to forge a signature?

  • This answer is theoretically correct but it does not take practice into account. See my answer below. Commented Dec 2, 2017 at 22:47

Fragments of the private key of that reused address are leaked. An attacker could find a bundle hash (via brute-forcing) that can be signed with the leaked fragments. Luckily for the user, the window for the attack is short (only while the spending transaction is not confirmed). But if more iotas come to the reused address the attacker can spend them right away if he completes the brute-forcing by that time.

  • Assuming the respend tx has been confirmed, is there still a risc when receiving funds on the reused address? Commented Dec 1, 2017 at 19:19

With every spend a random 50% of the private key is exposed. The reason that it is a one-time signature follows from what a second spend can reveal:

The overlap of the 2 random 50% reveals can be anywhere from 0% to 100%. Since it is random, the distribution for this will be on a bell curve.

Which makes 0% overlap (left/bottom of bell curve) and 100% (right/bottom of bell curve) overlap highly unlikely, 50% the most likely (middle/top of bell curve), and the likelihood decreasing faster and faster when you move towards either extreme.

But randomness being what it is, every value between 0% and 100% overlap can in practice occur. So if you are unlucky the overlap is a lot less than 50%, and in that case a lot more more than the theoretical average of 75% of your private key is exposed after the second spend.

This can be a problem because a possible attacker monitoring spent addresses can detect a second spend in progress, and until that second spend is confirmed he has time to brute force the missing parts of the private key and try to get his own spend of the funds in the address confirmed.

Any funds coming on that address after that are essentially gone the moment they arrive.

  • Just for clarification: it would be possible (and very unlikely) that after only 2 signatures, 100% of my seed is exposed?
    – Zauz
    Commented Dec 2, 2017 at 22:59
  • 4
    Zauz, 100% of the private key of that address, but not your seed (so other addresses of your seed are fine). For that to happen, the first half of one of the two bundle hashes has to be all 9, and the second half of the other one too.
    – mihi
    Commented Dec 2, 2017 at 23:59
  • 2
    100% is so extremely unlikely that the chance equals pretty much to zero. Commented Dec 4, 2017 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.