I have a receive address that I have given out to other people, both for payments and donations;

After transferring the funds to a new address, someone has donated to the previous address.

How can I safely withdraw the funds a second time or ensure that people do not emit transactions to an address that has already been used-up?

  • This is the worst thing about IOTA.
    – Daniel F
    Commented Feb 10, 2018 at 17:29
  • I’m voting to close this question because it is about the legacy-network and it is a good idea to keep only Shimmer/ShimmerEVM and latest IOTA Chrysalis questions Commented Apr 24, 2023 at 14:06

8 Answers 8


How can I safely withdraw the funds a second time ?

Second withdraw will be less secure. The security decrease exponential with every withdraw. There is nothing you can do against that.

How can I ensure that people do not emit transactions to an address that has already been used-up?

As far as I know, there is nothing in IOTA protocol that prevent an actor to send funds to an address that was already used for withdraw.

Obviously, as soon as you publish your address publicly, you do not know what people will do with it. But if you can assume that they won't keep a copy of it for days/weeks before using it, then you just have to "unpublish" your address some days/weeks before the transfer. ("unpublish" or "publish a new one")

see also What information is leaked if I reuse an address?

  • So we can say that: all IOTAs arrived on a never used (for withdrawing) address are totally secure; even the first withdraw from this address is totally secure. All the IOTAs arriving on the same address after the first withdraw are at risk, even the second withdraw, until confirmed, is at risk. Then all the IOTAs arriving on the same address after the second withdraw are more at risk and so forth. Is it right?
    – blockmined
    Commented Feb 8, 2018 at 15:08

As far as I know Lets say you were receiving donations on Address X, my recommendation is to not use this address till you REALLY need to withdraw from it. After you withdraw from address X, make sure you never use it again to send/receive funds from/to address X. Generate a new address Y and update donation address wherever you've posted it. Another recommendation is to have one seed for a "donation wallet" and another seed for "personal wallet" to which you transfer funds from donation wallet.


For now, you need to make sure that you consider an address a temporary place to receive funds for the exact reason you bring up: You will be compromising your security by withdrawing from a static address multiple times.

There have been discussions for a future possibility of creating "alias" addresses. An alias would be able to dynamically move between addresses so they don't get reused, while staying static so people can reliable donate to them.

  • Can you provide more info(sources) about "alias" addresses? Commented Dec 7, 2017 at 17:54

Here is a proposition to overcome this issue: https://medium.com/@EricHop/solving-the-iota-donations-problem-by-using-iota-cheques-ebfd79f721d4


You can receive many times on that donation address. Just don't spend from that address.

Simply change the address after withdrawing IOTAs from that address.


I do not understand, why this concept was choosen. The poeple at IOTA tell, that one major goal of IOTA should be, to make machine to machine payments possible on the IoT. But how does this fit into the fact, that you are not allowed to re-use addresses?

Assuming, you have a „data-source“ - for example a sensor - and you want, that this “data-source“ is payed for each value it serves to a „consumer“ - an actor -. Let‘s assume, that this „data-source“ is meant to serve 100 values (information-entities) to 100 „consumers“ each second.

Should the „consumer“ ask the „data-source“ each time, it wants to receive data, for the address, it should transfere the money to and should the „data-source“ create a new address for each request? 10000 adresses per second? How mny adreesses can be generated for each seed?

  • Answers only. This section is not for Questions
    – Tobi MZ
    Commented Feb 8, 2018 at 10:04

Here are several my proposals for address aliases, which are going to solve this problem:

1) Masked Authenticated Messaging https://medium.com/@alexpods/iota-address-aliases-masked-authenticated-messaging-65d352a5389d

2) obsoleteTag field https://medium.com/@alexpods/iota-address-aliases-9f6d9894f74e


You can keep your receiving address untouched. Then, generate a new address every time you want to withdraw funds. As long as you do not use twice the same address to withdraw, your funds should be safe.

  • As far as I understand, the problem with addresses come when reusing them as sender, not not as receiver. What is exactly wrong about this understanding of mine? Commented Dec 4, 2017 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.