Topic: Exchange BTC addresses (Read 310 times)

This is what I hope.  There have been some other things in this thread that seemed to indicate otherwise, but I suspect that those responses were written by someone that didn't really understand what they were looking at.

Why does it? What's stopping them from creating a bunch of offline wallets, and importing the master public keys of these wallets to their exchange servers to generate addresses for users to deposit their bitcoin to? It would require someone to manually approve and transfer all unsigned/signed transactions back and forth, but it's not impossible. I agree it is unlikely, but not impossible. However, as I explained above, Shakepay don't do this and batch their withdrawal transactions normally.

No, with a custodial service, it is not.  The service should be pooling funds, and ONLY keeping enough funds available online to cover their short term withdrawal demands.


As I've already said, there is no such thing as "from an address" with Bitcoin.  Regardless, for Shakepay to be creating a transaction that uses the exact same UTXO that was created when they received the bitcoins on behalf of the OP, it means that they need to be keeping ALL bitcoins in a Hot Wallet.  This is how MtGox lost hundreds of thousands of Bitcoins.


A few things. Including, but probably not limited to:
The importance of cold storage and limited key access for custodial services.
The fact that bitcoins aren't sent from addresses.


You are mistaken. They don't.


Just like Shakepay, they SHOULD have a separate BTC address for every transaction.  A bitcoin address is more like an invoice number than an account number.  There is no good reason to re-use the address in this situation.


I have no disagreement about them having custodial control. They should have a new address for every time you send bitcoins to them, but since they don't the behavior you are describing is expected.


This is what I described as what I hoped happened in my earlier post here. In this case, the broker should gain a better understanding of bitcoin transactions if they are going to be accepting them and placing rules on how they can be used.


Well, at least they got that part right.  I'm still quite concerned that your description seems to indicate that they are keeping those keys online, and that funds aren't being pooled and moved to cold storage.


This is what I'm saying Shakepay SHOULD be doing.  However, from everything I've seen written about this set of transactions so far, it doesn't sound like Shakepay is doing that (which is why I wouldn't touch their service with a 10' pole until/unless I learned that they actually ARE doing what you've described).

The outgoing transaction has nothing to do with your selling. Exchanges usually move the fund deposited by the users to their own wallet and use that for processing withdrawals.
Therefore, even if you didn't sell your bitcoin and held it until now, you would still see that outgoing transaction.

Coinbase does the same thing. Havn't checked if Binance does but wouldn't be surprised if they did.


The forex broker has a separate BTC address for all users accounts. The transaction history of this address has only transactions that match my deposits. Of course the forex broker has custodial control over this address.

I think that the first time I made a withdrawal the broker saved that withdrawal address as the only one that can accept withdrawals in the future.

The timeline must have been like this:

I deposited to the forex brokers BTC address that they created for my account.

On June 25 I withdrew some funds using my Shakepay address. The broker saved that address however Shakepay changed it once the transaction was complete.

July 29th I attempted to withdraw again using the new address that Shakepay listed on my account but it failed because it did not match the address I had used to make the first withdrawal. I expect that, had it been my first withdrawal, the transaction would have been successful.


Yes the address has an incoming transaction from the FX broker and an outgoing transaction when I sold the BTC for fiat. Now, after my last withdrawal it has more transactions but Shakepay and other exchanges recommend against using the same address.

What's the problem? That's how it should be.
The incoming transaction should be OP's deposit to Shakepay (which is probably the withdrawal made on June 25 from the forex broker) and the outgoing transaction should be the transaction made to Shakpay's wallet address from OP's deposit address.  

Am I missing something here?

Using a new address for EVERY TRANSACTION is not a problem.  That's actually the best way to use bitcoin. The concern is if those receiving addresses are being treated as account numbers and the funds are not being held in cold storage.


First of all, they are not "accounts". These are "addresses". There's a huge difference.  A bitcoin address is more like an invoice number than an account.  It's a way to track and control a specific payment that you receive.


That's a HUGE problem.  If this is true, I'd avoid using Shakepay until they can demonstrate that they've improved their security practices.


There's no such thing as depositing "from a bitcoin address".  That sentence doesn't make sense.  You deposit TO an address (specifically, the address that the ForEx provider tells you to deposit TO). It's entirely possible AND VERY COMMON for a single transaction to contain bitcoins that were received at multiple different addresses.  Which address would the ForEx broker require you to use in that case?  It's also possible for a transaction output to contain a script that can not be converted to an address at all.  If you sent those bitcoins to the ForEx, how would they handle your withdrawal?  If your broker (or his company) don't understand that there's no such thing as a "sending address" in a transaction, and that bitcoin addresses shouldn't be re-used, then I wouldn't trust them to handle bitcoins properly at all, and would look for a new broker.

Under most circumstances, Bitcoin addresses should NOT be re-used.  Once you receive bitcoins at an address, you should not receive additional bitcoins at that address in the future. You should use a new address each time.  There is no money laundering benefit that is prevented by requiring someone to re-use a previous bitcoin address.

I was aware of their AML policies before I opened an account. What I didn't know is that exchanges will assign new addresses after every transaction.


I only use them as an on/off-ramp, I wouldn't recommend anyone hold assets in any exchange.

Assigning new addresses to users after every transaction seems to be standard practice with exchanges now. I've confirmed that Shakepay and Coinbase both do this. I can also confirm that these new accounts are not pooled with anyone else. The address that Shakepay created for me has only one incoming and outgoing transaction that matches the transaction I made.

The exchanges probably hold the keys and monitor all these addresses.


I think I'll side with the FX broker on this one since it would be heaven for money launderers if they could deposit BTC from one address and then withdraw to a completely different one. 

I'm not used to forex brokers or know how they operate but if you read their faq or terms and conditions they would have stated that they can only withdrawaw crypto-related transactions to the deposited address and it is their only way of preventing their customer funds from online theft.
I will advise you always read about every platform's rules and conditions before using it to avoid this kind of issue in the future.

That would be HORRIBLE news.  If that's true, I'd IMMEDIATELY stop using Shakepay, and would withdraw ALL my funds of all types (crypto and Fiat).

If they are not pooling the funds, and sending out different coins than they are receiving, then it is impossible for them to maintain any reasonable amount of cold storage! This is a HUGE security risk.  It means that ALL private keys for ALL crypto funds are accessible electronically.  It means that FAR too many employees in that company have access to EVEERYONE's private keys.  That would be a disaster just waiting to happen.

My hope is that what really happened is the following:

Previously Surmount interacted with this ForEx broker and asked them to send some bitcoins to an address at Shakepay.  The broker entered the requested address into their system as being an "account number" for Surmount.  When Surmount now, later, requested a new transaction, it was a different address than the first time, and therefore the ForEx broker refused out of concern that sending to multiple "accounts" could be a sign of money laundering.

If that is what happened, then it's still possible that the funds that the ForEx received were still from some pooled funds, and that the ForEx broker is not looking at the transaction from Shakepay and trying to discern an address that the bitcoins "came from".

In this case, the ForEx broker needs some serious education about Bitcoin.  Addresses are NOT "accounts", and in bitcoin there is no such thing as a "sending address" or an address that the bitcoins in a transaction "came from".  A single "account" at custodial service can have an uncountable number of addresses. I would not trust this ForEx broker with Bitcoins until they can demonstrate that they understand some basic facts about how Bitcoin transactions work.

Those demands your Forex broker has are even more annoying and as you experienced yourself, they created a lot of headache. Imagine if you weren't able to withdraw funds to the original address and that you never gained control of its balance, but your broker insisted on using only that one no matter what you say? Luckily, you sorted it out.

LoyceV is right. A 1 input and 1-2 outputs segwit transaction is well it considering the problems that centralized exchanges can create.

Unlike exchanges, using your own wallet means you get to choose the fee you use. For the past month, minimum fees have been very low and $0.05 in fees can be enough.

Thanks. That is solid advice.

Though having to pay double the transaction fees will be slightly annoying at least until they add functionality for other types of crypto.

For future reference, the way around this is to insert your own wallet in between the bitcoin exchange (Shakepay in this case) and your Forex broker.

If you set up your own wallet in which you own the private keys, such as by using a piece of software like Bitcoin Core or Electrum, or by buying a hardware wallet such as a Trezor or Ledger for added security, then you can guarantee that you will always have access to the same addresses and they will never expire or be unlinked from your account or anything else that an exchange might do. You can withdraw from the exchange to your own wallet, and then from your own wallet deposit to the Forex broker (or whomever else you are sending bitcoin to). If they insist on only sending bitcoin back to the same address it came from, then that does not pose any issue at all, since you are the sole owner of that address and you can use it as many times as you like (although reusing the same address endlessly is bad for your privacy).

When I talked to the forex broker about this they insisted money be withdrawn to the wallet used to make the initial deposit. I can't have been the only one who experienced this so they must have some sort of policy in place for extreme cases. Either that or they continue to refuse to make the withdrawal forever which benefits them since the money in the broker is effectively theirs.

Coinbase support says that all previously used wallets remain tied to the account and are never removed. I wouldn't be surprised if Shakepay works the same way however their support is pretty bad and I've still yet to receive a reply from them.

In any case, I feel lucky that I got my money out and will stick to wire transfers for now while I wait for banking institutions to adapt to new tech.

Then someone must explain to them that bitcoin is not the same as cash and bitcoin wallets aren't bank accounts! Most if not all wallet apps and exchanges create new addresses for each transaction and a wallet can have an unlimited number of addresses. They shouldn't care which address you use to deposit/withdraw as long as they know it's you who issued the transaction and you are withdrawing to your own wallet. What would happen if you lose access to your wallet!

You were lucky that your old address was still active and tied to your account. Some other exchanges/services work differently, if you make a deposit to an old wallet, the sent money will be lost.

It certainly seems that way from what OP is saying, but that is not how they work. They work like every other centralized exchange, and batch customers' funds together for storage and withdrawals. See their post here - https://blog.shakepay.com/bitcoin-transaction-batching/. And you can also see plenty of posts on their subreddit confirming that withdrawals are indeed batched.

It sounds like Shakepay generates a new address for each deposit, and the Forex broker is sending coins to an old deposit address which is still valid for OP's account, even if he can't see it on his Shakepay account. I'm not sure about the whole "must send to the same address which deposited" thing though, which does not make sense given we know that Shakepay batch their withdrawals.

So I guess that exchange is an exception from the usual, looks like they assign addresses and manage funds like a non-custodial wallet, except they are in control of the keys.

No, I was talking about most Exchange's usual withdrawal procedure, as explained by Danny.
They consolidate all the users deposits to a hot wallet and use some of it for withdrawal, so the address used for withdrawal is in their control, not the user.

You mean an address previously used for my account may eventually be used for someone else?

After digging I found that on June 25 I had made a successful withdrawal from the forex broker to a BTC address. On Shakepay I see I received BTC on June 25th and cashed it out. The amount I withdrew and cashed out is nearly identical. Blockstream also shows that it was sent to the address that the forex broker wants me to use.

Coinbase say they change the address but the old ones remain tied to the account.  Must be the same for Shakepay.

For now I've withdrawn a small amount from the forex broker to the specified address. Will wait and see if it ends up in my Shakepay account.

UPDATE: I just received the small amount from the forex broker. I guess the old address is still valid and tied to my account. Quite a nerve wracking experience though, I had a lot of money in that forex account and brokers are notoriously strict about AML policy partly because they don't want people to withdraw.

You must be talking about your Shakepay deposit bitcoin address.
They do change deposit address but if it work just like any exchange, the address used for withdrawal isn't tied with your account.
It could be one of their "hot wallet" address that's specifically used for users' withdrawals (can't be 100% sure without the address).

If it's AML policy, try to explain to them that you've bought bitcoins through Shakepay (a custodial service) and sent the bitcoins to them.
Sending them your transaction history and the specific transaction's details might help. (Link: help.shakepay.com - Where can I see my full transaction history on Shakepay?)
You can also send this thread's link as a reference.

There should be a qualified technical support that can understand that Exchange withdrawals doesn't work like a non-custodial bitcoin wallet.