A stealth address is a one-time destination address generated for a payment so that the recipient’s main wallet is not publicly exposed. The sender derives it from the receiver’s public information, while the receiver uses private keys to detect and claim the funds. This breaks obvious on-chain links between payments and wallet identity.
How Stealth Addresses Work
A stealth address creates a fresh, one-time destination for each payment while letting the recipient detect and claim funds with private keys. The practical effect is simple: the public ledger shows movement, but it does not reveal a stable receiving address that can be reused to profile the recipient.
Why Stealth Addresses Matter
The main value is transactional privacy. Reusable addresses make it easy to connect incoming payments, estimate balances, and correlate activity across counterparties. Stealth addressing reduces that linkage, which is especially important when receiving patterns themselves could expose business relationships, treasury behaviour, or individual financial activity.
This also changes the trust model for public blockchains: the network can verify validity without requiring the recipient’s long-term address to be exposed on-chain. That makes stealth addresses a privacy control, not an anonymity guarantee, because other metadata, wallet behaviour, or off-chain information can still reveal identity.
How Detection and Claiming Works
Stealth address systems typically rely on public recipient information plus private keys held by the recipient to scan the chain and recognise outputs intended for them. In practice, this means the receiver can detect payments without publishing the main wallet address on every transaction, while the sender does not need privileged access to the recipient’s private keys.
The design is strongest when the wallet software handles key derivation and monitoring correctly. If implementation is weak, the privacy benefit can be reduced by address reuse, poor key separation, or wallet metadata that ties one-time outputs back to the same user.
Where Stealth Addresses Fit in Wallet Privacy
Stealth addresses are one part of a broader wallet privacy strategy. They are usually most effective when paired with sound operational habits, because on-chain privacy can be undermined by reuse of change addresses, exchange withdrawal records, IP correlation, or public disclosures that connect the wallet to a real-world entity.
For that reason, stealth addresses should be understood as a way to reduce linkability on the ledger, not as a complete substitute for endpoint privacy, operational security, or careful key management.
Risk and Threat Considerations
Stealth addresses reduce address reuse, but they also create a dependency on correct key handling and implementation. If the recipient’s wallet, derivation logic, or scanning process is compromised, an attacker may be able to identify incoming payments, disrupt claiming, or link activity that was meant to remain private.
Failure mechanism: Privacy degrades when one-time outputs, wallet metadata, or recipient-side keys are exposed, mishandled, or reused in ways that make correlation possible.
Impact: An observer or attacker can map payments to the same beneficiary, infer balances or counterparties, and weaken the confidentiality of financial activity even when the blockchain itself remains valid.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management | Stealth addresses rely on key derivation and private-key handling for claimability and privacy. |
| Recommendation — Protect the underlying key lifecycle so one-time payment outputs remain confidential and claimable only by the recipient. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The recipient’s private keys control who can detect and claim funds from stealth outputs. |
| Recommendation — Restrict access to recipient keys and wallet material so only authorised users can claim incoming payments. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Stealth addresses depend on limiting access to wallet and key material that would expose payment linkability. |
| Recommendation — Apply access control to wallet systems and key material that enable payment receipt and linkage. | ||
Practitioner Guidance
Why practitioners should care: Stealth addresses are only effective if the wallet implementation and surrounding operational practices preserve unlinkability. Treat them as a privacy feature that depends on secure key custody, correct address generation, and disciplined wallet hygiene.
What to watch for: Reuse of addresses, exposed xpub-like public material, wallet logs that reveal derivation patterns, and third-party services that accidentally reintroduce linkability are the usual points where the privacy model weakens.
Practitioner takeaway: Use stealth addresses to reduce on-chain correlation, but validate the full wallet workflow, because the privacy benefit is often lost outside the chain itself.