A Bitcoin address is a short string that tells the network where to send bitcoin and under what conditions it can later be spent. It is derived from one or more public keys, or from a script that sets out spending rules. It is not an account, it carries no owner's name, and a payment to the wrong address cannot be reversed. For finance teams, addresses are where everyday operational risk is concentrated.
What a Bitcoin address is, and is not
An address is a destination. When a company receives bitcoin, the sender creates an output locked to that address. When the company later spends it, it must provide signatures that meet the conditions the address encodes.
Three points matter for treasury teams:
- An address is not an account. A company may use hundreds of addresses, all belonging to one wallet. Balances are the sum of what is held across them.
- An address is not an identity. The network has no idea who owns it. Ownership is established off-chain, through contracts, custody records and provider confirmations.
- An address has a checksum. Most typos produce an invalid address that wallets reject. A checksum does not protect against pasting the wrong but valid address.
For the underlying mathematics, see public and private keys explained.
The main Bitcoin address types
Bitcoin has added new address formats over time. Older formats still work, so a company will meet several. You can usually tell them apart by the first characters.
| Format | Starts with | Introduced | Notes for treasury |
|---|---|---|---|
| Legacy (P2PKH) | 1 | 2009 | Widely supported, highest fees per payment |
| Script hash (P2SH) | 3 | 2012 | Often used for older multisig and wrapped SegWit |
| Native SegWit (bech32) | bc1q | 2017 | Lower fees, lower-case only, good error detection |
| Taproot (bech32m) | bc1p | 2021 | Efficient for complex spending rules, better privacy for multisig |
The format affects:
- Fees. Newer formats use block space more efficiently, so spending from them costs less. We explain this in how Bitcoin network fees work.
- Compatibility. Most providers now pay to all four, but some older systems may not support Taproot. Confirm before sharing one.
- Privacy. Taproot makes a multisig spend look like an ordinary single-signature spend on the ledger, which reveals less about a company's custody set-up.
Address reuse and privacy
The ledger is public. If a company publishes a single address and uses it repeatedly, anyone can see every payment in and out of it, and estimate the company's holdings.
Good practice is to:
- Generate a new receiving address for each incoming transfer.
- Keep the extended public key, which reveals all addresses in a wallet, confidential.
- Avoid publishing treasury addresses unless there is a deliberate disclosure decision, for example as part of a proof of reserves exercise.
Reuse is not a security flaw in itself, but it weakens privacy and can expose public keys for longer than necessary.
Fresh addresses do not mean more administration. Wallet software generates them automatically from the same set of keys, and they all roll up to one balance. The work for the finance team is in the register: knowing which wallet and entity each address belongs to, so that receipts can be matched to the right ledger account.
Common address risks
Most losses linked to addresses come from people and processes rather than from the network:
- Clipboard malware. Malicious software replaces a copied address with an attacker's address at the moment of pasting.
- Address poisoning. An attacker sends a tiny amount from an address that looks similar to one the company uses, hoping a staff member copies it from transaction history later.
- Impersonation. An email, apparently from a counterparty, announces "new wallet details".
- Wrong network. Some providers support several blockchains. Sending to an address on the wrong network can mean a long and uncertain recovery.
Controls finance teams should require
Addresses deserve the same discipline as bank details in a supplier master file.
- Whitelisting. Withdrawals can go only to pre-approved addresses. Adding an address requires a separate approver and, ideally, a time delay.
- Out-of-band verification. New or changed addresses are confirmed by phone with a known contact, never only by the channel that sent them.
- Full-string checks. Staff compare every character, or use a verified address book, rather than checking only the start and end.
- Device verification. Where hardware signing is used, the address is confirmed on the device screen, not just on a computer.
- Test transfers. A small first payment to any new address, with receipt confirmed before the main transfer.
- Ownership records. Each whitelisted address is linked to a named legal entity and a purpose, which also supports sanctions screening.
Treat a change of Bitcoin address exactly like a change of supplier bank details: never accept it by email alone, and always call back on a number you already hold.
Addresses and audit
Auditors will want to tie the balances on the public ledger to the company's records. A clean address structure makes this simpler: a known set of wallets, a documented derivation scheme and a register of addresses by entity. Evidence that the company controls an address, for example a signed message, is part of Bitcoin audit readiness.
How The Bitcoin World helps
We help companies design address standards, whitelisting rules and verification steps as part of a wider custody architecture, and document them in the treasury policy. Custody and transaction signing are carried out by licensed third-party institutions or under the company's own controls. Our terms are also summarised in the glossary.