What is a vanity address in crypto?

A vanity address is a crypto address that contains a pattern its owner chose, such as a name or a word at the start. It works like any other address and is controlled by a normal private key. The only difference is how it was found: software kept generating keys until one produced an address with the wanted characters.

How is a bitcoin vanity address made?

You cannot choose an address directly, because each address is calculated from a private key. A vanity generator therefore guesses. It creates a key, works out its address, checks for the pattern and repeats, millions of times if needed.

The Bitcoin Wiki gives the example of an address beginning "1Boat", which an old laptop processor found in about 10 seconds in 2014. Each added character multiplies the work. The wiki's table shows the difficulty climbing from about 4.5 million tries for a five-character pattern to astronomical numbers for long ones. Vanitygen, the first such tool, is now described as legacy, and the open-source VanitySearch is suggested instead.

The same math is why a generator cannot be used to steal an existing address. Matching a full address by brute force is not realistic. A short refresher on formats is in what is a wallet address.

Are vanity addresses safe?

The address itself is no weaker than any other, but how it was generated matters a great deal.

• Online generators. The Bitcoin Wiki warns against generating vanity keys on websites, which might keep a copy of the private key. Some people outsource long patterns to such services for that reason, taking on trust.
• Flawed tools. Profanity, a popular Ethereum vanity tool launched in 2017, used a weak method to create keys. In mid-September 2022 the decentralized exchange 1inch disclosed that keys from Profanity addresses could be recalculated with graphics chips and told users to move funds at once. The Block reported that about $3.3 million was drained from such addresses within days.
• Big losses. Days later, market maker Wintermute lost about $160 million. Security firm CertiK linked the hack to a compromised key, likely from a Profanity address. The Wintermute guide covers that case.

Anyone holding funds in an address made with a discontinued or unknown tool may want to check how it was created.

How do scammers use vanity addresses?

Scammers use the same technique in address poisoning. Trezor explains that they generate a vanity address whose first and last characters match one you use, then send a tiny transfer so it shows up in your history. If you later copy it by mistake, your funds go to them. Trezor's advice is to check every character before confirming and not to copy addresses from transaction history. Our guide to address poisoning explains the attack in detail.