Every crypto wallet rests on a private key and a public key, and the private one is just a number. A Bitcoin private key is, in the words of the Bitcoin developer documentation, “simply a 256-bit number”. Written in hexadecimal it fills 64 characters, using the digits 0 to 9 and the letters a to f. There is nothing else to it: no name, no account, no registration. The public key, the address you give to people who pay you, the signature on every payment you send and even the 12 or 24 words your wallet asked you to write down are all computed from that one number, or lead back to it.
The private key is the secret that signs. The public key is the matching value that anyone can use to check those signatures, and the address is a short fingerprint of the public key. Your wallet picks the private key at random, nobody approves it, and from there the arithmetic runs one way only.
Whoever knows the number controls the coins. Its derived forms, the public key and the address, can be shown to anyone, because nobody knows how to go back. And if the number is lost with no backup, nobody (not the network, not the wallet maker, not a court) can rebuild it. That is why “lost means lost” in crypto is a statement of arithmetic, not a slogan.
The general ideas behind it (hash functions, encryption, digital signatures) are in the previous lesson, what cryptography is and how blockchains use it. Here we stay with one tool: the key pair. The same family of mathematics also protects the padlock in your browser and the SSH keys developers use, which is why searches for “private key” often land on server tutorials. Everything below is about crypto wallets.
A private key is a very large number picked at random
Bitcoin and Ethereum build their key pairs on the same elliptic curve, called secp256k1. Its parameters were published by the Standards for Efficient Cryptography Group in SEC 2, version 2.0 (2010), a document that Bitcoin wallets still follow to the digit. A valid private key is any whole number from 1 up to just below a fixed limit called the order of the curve, written n.
That limit is about 1.158 x 1077, a number with 78 digits. It sits so close to 2256 that the difference does not matter for anything a reader will ever do, so people simply say a private key is a 256-bit number. Picking one means flipping the equivalent of 256 fair coins and writing down the result.
| Parameter of secp256k1 | Value | What it means |
|---|---|---|
| Equation | y2 = x3 + 7 | the curve on which public keys live |
| Field size p | 2256 – 232 – 977 | coordinates are whole numbers below p |
| Order n | about 1.158 x 1077 (78 digits) | private keys run from 1 to n – 1 |
| Cofactor h | 1 | every point on the curve can be reached from the starting point G |
| Security strength | 128 bits | the best known attack needs about 2128 operations |
Source: SEC 2 version 2.0, section 2.4.1 and table 1 (Certicom Research, 27 January 2010). The field size is the same number SEC 2 writes as 2256 – 232 – 29 – 28 – 27 – 26 – 24 – 1.
Who chooses the number? Your wallet does, on your device, using its random number generator. No server hands it out and no list of taken keys exists. Two people could in theory pick the same one; the figures further down show why that does not happen. The only thing that makes a key yours is that you are the one who knows it.
You will not find a sample private key in this lesson. A key printed in an article stops being secret the moment it is published, and anyone could take coins sent to it. Real keys appear in two common written forms: 64 hexadecimal characters, or the shorter Wallet Import Format, which adds a version byte and a checksum and is written in Base58, according to the Bitcoin developer guide. On Ethereum, ethereum.org describes the private key as 64 hex characters as well. Most people never see either form, because modern wallets show a seed phrase instead.
Private key vs public key: what each one does
The public key is computed from the private key by a fixed operation on the curve. Start from an agreed point G, the same for every user in the world, and “add” it to itself as many times as the private key says. The result is another point on the curve, a pair of coordinates (x, y), and that point is the public key. Computers do not literally repeat the addition 1077 times: they double and add, which takes a few hundred steps for a 256-bit number. That is why your phone does it instantly.
Written out, a public key is 65 bytes in the old uncompressed form (a prefix plus both coordinates) or 33 bytes in the compressed form that almost every wallet uses today: the x coordinate plus a prefix, 02 or 03, saying which of the two possible y values goes with it. The Bitcoin wiki walks through the compressed form byte by byte.
A common picture compares the public key to an open padlock that anyone can snap shut and the private key to the only key that opens it. That picture describes encryption, and it is half right for crypto. Bitcoin does not encrypt your payments: every transaction is public. The key pair is used to sign, and the public key is better thought of as a signature checker that the whole network can use, attached to the coins it guards.
| Private key | Public key | Address | |
|---|---|---|---|
| What it is | a random number below n | a point on the curve, computed from the private key | a hash of the public key, with a checksum |
| Typical size | 32 bytes (64 hex characters) | 33 bytes compressed, 65 uncompressed | 20 bytes of hash on Bitcoin (legacy) and Ethereum |
| Who knows it | only you (and your backup) | anyone, once you spend from the address (on most address types) | anyone you pay or who pays you |
| Used for | signing transactions | checking signatures | receiving coins |
| Safe to share | never | yes | yes, with a privacy cost |
The one-way street from private key to address
The chain runs private key, then public key, then address. Each arrow can be computed in a split second. Neither can be run backwards by any known method, and the two arrows are one-way for different reasons.
The first arrow, private key to public key, is the multiplication on the curve described above. Going back means finding how many times G was added to reach a given point, a task mathematicians call the elliptic curve discrete logarithm problem. Nobody has found a shortcut for curves like secp256k1. The best general attacks need roughly the square root of the number of keys, about 2128 operations, which is why SEC 2 rates the curve at “128 bits” of security even though the keys are 256 bits long.
The second arrow, public key to address, is a hash. On Bitcoin, a classic address is built by running the public key through SHA-256 and then RIPEMD-160, which gives a 160-bit fingerprint, and adding a version byte and a checksum. On Ethereum, ethereum.org explains that the address is “the last 20 bytes of the Keccak-256 hash of the public key”, written with 0x in front. A hash cannot be reversed at all in the usual sense: it throws information away, so many inputs could in principle share one output, and finding any of them is as hard as guessing.
“One way” therefore means “no known efficient way back”, which is a stronger statement than it sounds but not a proof of impossibility. ethereum.org puts the practical result plainly: you can derive new public keys from a private key, “but you cannot derive a private key from public keys”.
Why add the hash step at all? It makes the address shorter than the public key, and on Bitcoin it adds a second lock. With the classic pay-to-public-key-hash format, the Bitcoin developer guide explains that the network only sees the hash of your public key until the first time you spend from that address. At that moment you must show the full public key, together with a signature, so that nodes can check it. Before that, an attacker would have to break both the hash and the curve. The detailed construction of each address format, with its seven steps on Bitcoin, is in our lesson what a crypto address is.
Signing instead of sending a password
A bank checks your password against a copy it keeps. A blockchain has no copy of anything secret. Instead, when you send coins, your wallet builds the transaction (which coins, to which address, how much, what fee) and computes a signature from two inputs: that exact data and your private key. The signature is a pair of numbers that only someone holding the key could have produced for that data.
Every node that receives the transaction then runs a check using three things it already has or receives: the transaction data, the signature and the public key. If the check passes, the owner of the key approved this transaction. The private key itself never travels. On a hardware wallet it never even leaves the device: the computer sends the unsigned transaction in, and only the signature comes out.
Two properties make this safer than a password. A signature is bound to the data it signs, so changing one digit of the amount or one character of the destination makes it fail. And a signature for one payment is useless for another, because the next payment is different data. Someone who copies your signature from the blockchain has copied nothing they can reuse.
Satoshi Nakamoto saw a privacy side to this design. Because the keys carry no name, section 10 of the Bitcoin white paper (2008) advises that “a new key pair should be used for each transaction to keep them from being linked to a common owner”. Modern wallets do this automatically, as the seed phrase section shows. How the signed transaction then reaches a block is covered in how crypto transactions work.
What you can share and what you must never share
The rule follows from the one-way street: anything downstream of the private key can be shown, anything that leads back to it cannot. In practice you will be asked for an address all the time and for a public key almost never.
| Item | Share it? | Why |
|---|---|---|
| Receiving address | Yes | it is made to be given out; the cost is privacy, since anyone can then follow its history |
| Public key | Yes | it reveals nothing that lets someone sign; wallets rarely ask for it |
| Transaction ID (hash) | Yes | it points to a public record |
| A message you signed | Yes | it proves you control an address without moving funds |
| Extended public key (xpub) | Only with care | it shows every address of an account; combined with one leaked child private key it can expose the rest (BIP32) |
| Private key | Never | whoever has it can sign and move the coins |
| Seed phrase | Never | it rebuilds every private key of the wallet |
| Photo or cloud copy of either | Never | a copy is the key; anyone who reads it holds the coins |
The extended public key deserves a second look. It is the master public key of a wallet account, which lets watch-only apps and accounting tools see all your addresses. BIP32, the standard that defines it, warns that knowing an extended public key plus any non-hardened private key derived from it is equivalent to knowing the parent private key. Treat it as private information, even though it cannot sign on its own. Addresses and plain public keys carry a smaller cost: every payment to them stays readable, and payments can be linked to each other and, through exchanges, to your identity.
On the other side of the table, the rule has no exceptions. No exchange, wallet maker, support agent, airdrop site or “validation” form ever needs your private key or seed phrase. A request for either is a scam by definition, whatever the logo on the message. Our guide on how to avoid crypto scams lists the forms these requests take.
The seed phrase: one backup for a whole tree of keys
If a private key is a single number, why do wallets give you 12 or 24 words? Because the words back up something one level higher: a random number from which the wallet derives every key it will ever use. Two Bitcoin standards, now used by most wallets on Bitcoin and many other chains, define how.
From random bits to words (BIP39)
BIP39 starts from 128 to 256 random bits, called entropy, in steps of 32. It adds a short checksum taken from the SHA-256 hash of that entropy, one checksum bit for every 32 bits. The total is cut into groups of 11 bits, and each group picks one word from a fixed list of 2,048 words (211 = 2,048). So 128 bits plus a 4-bit checksum give 132 bits, or 12 words; 256 bits plus 8 give 264 bits, or 24 words. The last word partly carries the checksum, which is how a wallet notices a typo when you restore.
The words are then stretched into a 512-bit seed with a function called PBKDF2, run 2,048 times with HMAC-SHA512 and the word “mnemonic” (plus an optional passphrase) as salt. That slow step makes guessing a passphrase more expensive.
From one seed to many keys (BIP32)
BIP32 turns the seed into a master key: one more HMAC-SHA512, keyed with the text “Bitcoin seed”, splits into a 32-byte master private key and a 32-byte “chain code”. From that pair the wallet derives child keys, then children of children, as a tree. Each branch can produce billions of keys and addresses, which is how your wallet hands you a new address for every payment without asking you to back anything up again. “Hardened” branches cut the link that the xpub warning above describes.
The Bitcoin developer guide sums up the gain: a root seed “of as little as 128 bits is the only data the user needs to backup” to derive every key a given wallet program creates with its settings. One phrase covers every address you have used and every address you will use.
Three details follow from the standards. A 12-word phrase holds 128 bits of entropy, so there are 2128 possible phrases, the same security level SEC 2 gives the curve itself: 12 words are not weaker in practice than 24. The optional passphrase, sometimes called the 25th word, changes the whole tree; BIP39 states that every passphrase produces a valid seed, so a mistyped passphrase opens a different, empty wallet without any error. And a phrase only covers keys derived from it: a private key imported on its own, or a very old wallet file, is not inside the tree.
How to write the phrase down, where to keep it and which scams target it are covered in our guide to seed phrase security. For this lesson, one point is enough: the phrase is the private keys, in a form humans can copy. Anyone who reads it can rebuild every one of them.
How big is 2256? Why brute force is out of reach
“Lost means lost” rests on one claim: nobody can find a properly random private key by trying numbers until one fits. The sizes involved are hard to feel, so here they are against the biggest computing effort that exists, the Bitcoin mining network.
On 23 October 2026, mempool.space estimated the network at about 1.05 x 1021 hashes per second, roughly a thousand billion billion guesses of a hash every second. Suppose, very generously, that the same machines could test a private key as fast as they compute a hash. In reality testing a key costs a curve multiplication, which is far heavier, and mining chips are built for SHA-256 only and cannot do it at all.
| Quantity | Value | Source or method |
|---|---|---|
| Possible private keys (order n) | about 1.158 x 1077 | SEC 2 v2.0 (2010) |
| Work of the best known attack on the curve | about 2128, or 3.4 x 1038 operations | SEC 2, strength 128 |
| Possible 12-word seed phrases | 2128 | BIP39, 128-bit entropy |
| Bitcoin network hash rate, 23 Oct 2026 | about 1.05 x 1021 per second | mempool.space |
| Time to try every key at that rate | about 3.5 x 1048 years | our calculation, one key per hash |
| Average time to hit one chosen key | about 1.7 x 1048 years | half of the line above |
| Age of the universe | about 13.8 billion years | NASA |
| Ratio of the two | about 2.5 x 1038 | our calculation |
With the universe at about 13.8 billion years old, according to NASA, a full search would last roughly 2.5 x 1038 times its age, and that is with the imaginary machines described above.
An honest version of the argument must also use the smaller number. Thanks to the square-root attacks mentioned earlier, the real work to break one public key is about 2128 operations, not 2256. At one operation per hash, the whole mining network would need about 10 billion years for that, close to the age of the universe, for one single key, and with hardware that cannot run the calculation. That 128-bit margin is the level SEC 2 assigns, and no existing computer comes near it.
The same arithmetic covers the fear of collisions, two people landing on the same key. With about 1077 possible keys, even billions of wallets created every day for millions of years would fill a share of the space too small to write without dozens of zeros. We found no documented case of a properly generated random key being found by search. That is the absence of evidence in our research, not a proof, but it matches the numbers.
When keys are not random, they can be found
Every key in the previous section was assumed to be truly random. That assumption is where real thefts happen. A key made from a weak source of randomness belongs to a much smaller space, and a small space can be searched.
In August 2013, bitcoin.org warned that a component of Android responsible for generating secure random numbers “contains critical weaknesses”, so that any wallet generated by an Android app could be exposed to theft. The fix was to update the app, create new addresses with the repaired generator, move the funds there and give the new addresses to anyone who paid the old ones. The alert was dated 11 August 2013 and updated on 13 August.
Ten years later, the researchers behind Milk Sad showed that the bx seed command of Libbitcoin Explorer 3.x drew its key material from Mersenne Twister, a generator meant for simulations, not secrets. The flaw is recorded as CVE-2023-39910, and the researchers date the theft from affected wallets to 12 July 2023.
This month gave a fresh case. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October 2026, 1,404 wallets on the Qubic network were emptied because its open-source web wallet had generated seeds with JavaScript’s Math.random(), a function never designed for cryptography, as we reported in our story on the Qubic seed drain. The project switched to a cryptographic generator on 18 October.
Keys can also leak after being made correctly. On 21 October 2026 the Polkadot Community Foundation said that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the Fearless Wallet browser extension sent the private key to an attacker’s server when the wallet was unlocked; eight users had reported unauthorised transfers of 17,286 DOT at the time, as we reported on the Fearless Wallet leak. The advice was to create a new key and move the funds, because reinstalling the app does nothing for a key that has already left.
In none of these cases was the curve broken. The arithmetic held each time, and what failed was software: how the number was chosen, or where it was sent. That is the practical reason to create keys only in widely used, audited wallets or hardware devices, and never with a homemade script, a “key generator” website or a dice roll you do not fully understand. Attacks on blockchains themselves, rather than on users’ keys, are the subject of a later lesson.
Lost keys in real life: a locked drive, a landfill and an exchange
The other way to lose coins is to lose the key yourself, or to let one person be the only copy.
Stefan Thomas, a programmer, holds the keys to 7,002 bitcoin he was paid more than a decade ago for a video explaining Bitcoin, according to the New York Times. The keys sit on an IronKey, an encrypted drive that allows 10 password attempts before it encrypts its contents for good. In January 2021, TechSpot, citing the Times, reported that he had used eight attempts and lost the paper with the password. Strictly, his problem is a forgotten password protecting a key, not a lost key: if the drive opens, the coins are there.
James Howells, in Newport, Wales, says a hard drive holding the keys to more than 7,500 bitcoin was thrown away by mistake in 2013 and ended up in the city landfill. In January 2025 Judge Andrew Keyser KC dismissed his claim against Newport City Council, which sought £495 million in compensation and access to the site, finding “no reasonable grounds” for it, The Block reported, citing the BBC. Here the only copy of the key was a physical object, and it was gone.
QuadrigaCX, a Canadian exchange, shut down in February 2019 after the death of its founder, Gerald Cotten, who was described as the only person controlling its cold wallets. In December 2022 the trustee, Ernst & Young, said the private keys to those wallets “have not been located despite the detailed review”, Decrypt reported, just as about 104 bitcoin moved out of five wallets linked to the exchange. EY said it “did not initiate the transfers”. According to Decrypt, official inquiries later found that most customer money had never reached cold storage. The point about keys still stands: one person, no backup.
In all three cases the coins did not vanish. They are still recorded on the blockchain, visible to anyone, and nobody can move them without the key. How many bitcoin are lost this way is not known. Estimates count coins that have not moved for years, which is not the same as proof of loss, and they differ widely depending on the definition used.
Can a lost private key be recovered?
Only from a copy. If you still have the seed phrase, a backup of the wallet file with its password, a second device holding the same wallet or a written copy of the key, you can rebuild everything in a few minutes in any compatible wallet. Without any copy, no. The key cannot be guessed, as the figures above show, and no company, miner or developer holds a spare.
A forgotten password is a different, smaller problem. If the key sits inside an encrypted file or device, the search space is the password, not the key. Short or predictable passwords can sometimes be found by trying candidates, which is why Stefan Thomas was offered help. Devices that count attempts, like his IronKey, limit that route.
Be careful with anyone who offers to “recover” a lost wallet for a fee. A real recovery service can only work on a password problem, and only with your files. Anyone who says they can find a private key from an address or a public key is describing something no known method can do, and such offers are a common scam. Quantum computers do not change that today.
Quantum computers and your keys, as of October 2026
A large enough quantum computer running Shor’s algorithm could, in principle, solve the elliptic curve discrete logarithm problem and derive a private key from a public key. That is the one serious long-term question for the one-way street. The keys most exposed would be those whose public key is already visible on the chain, for example on addresses that have already spent.
No such machine exists. Google Quantum AI published a paper on the quantum risk to elliptic curve cryptocurrencies on 30 March 2026 and reported a further hardware result on 15 October 2026, which our report on Google’s Willow result reads as leaving no bitcoin at risk today. Bitcoin developers are discussing proposals for quantum-resistant outputs, such as BIP 360. For a reader today, the practical advice does not change: the risk to your keys comes from weak software and from people who ask for them.
Lost keys, custody and tax for readers in the US and the UK
In the United Kingdom, HMRC has written down how it treats a lost key. Its Cryptoassets Manual, page CRYPTO22400 says that “misplacing the key does not count as a disposal for Capital Gains Tax purposes”, because the tokens still exist on the ledger. If it can be shown that there is no prospect of recovering the key or reaching the tokens, the owner can make a negligible value claim; if HMRC accepts it, the owner is treated as having disposed of the tokens and acquired them again, which lets the loss be recorded. The page was last updated on 28 November 2025.
In the United States, the IRS has not published guidance on lost private keys that we could find as of 23 October 2026. Its frequently asked questions on virtual currency (last reviewed on 30 June 2026) mention private keys only as part of how a wallet identifies assets. An asset you can no longer reach has not been sold in a taxable transaction, but whether the loss can be deducted is not settled by that page. Ask a tax professional before claiming anything; this is general information, not tax advice.
European supervisors put the consumer side bluntly. In a 2025 warning on crypto-assets, published in Italy by Consob, the European Supervisory Authorities state that losing the private keys of crypto-assets means a permanent and irreversible loss of access to them and of their ownership.
Custody changes who carries that risk. When an exchange holds your coins, it holds the keys, and your protection is the exchange’s own security and the rules it operates under, from US state licences to the EU’s MiCA regime. QuadrigaCX shows what that dependence can mean. When you hold the keys yourself, in self-custody, no one can freeze or lose them for you, and no one can give them back either.
Five things to remember before your next wallet
- A private key is a random number; whoever knows it owns the coins it controls.
- The public key and the address are computed from it, and nobody knows how to go back, so you can share both, at a cost to privacy.
- A seed phrase rebuilds all your private keys at once, so it gets the same protection as the keys themselves.
- Brute force cannot find a key that was made properly at random; weak generators, leaks and missing backups are how keys are actually lost.
- Nobody legitimate ever asks for your private key or seed phrase, and nobody can recover a key that has no copy.
The next lesson of this cryptography path compares symmetric and asymmetric encryption; later ones go deeper into elliptic curves, signature schemes, wallet derivation paths and the quantum question. For now, the test is simple: you should be able to look at anything your wallet shows and say whether it sits before or after the one-way street.
