If only the Bitcoin public key or address was exposed, create a new receiving address in a wallet you control and send the bitcoin there. A public key is not a private key: disclosure of an ordinary public key does not, under Bitcoin’s stated cryptographic assumptions, give an attacker the authority to spend the coins. Moving the funds is still sensible because continued address reuse reveals more of your financial activity.
First identify exactly what was disclosed. A private key, seed or recovery phrase, extended private key, or other signing secret is a wallet compromise, not an ordinary privacy issue. In that case, stop using the affected wallet, create a new wallet you control, protect its backup, and move the funds as soon as safely possible. Never paste a recovery phrase or private key into a website or send it to support.
As an Amazon Associate I earn from qualifying purchases.
What an exposed Bitcoin public key does—and does not—mean
Bitcoin uses public-key cryptography. The public key and addresses derived from it are used to receive funds and identify transaction activity; the corresponding private key is what authorizes spending. The Bitcoin Developer Guide describes public keys in normal transaction flows, while BIP 32 distinguishes ordinary public keys from extended wallet keys. Nothing in those technical assumptions says that seeing an ordinary public key reveals its private key.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →That means an attacker who sees only an address or ordinary public key generally cannot sign a valid spend from it. They can, however, observe activity associated with the address, and address reuse can make a larger portion of your financial history easier to connect. Bitcoin transaction data is public and permanent, so moving the balance does not erase earlier records.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
Separate the items that people often call a “key”
| What was exposed | What it normally permits | Recommended response |
|---|---|---|
| Receiving address | Others can pay it and inspect its public transaction history. | Create a fresh address for future receipts and move the balance if you want to stop using the old one. |
| Ordinary public key | Public identification and, depending on the output type and transaction state, information that can aid tracking; not the signing authority by itself. | Use a new wallet-controlled receiving address and stop reusing the exposed one. |
| Extended public key (often called an xpub or another extended public key) | Can describe a branch of derived public keys and addresses, enabling broad transaction monitoring. It is not the same as an extended private key. | Treat it as a serious privacy disclosure. Review what was shared and avoid exposing additional wallet data. |
| Private key | Can authorize spending from the associated output. | Assume the funds are at risk. Create a new wallet and transfer funds immediately, without waiting for a routine privacy move. |
| Seed or recovery phrase | Can recreate the wallet and its private keys. | Assume the entire wallet is compromised. Use a new wallet and never enter the phrase into an untrusted site or send it to anyone. |
| Extended private key | Can control a tree of derived private keys. BIP 32 also warns that combining an extended public key with certain descendant private-key material can have serious consequences. | Treat it as an urgent compromise and migrate to a completely new wallet. |
If you cannot tell whether a file, screenshot, export, QR code, or text string contains a public or private value, do not publish it for identification. Keep it secret and consult the wallet’s official documentation or a qualified security professional without disclosing the secret itself.
Decide whether this is a privacy move or an emergency migration
Ordinary address or public-key exposure
When the disclosure was limited to an address or ordinary public key, there is no basis to say that the coins became immediately spendable by somebody else. You can plan a normal transaction: prepare a new destination wallet, verify its backup, generate a fresh receiving address, and send the funds from the old address.
Private material or recovery information exposure
If a private key, seed phrase, recovery phrase, or extended private key was exposed, do not treat the situation as merely a privacy concern. Create a new wallet whose keys you control and transfer the funds there as soon as you can verify the destination. An attacker who obtains the signing secret may move the coins first, and a Bitcoin payment cannot be reversed after it is accepted by the network. Do not wait for six confirmations before starting this emergency response; confirmations protect a completed transfer, not an already compromised key.
Watch-only and exchange-controlled situations
A watch-only wallet can display addresses and balances without holding the private keys needed to sign. Likewise, a service may hold the keys for you. In either case, you may need that service’s current withdrawal or signing process rather than a “send” button in the watch-only interface. Do not assume that seeing a balance means you control the ability to move it.
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
Prepare a new destination wallet
Choose a wallet whose keys you control
Use a self-custodial wallet that you understand. A software wallet can keep keys on an internet-connected computer or phone; a hardware wallet keeps signing operations on a separate device. Either can be self-custodial, and neither is automatically safe if its backup or recovery process is mishandled. Bitcoin.org presents hardware and offline wallets as security options, but no single brand or model is established as universally best for this task.
Make and protect the backup before receiving funds
Complete the wallet’s backup or recovery setup before sending anything. Confirm that you know how the wallet would be restored and that the recovery information is protected from theft, loss, fire, and unauthorized access. Losing recovery information can permanently lose self-custodied bitcoin; a wallet provider cannot recreate a missing seed for you. Do not photograph, email, paste, or upload the recovery phrase merely to make another copy, and never give it to support.
Check compatibility
Confirm that the destination wallet supports Bitcoin and the address format produced by the sending and receiving wallets. Wallets differ in their supported address formats, fee controls, signing flow, and recovery procedure. If a hardware wallet is involved, use the device’s own screen or trusted signing display when verifying the address rather than relying only on a computer screen.
Recommended Free Tools
Move the bitcoin step by step
- Identify the old wallet and the exposed item. Write down the old address for your own records, but do not publish additional wallet data. Decide whether this is an ordinary public-key disclosure or a private-key compromise. If any private material was exposed, follow the emergency path above.
- Create or select the new wallet. Use a wallet you control, finish its setup, and complete its backup. If you already have a trusted wallet, select a receiving account that is not the exposed address.
- Generate a fresh receiving address. Use the destination wallet’s own Receive function to create a new address. Do not type one from memory or reuse the exposed address. The new address should be copied or transferred through a method you can verify.
- Compare the destination carefully. Compare the full address shown by the sending wallet with the full address shown by the receiving wallet or trusted signing device. Check every character, not just the first and last few. Bitcoin payments are irreversible; an address error can permanently send the coins somewhere you do not control.
- Open the old wallet’s current send or sweep procedure. Wallet interfaces change, so follow the instructions for that wallet’s present version. A normal send spends the available balance according to the wallet’s coin and fee controls; a sweep procedure may be offered when importing or transferring a private key. Do not invent a menu path from another app.
- Choose the amount and fee deliberately. If the objective is to stop using the old address, send the spendable balance you intend to keep, while accounting for the network fee shown by the wallet. Fee controls and balance calculations vary. A test transaction can be useful when the amount or setup warrants it, but it is optional: it creates an additional transaction and fee and is not a universal requirement.
- Review the final transaction before signing. Confirm the destination address, amount, network, and fee on the wallet or signing device. If a hardware wallet displays the address independently, compare that display with the destination you recorded. Never approve a transaction whose address differs from the one you verified.
- Sign and broadcast from the wallet. Complete the wallet’s send or sweep flow. Keep the transaction identifier if the wallet provides one, but do not publish sensitive backups or private keys along with it.
- Wait for confirmation. Bitcoin.org’s guidance, accessed in 2026, lists six confirmations as the minimum recommendation for high-value transfers. That is a general recommendation, not a universal rule: the receiving service, your wallet, and your risk tolerance may use another threshold. A transaction shown as broadcast or pending is not the same as one with the confirmations required by your recipient.
- Verify receipt in the new wallet. Check that the destination wallet displays the expected transaction and that the confirmation count is advancing. Only after you have verified the result should you treat the migration as complete.
How to verify the transfer without creating a new mistake
Use the receiving wallet’s address, not an old record
Generate the address inside the new wallet immediately before the transfer when practical. Old address lists and screenshots can contain the exposed address or a transcription error. If you copy and paste, still compare the complete value on both sides; a copied address is not proof that the correct address was selected.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Use an independent display when available
A hardware wallet or another trusted signing device can show the address it will authorize. Compare that display with the destination wallet and the transaction review screen. This adds a verification step; it does not eliminate the need to protect the device’s recovery backup.
Understand what confirmations prove
Confirmation means the transaction has been included in the blockchain and additional blocks have built on it. Six confirmations is Bitcoin.org’s cited minimum recommendation for high-value payments, but a service may require more or accept fewer for a smaller-risk transfer. Keep the transaction ID and monitor the receiving wallet until the required threshold is reached.
Software wallet versus hardware wallet for the new address
| Decision point | Software wallet | Hardware wallet |
|---|---|---|
| Who controls the keys | You control them when the wallet is self-custodial and the backup is yours. | You control them when the device is set up as self-custodial and the recovery backup is protected. |
| Address verification | Verify the receiving address in the wallet interface and transaction review screen. | Verify the address on the device’s trusted display as well as in the companion wallet. |
| Exposure to an internet-connected device | Keys may be used on a connected phone or computer, depending on the wallet design. | Signing is designed to occur on a separate device, reducing direct exposure of the signing key. |
| Backup and recovery | Protect the wallet’s recovery information; loss can permanently lose funds. | Protect the device recovery information with the same care; losing it can also permanently lose funds. |
| Address formats and usability | Check supported Bitcoin address formats and the app’s current send and fee controls. | Check both the device and companion software for supported formats and follow the device’s signing prompts. |
| Required for this transfer? | No. A correctly configured self-custodial software wallet can receive the funds. | No. It is an optional security and usability choice, not a prerequisite. |
The deciding factor is not the label “software” or “hardware” alone. It is whether you control the private keys, can recover the wallet, and can verify the destination before signing.
Free tools Windows power users keep installed
One-click scans. No signup required.
What moving the funds changes—and what it cannot change
It changes future control and receipts
After the transaction confirms, the balance you moved is associated with outputs controlled by the new wallet. Use the new wallet’s fresh receiving addresses for future payments. Do not keep receiving bitcoin at the exposed address simply because it remains visible in an old invoice, website, or address book.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
It does not erase the old history
The earlier address, its public key when revealed by the relevant transaction flow, and its transaction history remain visible on the Bitcoin blockchain. Sending the balance elsewhere does not make those records private or disconnect every address that observers may already have linked. The purpose of the move is to stop adding new receipts to the exposed address, not to rewrite the past.
It may create a new fee and transaction record
A transfer from the old address to the new wallet is an on-chain transaction. The wallet will calculate or let you select a network fee according to its current controls. A test transfer, if you choose one, creates another on-chain transaction and another fee. There is no research-supported universal fee amount for this situation, so rely on the wallet’s current estimate and documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting and recovery paths
The new wallet shows no funds
Confirm that you generated a Bitcoin receiving address, that the sending wallet broadcast the transaction, and that you are viewing the same network and account. Use the transaction identifier, if available, to check whether the transaction is pending or confirmed. Do not send a second payment until you understand the first transaction’s status.
The transaction is pending
Pending status means the transfer has not reached the confirmation level you are using. Fee controls, network conditions, and wallet behavior vary, so follow the current documentation for that wallet rather than applying a procedure from another application. A receiving service may also wait for its own threshold even after the transaction has confirmations.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
You cannot sign from the old wallet
A watch-only wallet, an address imported without its private key, or a service-controlled account may show the balance but cannot authorize a spend in that interface. Locate the wallet or service that actually controls the private key and use its current withdrawal, export, or signing process. Never “recover” by entering a seed phrase into an untrusted website.
The destination address differs during review
Reject the transaction. Generate a new receiving address if necessary, compare it again on the receiving wallet and trusted signing device, and investigate the mismatch before trying again. Because Bitcoin payments are irreversible, guessing that two addresses are equivalent is unsafe.
You discover that a private key or seed was exposed
Stop treating the old wallet as secure. Create a new wallet and backup, verify its fresh receiving address, and transfer the funds urgently. If an attacker has already broadcast a transaction, you may not be able to recover the coins; do not send secrets to anyone promising to reverse it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Security checklist before you finish
- Only an address or ordinary public key was exposed, or you have correctly followed the emergency compromise procedure.
- The destination wallet is self-custodial and its backup is complete and protected.
- The new receiving address was generated by that wallet, not copied from an old record.
- The full destination address matches on the sending wallet, receiving wallet, and trusted signing device when available.
- The amount, network, and fee were reviewed before signing.
- You recorded the transaction identifier without exposing private material.
- You waited for the confirmation threshold appropriate to the amount and recipient; six confirmations is Bitcoin.org’s general minimum recommendation for high-value transfers.
- You stopped using the exposed address for future receipts and understand that its earlier public history remains.
Under Bitcoin’s key-security assumptions, revealing an ordinary public key is not the same as revealing spending authority. The safe practical response is to move the balance to a newly generated address in a wallet you control, verify every character before signing, protect the new backup, and reserve the emergency procedure for cases involving private keys, recovery phrases, or extended private keys.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
