Download the PHP package dan-da/hd-wallet-addrs without Composer

hd-wallet-addrs

A command-line tool for finding bitcoin hd-wallet addresses that have received funds.

This tool does two primary things:

1. derive hd-wallet addresses (both change and receive) according to bip32 rules.
2. examines the blockchain to find the addresses that have actually been used. (received funds at least once)

A web frontend for this tool is available at: https://mybitprices.info/hd-wallet-addrs.html

Both regular HD wallets (single address) and multi-sig wallets (eg Copay) are supported.

Segwit addresses are generated if a ypub or zpub key is provided. (ypub: segwit-p2sh, zpub: bech32)

Reports are available in json, plaintext, and html. Columns can be changed or re-ordered via command-line.

hd-wallet-addrs is general purpose for anyone needing to discover which addresses are actually used in their wallet, including change addresses.

The motivation for building this tool was to simplify extracting used wallet addresses for accounting purposes. In particular for use with:

• bitprices - a command line utility for wallet pricing history and cost-based accounting.
• mybitprices.info - an easy-to-use web frontend to bitprices.

See also: hd-wallet-derive -- a tool that derives bip32 addresses and private keys.

Let's see some examples.

We can change up the fields and specify to use bip44 derivation to generate an absolute path.

Tip: The abspath column is empty when --derivation=relative, which is the default.

Or get a list for easy copy/paste.

Or JSON

Or CSV

multi-sig examples.

So far multi-sig has been tested with copay (bip44 and bip45) only. Older versions of Copay using bip45 require the --derivation=copaylegacy flag.

multisig requires multiple xpub keys and use of the --numsig flag to indicate the required number of signers. (m of n)

discovering an empty Copay 1.6.3+ (bip44) 2 of 3 wallet.

This test wallet has no funds, so we use --include-unused to obtain the initial addresses up to the gap limit. The gap limit default is 20, but we use 2 here for brevity.

discovering an empty Copay 1.1.x (bip45) 1 of 1 wallet.

Legacy versions of Copay used bip45 in a special way that the tool cannot detect without help.

Note the use of --derivation=copaylegacy

(Copay 1.6.3+ 1 of 1 wallets use bip44 derivation and do not require any special arguments.)

Warning for users of Copay 1.6.2 and below

Older Copay versions made it possible to generate gaps larger than 20. This is because it would generate a new address each time the receive screen was viewed and did not respect the standard gap-limit of 20.

Checking only 20 addresses could possibly leave you without discovering funds. If you suspect this may be happening, a workaround is to specify a larger gap limit such as 100 via the gap-limit argument.

discovering an empty Copay 1.1.x (bip45) 2 of 2 wallet.

Again we must use --derivation=copaylegacy

How discovery works

In plain english, discovery works by mathematically deriving the addresses for your wallet in order and checking if each one has been used or not.

A slightly more technical description of the process:

• starting from the extended public key (xpub)
• for receive addresses, then change addresses
  • derive batches of xpub child addresses (bip32: 0/*)
  • for each batch
  • check if each address has received funds (API call to oracle/server)
  • until 20 (default) unused addresses in a row are found.

Privacy implications

An important thing to recognize is that unless you are running a toshi or insight server locally, the discovery process will send your public addresses to a third party. ie: BlockChain.info, BitPay (insight), or CoinBase (toshi)

The third party will have no way to spend your funds.

The third party could track your requests and guess/assume that your addresses are associated with your IP, or are associated with eachother.

If that is something you care about, then you should investigate how to run toshi or insight locally and use the --toshi or --insight flags to specify the local server URL.

There is now a feature that helps to improve privacy when using third-party API servers. The --api=roundrobin flag will cycle through the available blockchain providers and send individual addresses to each. In this way, no single provider will have access to all the queried wallet addresses.

Querying for individual addresses is slow. The --batch-size flag may be used to increase the number of addresses sent to each provider.

Use at your own risk.

The author makes no claims or guarantees of correctness.

Output formats

The report may be printed in the following formats:

• plain - an ascii formatted table, as above. intended for humans.
• csv - CSV format. For spreadsheet programs.
• json - raw json format. for programs to read easily.
• jsonpretty - pretty json format. for programs or humans.
• addrlist - single column address list. for easy cut/paste.

Additionally, the report may contain incoming transactions only, outgoing transactions only, or both types.

Usage

Installation and Running.

PHP's gmp extension is required. Here's how to install on ubuntu.

Basics

Try an example

Or to hide log messages

Run Test cases

It is really slow to generate keys in PHP. For a huge speedup, you can install the secp256k1 extension from:

https://github.com/Bit-Wasp/secp256k1-php

Blockchain API provider notes.

tip! use the --api flag to switch between blockchain API providers.

Each API has strengths and weaknesses. Some are faster than others, or easier/harder to run locally. The blockchain.info service is recommended because it presently has the fastest API, and it is the default.

For best privacy, one should query an oracle that is running locally. Esplora, Insight, toshi, and btcd can be operated this way.

blockchain.info

as of 2024-06-03: tested WORKING.

as of 2015-12-30:

• supports multi address lookup in a single call.
• max addrs per call: unknown.
• returns extra un-needed info such as last 50 tx.
• returns addresses in different order than requested.

esplora (by blockstream.info)

as of 2024-6-03: tested WORKING.

as of 2019-08-06:

• does NOT support multi address lookup in a single call. feature requested.
• open source, can be run locally.

btc.com

as of 2024-6-03: tested NOT WORKING.

as of 2019-08-06

• API is returning 403 forbidden error except when requested via web browser. ymmv.

as of 2018-07-23:

• supports multi address lookup in a single call.
• max addrs per call: unknown.
• returns an index with NULL value for any addresses without received funds.

bitcoin-core

as of 2019-08-06:

• still does not support address index or API.
• There is a chance this pull request might get merged.

as of 2015-12-30:

• does not provide a suitable API for querying address total_received
• does not have a public address index. Implementing an API would be difficult.
• some 3rd party party patches or external solutions exist for creating an address index.
• not supported by hd-wallet-addrs (sadly).

blockcypher.com

as of 2024-6-03: tested NOT WORKING.

as of 2018-07-23:

• does support multi address lookup in a single call via batching.
• max addrs per batched call is 100. however:
• each address is counted as a request internally, and more than 3 triggers the rate limiting, so the request fails. Thus, 100 can only be achieved with an API key, and the limit for free usage is effectively 3.
• See https://github.com/blockcypher/explorer/issues/245

Insight

as of 2024-06-03: tested NOT WORKING.

as of 2019-08-06

• project page states insight has been replaced by bitcore-node
• insight public API is still working.

as of 2015-12-30:

• does NOT support multi address lookup in a single call.
• each candidate address must be queried separately.

blockr.io

as of 2017-09-04:

• Dead. Killed by Coinbase.com.
• Read the obituary.
• R.I.P. blockr

as of 2016-02-16:

• supports multi address lookup in a single call.
• limits number of addresses per call to 20.
• does not return un-needed tx data.

btcd

as of 2017-05-21:

• btcd can now be queried from hd-wallet-addrs to find used wallet addresses, but values for balance/sent/received are empty.
• does not support multi address lookup, so is not that fast.
• is probably the simplest way to run a local oracle.
• See this issue.

as of 2015-12-30:

• does not provide a suitable API for querying address total_received or balance.
• does have a public address index that should make such an API possible, if not performant.

Toshi

as of 2019-08-06:

• coinbase/toshi project page not found on github. Maybe try here.

as of 2017-05-21:

• toshi.io no longer exists since Dec 31, 2016.
• toshi can still be run locally by installing from github.
• See the Coinbase announcement here.

as of 2015-12-30:

• does NOT support multi address lookup in a single call.
• each candidate address must be queried separately.

Embed in your own PHP project

Here's a quick example how you one can access the API directly without invoking the CLI program.

in your project's composer.json:

yourproject.php

Thanks

A big thank-you to the author of bitwasp/bitcoin-php. This library does the heavy lifting of dealing with deterministic keys and multisig, amongst other things.

Todos

• add option to return only Receive or Change instead of both.
• test with additional wallet software.
• Add bip39 support to obtain xpub from secret words. maybe?
• Add suitable API to btcd.