Proof of Ownership Without Moving a Coin

On May 2, 2016, Craig Wright published a signature on his blog as proof that he was Satoshi Nakamoto. The accompanying text said he had signed a passage from Sartre with Satoshi's key. It soon came out that the signature had been copied straight from a transaction recorded on the blockchain in 2009. Security researcher Dan Kaminsky called him the world's first cryptographically provable con artist.

Four years later, in May 2020, a message appeared signed with 145 addresses that Wright had claimed as his own in a US lawsuit. It opened: "Craig Steven Wright is a liar and a fraud. He doesn't have the keys used to sign this message." It closed: "We are all Satoshi."

Both episodes used the same tool: signing an arbitrary sentence with the private key of a Bitcoin address. Once it served a forgery that failed to hold up, once the evidence that took it apart. From February 2027 the tool moves closer to ordinary users in Korea. Under the amended travel rule, transfers to personal wallets are allowed only when sender and recipient are the same person, and the cleanest way to show that they are is a message signature.

Proving a Secret Without Showing It

In Bitcoin, ownership means holding the private key that corresponds to an address. Spending a coin requires signing a transaction with that key, and the network only checks that the signature is valid. The key itself is never transmitted anywhere.

Message signing is that same structure with the transaction swapped out for a sentence. An exchange hands you the sentence "October 13, 2026, exchange account check," and you return a signature over it made with your address's key. The exchange verifies using only three things: the address, the sentence and the signature. If it checks out, whoever signed this sentence holds a key that can spend from that address, and not a single coin has moved.

This is also where Wright's 2016 signature fell apart. The signature was mathematically valid. It was simply a signature over the contents of a 2009 transaction, not over Sartre. Verification covers which sentence was signed, so a verifier who feeds in the original sentence themselves gets a mismatch. Wright's write-up was structured so that readers would skip that step.

signmessage in 2011

Message signing arrived in Bitcoin when Pieter Wuille's code was merged on September 30, 2011, and it shipped that November in version 0.5.0 as the signmessage and verifymessage commands. The mechanism is simple. A fixed phrase is prepended to the sentence, the result is hashed, and the hash is signed with ECDSA.

Bitcoin Signed Message:\n

The reason for the phrase is written in a comment in the Bitcoin Core source: it signals that a signed message follows and prevents inadvertently signing a transaction. From the start, the two were kept apart so that a signature over a sentence could never be read as a signature over a transaction.

The output is 65 bytes, usually exchanged as a Base64 string. It contains no public key. The first byte carries public key recovery information, so the verifier recomputes the public key from the signature and the sentence alone. If the hash of that public key matches the address, it passes.

That last comparison means the scheme only works where the address is itself a public key hash, that is, legacy P2PKH addresses starting with 1. It still does. As of October 2026, giving a bc1 address to Bitcoin Core's signmessage returns this error.

Address does not refer to key

More Address Types, Diverging Formats

After SegWit in 2017, default wallet addresses moved to wrapped SegWit starting with 3 and native SegWit starting with bc1q. Address formats had changed, but message signing still only understood addresses starting with 1.

Wallets built their own workarounds, and in 2019 BIP-137 wrote the practice down. Its motivation section describes the problem: signing with P2PKH addresses is a fairly well understood process even without a BIP, but with SegWit addresses it is unclear how to tell a P2PKH, P2SH or bech32 address apart from the signature. BIP-137's answer was to widen the range of the first byte. 27 to 34 remain P2PKH, 35 to 38 mean wrapped SegWit, and 39 to 42 mean native SegWit.

That is a label, not a change of structure. It is still a single-key ECDSA signature, so multisig addresses, script-locked addresses and Taproot addresses, which use Schnorr signatures, are out of reach. BIP-137 itself points to BIP-322 as a new format with a number of advantages, and notes that some software treats the newer header values as errors.

BIP-322 Turns a Signature Into a Transaction

The idea behind BIP-322 is to stop writing a signing rule for each address type and reuse the verifier Bitcoin already has. Every address already has a script defining how its coins can be spent. So build a transaction that pretends to spend from that address and run it through the script.

BIP-322 builds two virtual transactions. The first takes as its input an output that does not exist: previous transaction ID all zeros, output index 0xFFFFFFFF, a slot that can never be real. That input carries the hash of the message, and its output has an amount of 0 and the locking script of the address being signed for. The message hash is a BIP-340 style tagged hash with the tag string BIP0322-signed-message.

The second transaction spends that output. Its only output is a zero-value OP_RETURN. The signer fills in witness data so that the second transaction passes script validation, and that witness is the signature. The verifier rebuilds both transactions and checks them against the consensus rules, with a single exception: the first transaction's input does not exist. That exception is exactly why the transaction can never become valid even if someone broadcasts it.

The payoff is reach. In the words of BIP-322's motivation, any coins, no matter what script they are controlled by, can in principle be signed for. For a multisig address, several signers cooperate to fill in the witness, and a dedicated field was added to PSBT for that. Hardware wallets are advised to display which address is signing which message.

There are four formats: the legacy format restricted to addresses starting with 1, a simple format carrying only witness data, a full format carrying the entire second transaction, and proof of funds. On April 15, 2026, BIP-322 was marked Complete, and signatures now begin with a prefix naming the format: smp, ful or pof. The document itself calls this a breaking change, so signatures from implementations written before it may look different. Version 2.0.0 followed on June 4.

Verification has three outcomes rather than two: valid, invalid and inconclusive. A verifier that meets a script version or upgrade opcode it does not know reports inconclusive. It is a guard against declaring a future soft fork invalid in advance.

The Standard Is Done, the Wallets Are Not

The BIP is complete, but implementations are uneven. Pull requests to add BIP-322 to Bitcoin Core were opened in 2019, 2020 and 2022, and all three were closed unmerged. The author of the last attempt wrote that the effort required to keep up with wallet changes did not at all match the interest in the feature itself. Bitcoin Knots, a fork of Core, has supported BIP-322 since version 28.1 in April 2025.

Among wallets, Sparrow added BIP-322 signing for single-signature addresses including Taproot in version 1.7.8, July 2023. Trezor Suite offers message signing and verification but notes that it is not available for Taproot accounts. Ledger Live has no Bitcoin message signing, so users connect the device to an external wallet such as Sparrow to sign.

In practice: addresses starting with 1 can be signed and verified almost anywhere. bc1q addresses work in most wallets, but depending on whether the format is BIP-137 or BIP-322, verification can fail in another tool. bc1p Taproot addresses and multisig work only in the few tools that support BIP-322.

What a Signature Cannot Prove

BIP-322 writes its own limits into its motivation. No message signing protocol can actually prove control of funds, both because a signature is obsolete as soon as it is created, and because the possessor of a secret key may be willing to sign messages on others' behalf.

The first limit is time. A signature only says that someone held the key at the moment it was made. If the key changes hands the next day, the signature remains valid. This is why a message should include a date and a random string chosen by the other party. At least it rules out a signature prepared before the sentence existed.

The second limit is people. A signature shows only that whoever holds this key agreed to this sentence. Who holds the key is a question outside the signature. A custodian can sign on a customer's behalf; someone can sign as a favor. Strictly speaking, the 145 signatures of 2020 showed that the holders of those keys were not Wright. Who they are, the signatures still do not say.

The third limit is scope. A signature shows control of an address, not that the address is everything. On June 23, 2011, Mt. Gox moved 424,242.42424242 BTC in one transaction to show that it controlled its wallet. That transaction said nothing about whether the wallet covered every customer balance, and at the 2014 bankruptcy roughly 850,000 BTC turned out to be missing. BIP-322's proof of funds format draws the same line: the document states that it does not aim to prove that the coins presented are complete, nor that they are unspent. What more an exchange needs when it shows the coins in thousands of addresses this way at once, and what remains unproven even then, is taken up in proof of reserves.

How Exchanges Check

Europe answered the question with a list. The European Banking Authority's travel rule guidelines enumerate five ways a provider can verify ownership for transfers above EUR 1,000 involving a self-hosted address: showing the address on screen during unattended remote verification, attended verification, sending a predefined small amount between the address and the provider's account, asking the customer to sign a specific message with the address's key, and other suitable technical means. If one method is not reliable enough, they are combined, and verified addresses may be whitelisted.

Korea has not settled on a method yet. The amended decree sets the condition that sender and recipient be the same person; how to establish that is left to supervisory regulations and industry guidance. Current practice varies by exchange. When registering a personal wallet address, Upbit connects the wallet and asks for a signature to confirm ownership; its guide uses browser extension wallets such as MetaMask as the example. When whitelists were introduced in 2022, Coinone accepted an image or video showing the withdrawal address together with the user's details, and Korbit asked for a photo of the wallet screen alongside an ID card.

The signature method is the most precise of these and the most permanent. A screenshot is one picture sitting on an exchange server; a signature is a mathematical link anyone can recheck at any time. That was the reason Trezor added a protocol for one-click ownership proofs inside the wallet in January 2022 and soon pulled it. The objection was not a flaw in the technology but that the link it created was too strong.

Before You Sign

When an exchange asks for a signature, read the message first. Do not sign a sentence when you do not know what you are agreeing to. Message signatures are structurally separated from transaction signatures, so one signature cannot drain your coins, but a signed sentence stands on its own.

Use a separate address for signing. A signature ties that address to your identity permanently. Signing with one address used to receive from the exchange, then moving the coins onward to another, does less damage to what self-custody means than exposing your long-term storage addresses. It is the same reasoning as not reusing addresses.

With a hardware wallet, look at the device screen. Checking that the message and address shown on the device match what the computer shows is the reason to use a hardware wallet at all.

Finally, verify it yourself. Before handing over a signature, paste the address, sentence and signature into the verification feature of the same wallet or another tool and confirm it passes. While formats remain split, it is not unusual for the other side's tool to fail to read a signature your wallet made.

A Signature Does Not Say a Name

The 2020 message is a record of 145 addresses signing the same sentence. What those signatures prove is exactly one thing: someone holding these keys agreed to this sentence. That someone's name appears nowhere in the signatures.

An exchange's personal wallet check has the same structure. The signature binds a key to a sentence, and the name is attached by whoever asked for the sentence. Being able to prove ownership without moving a coin is convenient. It is also a proof that cannot be taken back once given. Which addresses get a name attached is the last choice left to the person signing.