Open a Bitcoin wallet app such as Xverse, and it shows five addresses: payment, Ordinals, Stacks, Starknet and Spark. All five live in one app.
Bunker does not give them one result. Three of the five hide their public key until they sign. Two show it from the first day, and a new address of the same type does not change that.
The reason is simple. Each network decides how its addresses relate to the public key. Bunker knows more than 100 networks, and it applies the rule of each one.
This article is a tour of those rules, family by family. Every example is a real scan with the Bunker command-line tool, version 1.2.1. Every explanation in quotes is the exact text that Bunker printed.
How to read this tour
Bunker calls the public key the lock. Each network gets one of two main lock rules:
| Lock rule | Meaning | What a new address does |
|---|---|---|
| Hidden | The key is hidden until the address sends or signs. | It hides the key again. |
| Visible | The key is visible from day one. | Nothing. The fix must come from the network. |
A few networks need special models, such as Zcash shielded pools and permissioned networks. Article 9 of this series covers them.
The example addresses come from published standards, developer accounts and public explorer pages. Some formats have no public example. For those, I built sample addresses with the project’s own encoders, the same way its tests do. No address in this article belongs to a private person.
One wallet, five results
Here is the Xverse case as a real scan. The payment, Ordinals and Stacks addresses are public example addresses. The Starknet and Spark addresses are samples.
| Label | Address type | Lock rule | Card before your answer |
|---|---|---|---|
| Payment | Nested SegWit or script (3...) | Hidden | Check needed |
| Ordinals | Taproot (bc1p) | Visible | Lock visible |
| Stacks | Stacks account (SP...) | Hidden | Check needed |
| Starknet | Starknet account (0x) | Hidden | Check needed |
| Spark | Spark address (spark1...) | Visible | Lock visible |
The three hidden addresses get a question: has the address ever sent or signed? Your answer decides their final result. The two visible addresses need no question, because their key is already public.
Bitcoin and its layers
Bitcoin has several address types, and they follow different rules. Most of them hide the key until they spend. Taproot and Silent Payments are the exceptions.
| Type | Example source | Rule | Explanation from Bunker |
|---|---|---|---|
Legacy (1...) | Bitcoin genesis block address | Hidden | Only a hash of the key is on chain until this address spends. |
Nested SegWit or script (3...) | Bitcoin wiki P2SH example | Hidden | Only a hash is on chain. The key appears the first time this address spends. |
Native SegWit (bc1q) | BIP-173 test vector | Hidden | Only a hash of the key is on chain until this address spends. |
SegWit script, multisig (bc1q, long) | BIP-173 test vector (P2WSH) | Hidden | The signer keys appear on chain the first time this address spends. |
Taproot (bc1p) | BIP-86 test vector | Visible | Taproot puts the public key in the address. Ordinals and Runes use this type. |
Silent Payment (sp1q) | BIP-352 test vector | Visible | A Silent Payment address publishes its scan and spend public keys, so senders can pay it in private. |
BIP-360 (bc1z) | Sample (future type) | Hash-protected | A BIP-360 output shows no curve key. You can use it only after the upgrade activates. |
The Taproot row explains the Ordinals result above. A new Taproot address shows its key too, so a new address does not help. Bunker gives this advice for a Taproot address:
From the Bunker plan, for Taproot:
Taproot has no hidden option yet. Keep inscriptions here. Move plain coins to a new SegWit address. Be ready to move to BIP-360 outputs when they activate.
BIP-360 is the real fix for this case. It is a proposed address type that shows no curve key. Today it is a draft, and it runs on test networks only.
Layers on top of Bitcoin
Bitcoin layers add their own formats. Several of them put keys inside the address or the invoice:
| Layer | Format | Rule | Explanation from Bunker |
|---|---|---|---|
| Lightning invoice | lnbc... (BOLT 11 test vector) | Visible | An invoice contains the public key of the node that receives the payment. |
| Lightning node ID | 03..., 66 hex characters | Visible | This is a public key. The Lightning network publishes node IDs to all users. |
| Liquid confidential | lq1q... (Elements reference library) | Hidden | Only a hash of the key is on chain until this address spends. The blinding key inside only hides amounts. It does not control funds. |
| Liquid confidential Taproot | lq1p... (Elements reference library) | Visible | Taproot puts the public key in the address. The blinding key inside only hides amounts. It does not control funds. |
| Stacks | SP... (Stacks burn address) | Hidden | The address is a hash of the key. The key stays hidden until the account sends. Stacks keys use the same curve as Bitcoin. |
| Spark | spark1... (sample) | Visible | A Spark address contains the identity public key of the wallet, so the lock is visible from day one. |
| Ark | ark1... (sample) | Visible | An Ark address contains public keys, including the key of the owner. |
The Liquid rows show why exact rules matter. A Liquid confidential address carries a second key, called the blinding key. That key only hides amounts. Bunker rates the address by the key that controls the funds.
For Lightning, the advice follows the rule: “Lightning keys are public by design. Keep only spending balances in channels. Keep savings on a new bc1q address.”
Ethereum and EVM networks: one key, many networks
EVM means Ethereum Virtual Machine. All EVM networks use the same address format: 0x and 40 hex characters. One private key gives the same address on every EVM network.
That fact has a direct effect on the lock. If you send once on any EVM network, the key is public on all of them. I scanned the EIP-55 test address:
"network": "EVM networks",
"networkId": "evm",
"type": "EVM account",
"model": "hidden-until-used",
"status": "check",
"explanation": "The key stays hidden until the first transaction or signed message from this address. One address covers every EVM network.",The Bunker card lists the networks that share the key:
- Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, Avalanche C-Chain, Sonic, Linea
- zkSync, Scroll, Mantle, Gnosis, Celo, Cronos, Berachain, Monad, HyperEVM
- Plasma, Plume, Rootstock, BOB, Core, VeChain, XDC, Ronin and Harmony
Three of them write the address in their own way. XDC uses the prefix xdc, Ronin uses ronin:, and Harmony uses one1. Bunker reads all three. For each one, it says: “The key and the rules are the same as any EVM account.”
Tokens follow the wallet. USDT, USDC, PAXG, XAUT, QNT, ONDO and tokenized funds such as BUIDL use the key of the wallet that holds them. So the move advice covers every network at once: “Move coins and tokens on every EVM network where this address holds them.”
Networks where the address is the key
On many newer networks, the address is the public key itself, or it contains it. For these networks, every address shows its key from day one:
| Network | Example source | Explanation from Bunker |
|---|---|---|
| Solana | Sample | A Solana address is the public key. A fresh address does not hide it. |
| Polkadot | Development account Alice | A Substrate address contains the public key. |
| Stellar | Stellar documentation example | A Stellar address is the public key. |
| Algorand | Algorand documentation example | An Algorand address is the public key. Rekeying changes the key without moving funds. |
| MultiversX | MultiversX documentation example | A MultiversX address is the public key. |
| Mina | Mina documentation example | A Mina address is the public key. |
| Kaspa (standard) | Kaspa documentation example | A standard Kaspa address is the public key, so the lock is visible from day one. |
| Nostr | NIP-19 test vector | This is a Nostr identity key on the same curve as Bitcoin. It holds no funds. Do not use it as a wallet key. |
The Polkadot row covers a whole family. Polkadot, Kusama, Astar, Acala, Bifrost, Hydration and KILT use the same SS58 format. So do Bittensor, Polymesh and Centrifuge. A number inside the address, called the SS58 prefix, names the network. Bunker reads that number, so a Kusama address gets the label “Kusama account”, not “Polkadot”.
For these networks, the plan cannot tell you to move to a new address. Here is the Solana advice:
From the Bunker plan, for Solana:
A Solana address is its key, so a new address does not hide it. For long-term SOL, the hash-based Winternitz Vault is an option for advanced users. Follow the Solana post-quantum upgrade.
Networks that can change the key
Some networks let an account change its key without moving funds. Algorand calls it rekeying. Bunker marks eight networks with this ability: Aptos, Starknet, XRP Ledger, Stellar, Hedera, Algorand, NEAR and Flow.
On some of them, the ledger itself stores the keys where anyone can read them. Two examples from real scans:
| Network | Example | Explanation from Bunker |
|---|---|---|
| Flow | 0xc84eefd049dd1b67 (account page on flowscan.io) | Flow stores account keys in public on chain. You can change the keys without moving funds. |
| Hedera | 0.0.123-vfmkw (sample) | Hedera stores account keys in public on the ledger. You can change the keys without moving funds. |
Key change gives these networks a path that needs no move of funds. When a network supports post-quantum keys, an account can switch to one in place. The plan says so for every visible account on these networks: “Change to a post-quantum key when the network supports one.”
Cosmos networks: 45 prefixes, one rule
All Cosmos SDK networks use one address format. The address is a Bech32 text with a network prefix and a hash of the key. Bunker knows 45 prefixes, from cosmos and osmo to thor and maya.
The rule is the same for all of them. I scanned five accounts from public explorer pages:
| Prefix | Network | Rule |
|---|---|---|
cosmos1 | Cosmos Hub | Hidden |
secret1 | Secret Network | Hidden |
neutron1 | Neutron | Hidden |
thor1 | THORChain | Hidden |
maya1 | Maya Protocol | Hidden |
The explanation is the same for each one: “The address is a hash of the key. The network stores the key on chain after the first transaction.”
Store of value and payment coins
Many payment coins use the same hash addresses as Bitcoin. Their newer address types can differ:
| Coin | Type | Rule |
|---|---|---|
| Litecoin | Legacy L..., script M..., Native SegWit ltc1q | Hidden |
| Litecoin | Taproot ltc1p | Visible |
| Litecoin | MWEB ltcmweb1... | Visible: scan and spend keys |
| Dogecoin | Legacy D... | Hidden |
| Bitcoin Cash | CashAddr bitcoincash:q... | Hidden |
| eCash | CashAddr ecash:q... | Hidden |
| Dash | X... | Hidden |
| Kaspa | Standard kaspa:q... | Visible: the address is the key |
| Kaspa | Script kaspa:p... | Hidden |
Kaspa shows why Bunker reads the type and not only the network. Two addresses with the same kaspa: prefix get different rules. The standard address is the key. The script address is a hash.
Monero: private, but the keys are in the address
Monero is a privacy network. Its privacy does not hide the public keys in the address. I scanned the old Monero project donation address:
"network": "Monero",
"networkId": "xmr",
"type": "Monero address",
"model": "visible",
"status": "exposed",
"explanation": "A Monero address contains its public spend key and view key. No Monero address type hides them.",Monero subaddresses get the same result. Bunker shows no explorer link for Monero, because the network is private by design. The advice is to follow the Monero post-quantum research and move when an upgrade is available.
Institutions, payments and tokenized assets
Banks, payment firms and asset issuers use some of these networks. Their rules vary as much as anywhere else:
| Network | Format | Rule |
|---|---|---|
| XRP Ledger | r... | Hidden. The account can also change its key. |
| Stellar | G..., 56 characters | Visible. The account can change its key. |
| Hedera | 0.0.12345 | Visible. The account can change its key. |
| Algorand | 58 uppercase characters | Visible. Rekeying can change the key. |
| Polymesh (regulated securities) | SS58 | Visible |
| Centrifuge (real-world assets) | SS58 | Visible |
| Tron | T... | Hidden |
| Canton Network | name::1220 and 64 hex characters | Ask your provider |
QNT is a common question here. QNT is a token on Ethereum, so retail holders keep it on Ethereum addresses. Its result is the EVM result of the wallet that holds it.
Private bank networks such as Kinexys and Partior have no public addresses at all. No scanner can examine them. They need a review of the provider.
Inputs that are not wallets
People often paste things that look like addresses but hold no key of their own. Bunker recognizes them and does not rate them. Five real scans:
| Input | Bunker says | Explanation from Bunker |
|---|---|---|
example.eth | Name, not an address | This tool does not look up names. Paste the address that the name points to. |
[email protected] | Lightning address or payment handle | This points to a payment server, not to a key. Examine the wallet behind it. |
0x4a22...4675 | Token contract: QNT (Quant) | This is the token contract, not a wallet. It has no key to protect. Paste your own address that holds this token. |
11111111111111111111111111111111 | Program: Solana System Program | This is a program, not a wallet. It has no key to protect. Paste your own address. |
tb1qw508...kxpjzsx | Test network address | Test network coins have no value. Nothing to protect here. |
The token contract row matters most. Many people copy the token contract instead of their own wallet address. Bunker keeps a short list of the most common contracts, so this frequent case gets a clear answer.
The whole test set in one scan
The project tests its rules with 57 real public addresses. Each one has a recorded source. I scanned all 57 in one run, with no answers:
| Result | Addresses |
|---|---|
| Lock visible | 22 |
| Check needed | 29 |
| Lock hidden | 0 |
| Not rated | 6 |
| Total | 57 |
No address is “Lock hidden” in this run, and that is correct. A hash-type address needs your answer before it can be hidden. The 29 addresses wait for that answer. The 6 unrated inputs are token contracts, programs and Internet Computer identifiers that hold no key of their own.
What the tour shows
- The network does not decide the result alone. The address type does. Bitcoin, Litecoin, Liquid and Kaspa each have hidden and visible types.
- One key can cover many networks. On EVM networks, one transaction shows the key everywhere.
- On networks where the address is the key, a new address does not help. The fix must come from the network.
- Networks that can change keys have a path that does not need a move of funds.
Read the sources
- The tool: bunker.nosistech.com
- Every network, format, rule and checksum: docs/03-networks.md
- The network list as data: networks.json
- The 57 test addresses with their sources: test/fixtures/addresses.json
In the next article, I open the engine. You will see the five steps that turn pasted text into a plan, and the code that runs each step.
Have a question or feedback about Bunker? Contact NosisTech.
Keep reading: Bunker by NosisTech
Previous article: The Sealed Box: When a Crypto Address Shows Its Public Key
Next article: From Pasted Text to a Plan: Inside the Five-Step Engine of Bunker
All articles: NosisTech Writing
This post is general information, not financial, legal or security advice. Bunker is an educational tool with no warranty. Examine each address on a block explorer, and send a small test amount before you move funds.