Bitcoin Address

Detects Bitcoin payment address candidates in both Bech32 (bc1…) and legacy Base58 (1…/3…) shapes. Checksums are not validated (Purview custom SITs lack Bech32/Base58Check functions), so matches are structural candidates and require Bitcoin/transfer context at enforce tiers.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

Medium confidence: pattern has structural constraints but corroborative keywords are recommended to reduce false positive rates. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

global

Regulations

AML/CTF Act (Cth), PCI-DSS

Frameworks

ISO 27001, ISO 27701, PCI-DSS, SOC 2

Data categories

financial

Scope

narrow

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

(?:\bbc1[a-z0-9]{25,39}\b|\b[13][a-km-zA-HJ-NP-Z1-9]{24,33}\b)

Corroborative evidence keywords

identifier, number, ID, transaction, transfer, payment, deposit, withdrawal, debit, credit, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+14 more)

Proximity: 300 characters

Should match

• bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Exact 65 discovery probe with a bare Bech32-shaped candidate
• bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq — Standard Bech32 address
• bc1q0000000000000000000000000000000000 — Bech32-shaped synthetic candidate (shape only — checksum is not validated, so this discovers but proves nothing)
• Bitcoin payment address bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Exact 75 probe with explicit Bitcoin address context
• Bitcoin withdrawal address bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Exact 85 probe with chain-specific and transfer-destination context

Should not match

• bc2qw508d6qejxtdg4y5r3zarvary0c5xw7k — Wrong prefix (bc2 instead of bc1)
• bc1qw508d6qejxtdg4y5r3zarv — Too short (only 22 characters after bc1)
• tb1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Testnet prefix (tb1 instead of bc1)
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present
• Bitcoin address bc1qW508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Mixed case is invalid Bech32 — the lowercase-only shape regex rejects it
• Documentation example: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Documentation/example exclusion suppresses even the discovery-only candidate
• Database key bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 — Valid-shaped non-wallet key must remain discovery-only
• 2A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa — Invalid first character (2 instead of 1 or 3) (merged from companion SIT)
• 1A1zP1eP5QGefi2DMPTf — Too short (only 20 characters) (merged from companion SIT)
• 1A1zP1eP5QGe-fi2DMPTfTL5SLmv7Divf — Hyphen breaks the run so no 24-33 char base58 body is contiguous — rejected (merged from companion SIT)
• Tutorial wallet 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy — Tutorial exclusion suppresses even the discovery-only candidate (merged from companion SIT)
• Database key 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa — Valid-shaped non-wallet key must remain discovery-only (merged from companion SIT)

Known false positives

• Financial terminology appearing in published reports, accounting textbooks, regulatory guidance, or template documents without actual transaction data. Mitigation: Require corroborative evidence keywords within the proximity window. Cross-reference with structured financial identifiers to confirm actual sensitive data.
• In English (as the primary international business language), standard business terminology overlapping with financial detection keywords in routine correspondence and documentation. Mitigation: Increase confidence threshold when scanning business correspondence. Layer with transaction-specific patterns for higher precision.

Collections

• Cryptocurrency Wallet Addresses