MSTR Cat

Blockchain/Level IV · Protocol depth/4.3 Custody and privacy/Lesson 6

Privacy: the chain’s leaks, CoinJoin and PayJoin

The anonymity that was promised, the heuristics that broke it, and the tools that push back

MaterialsA block explorer interface (e.g., mempool.space or blockchain.com)A list of known coinjoin transactions for referenceA notebook to record input/output counts and valuesA block explorer

Wonder

  1. Why does a single reused address permanently link two distinct transactions?
  2. How can multiple strangers combine inputs into one transaction without revealing who owns which output?
  3. What happened to the developers of the most prominent privacy tools in 2024?

Explore

    Part IPrivacy: address reuse and coinjoin

  1. Bitcoin’s ledger is public and immutable. Every input and output, from the genesis block onward, is visible to anyone running a node. Section 10 of the whitepaper concedes that multi-input transactions ‘necessarily reveal that their inputs were owned by the same owner’. Analysts call this the common-input-ownership heuristic and use it to cluster addresses into entities by observing which coins are spent together.
  2. Address reuse compounds this exposure. When a recipient uses the same address for multiple payments, every UTXO associated with that address is deterministically linked. Chain-analysis firms sell services built on these heuristics, mapping flows between addresses to identify entities. Change outputs can also be identified by size or timing patterns, allowing further clustering. The result is a graph where financial history becomes traceable across years and counterparties.
  3. Countermeasures exist in wallet practice. A fresh address per payment prevents direct linking via reuse. Coin control lets a user avoid spending coins from unrelated sources together, so separate parts of their history are not merged. These practices require wallet support for granular control over which UTXOs are used for each output, moving beyond simple ‘spend all’ logic to more complex selection algorithms.
  4. Coinjoin, proposed by Gregory Maxwell in 2013, takes this further. Multiple users combine their inputs into a single transaction with outputs of identical value. Because the outputs are indistinguishable from one another, an observer cannot determine which output belongs to which input. This breaks the link between sender and receiver without requiring a trusted third party, relying instead on the mathematical ambiguity of equal-value outputs in a shared transaction.
  5. Implementations like JoinMarket (2015), Wasabi Wallet (2018), and Samourai’s Whirlpool brought coinjoin to users. However, legal pressure intensified. In April 2024, US authorities arrested the founders of Samourai Wallet, charging them with conspiracy to commit money laundering and to run an unlicensed money-transmitting business; in 2025 they pleaded guilty to the unlicensed-transmitting charge and were sentenced to prison. In June 2024, zkSNACKs, the operator behind Wasabi’s coordinator service, shut down its operations. These events demonstrate that while coinjoin is a protocol feature, its implementation faces significant regulatory scrutiny.
  6. Find a known coinjoin on a block explorer (several explorers label them). Note the many inputs, the block of outputs with identical values, and the smaller ‘change’ outputs, which may still be linkable to their owners. The equal outputs are where the privacy lies; anything that makes one participant’s coins distinctive weakens it.

    7. Part IIBitcoin’s privacy model and its leaks

  7. Satoshi Nakamoto’s white paper, in section 10, proposed privacy through anonymity. The public key is not tied to a name; it is merely a string of characters. By using a new key pair for each transaction, users could limit linking, though §10 itself conceded that multi-input transactions reveal common ownership. This design mirrored the stock market tape: everyone sees the trade size and time, but no one knows who executed it.
  8. Chain analysis dismantled this model through heuristics. The common-input-ownership heuristic is the most powerful: if a single transaction spends multiple inputs, those inputs are assumed to belong to the same owner. Wallet software often consolidates UTXOs into new addresses, creating multi-input transactions that cluster previously separate addresses together. One consolidation can link much of a wallet together.
  9. Change detection compounds the problem. When a sender pays less than their total balance, they create a change output returning to themselves. Analysts spot it by script type or amount: the round-number output is usually the payment, so the other is flagged as change. Once an address is identified as ‘change’ for a specific user, every subsequent spend from that address links back to them. Address reuse, where a wallet reuses an address, makes these links permanent and visible.
  10. Network-level observation adds another layer. If a node broadcasts a transaction that no other peer had seen, its IP address is linked to the sender. Separately, Meiklejohn et al.’s 2013 study ‘A Fistful of Bitcoins’ showed how clustering heuristics plus a handful of known addresses could identify large services and track flows between them. Exchange KYC records provide the final link: when an exchange identifies a user, that user’s deposits and withdrawals are attributed to them.
  11. Chainalysis, founded in 2014, industrialized this analysis. Their software traces flows for governments and exchanges, mapping billions of dollars in transactions. Privacy is not just about secrecy; it is about safety against extortion, protection of commercial data like supplier prices, and the fungibility of coins. If a specific coin can be flagged as ‘dirty’ or linked to a criminal, its value drops relative to ‘clean’ coins.
  12. Wallet hygiene mitigates these leaks but does not eliminate them. Using fresh addresses for every payment and avoiding consolidation in multi-input transactions reduces graph clustering. However, the fundamental tension remains: Bitcoin’s transparency allows anyone to verify the ledger, which also allows anyone to analyze it. The white paper’s promise of anonymity holds only as long as users maintain strict discipline, a burden that many commercial wallets fail to meet.

    13. Part IIICoinJoin, PayJoin and the law

  13. Gregory Maxwell proposed CoinJoin in 2013 on bitcointalk. The mechanism combines inputs from multiple users into a single transaction with multiple outputs of equal value. This breaks the common-input-ownership heuristic, which chain analysis firms use to link addresses. If five people join, no input can be definitively linked to any specific output without external evidence.
  14. Wallets like Wasabi (zkSNACKs) and Samourai (Whirlpool) implemented coordinated CoinJoins. These required a central server to match participants with compatible transaction sizes. zkSNACKs shut down its coordinator on June 1, 2024, though community-run servers continued. The centralized architecture created a single point of failure and legal exposure for the operators.
  15. Samourai’s founders were arrested in April 2024, Rodriguez in the US and Hill in Portugal at US request. They pleaded guilty in July 2025 to conspiracy to operate an unlicensed money-transmitting business. In November 2025, they received sentences of five and four years respectively. Prosecutors treated the mixing service as a money transmitter that needed a license, a legal interpretation that chilled development of similar tools.
  16. PayJoin (BIP-78) offers an alternative that requires no coordinator. When a receiver accepts payment, their wallet adds one of their own UTXOs as an input and increases its own output by that amount. This hides the exact payment amount from observers and breaks the common-input heuristic between just two parties. It is simpler than CoinJoin but still effective for basic privacy.
  17. The asynchronous version, BIP-77 (v2), lets sender and receiver complete a payjoin without both being online at once, exchanging messages through an encrypted relay that uses Oblivious HTTP. The Payjoin Dev Kit reached version 1.0 in August 2026. This decouples the negotiation from the final broadcast, making it more robust against network interruptions and easier to integrate into existing wallet infrastructure without complex state management.
  18. Open a block explorer and examine a standard transaction versus a known CoinJoin or Payjoin output. A coordinated CoinJoin is easy to spot, with many outputs of the same size. A PayJoin is designed to look like an ordinary payment, so analysts who assume one owner for all inputs are quietly wrong; that is its strength.

Key facts

  • The common-input-ownership heuristic assumes that inputs spent together belong to one owner.
  • Address reuse creates deterministic links between multiple UTXOs, enabling perpetual on-chain fund tracking.
  • Coinjoin combines multiple users’ inputs into one transaction with equal-value outputs to obscure ownership.
  • Gregory Maxwell proposed the coinjoin protocol in 2013; JoinMarket launched in 2015 and Wasabi Wallet in 2018.
  • US authorities arrested Samourai Wallet’s founders in April 2024; they pleaded guilty in 2025 to running an unlicensed money-transmitting business.
  • zkSNACKs, the coordinator operator for Wasabi Wallet, shut down its service in June 2024.
  • The Bitcoin white paper (§10) proposed privacy by keeping public keys anonymous and using new key pairs per transaction.
  • The common-input-ownership heuristic links all inputs of a single transaction to the same owner, breaking address isolation.
  • Chris Belcher documented major blockchain attacks on privacy, including change detection and address clustering heuristics.
  • Meiklejohn et al. (2013) showed that clustering heuristics and a few known addresses could identify major Bitcoin services.
  • Chainalysis, founded in 2014, provides flow-tracing software for exchanges and governments to attribute on-chain activity.
  • Address reuse and multi-input consolidation are primary self-inflicted leaks that enable long-term identity linking.
  • CoinJoin was proposed by Gregory Maxwell in 2013.
  • zkSNACKs shut down its central coordinator on June 1, 2024.
  • Samourai’s founders were sentenced to five and four years in November 2025.
  • PayJoin (BIP-78) allows the receiver to add an input to a transaction.
  • The Payjoin Dev Kit reached version 1.0 in August 2026.
  • CoinJoin breaks the common-input-ownership heuristic used by chain analysis.

Exercise nine, six, three, one

9CollectFind 9 multi-input transactions on a block explorer, including at least two labeled coinjoins; note the number of inputs and outputs and the output values.
6ClusterGroup the 9 transactions into 6 categories based on output value uniformity: all equal, mostly equal, one large change, mixed sizes, single output, or other patterns.
3DistillReduce the 6 to 3 conclusions an analyst could, and could not, safely draw from these transactions.
1CrystallizeWrite 1 sentence on how equal-value outputs in a coinjoin transaction create ambiguity that breaks input-output linking.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS