What CoinJoin can't hide¶
The honest limitations
Privacy is a cost you impose on someone analysing the chain — not a cloak that makes a coin disappear. This page maps exactly where CoinJoin stops, so you can decide whether it fits your threat model. If a page ever tells you a mix makes coins "untraceable", close the tab.
The one-line version¶
A CoinJoin breaks the link between a specific input and a specific equal-value output, within one round. It does not erase amounts, timing, metadata, or your own spending habits. Almost every real-world deanonymisation below follows from that single sentence.
What stays visible on-chain¶
| Still visible | Why |
|---|---|
| ✗ That a CoinJoin happened | The equal-output shape is a recognisable pattern; chain analysts flag it. |
| ✗ Non-equal amounts (especially change) | Any output that isn't part of the uniform set is a unique value — a fingerprint. |
| ✗ Timing | When you joined, and when you spent afterwards, are both public and correlatable. |
| ✗ Anonymity-set size | Anyone can count the equal outputs in the round; your cover is exactly that number. |
The change output — the #1 deanonymiser¶
Your inputs rarely sum to an exact multiple of the pool denomination, so a CoinJoin usually returns change — a non-uniform amount. That change is trivially linkable back to you, and if you later combine it with a mixed output in the same transaction, you re-link the two and undo the round.
Change is where privacy leaks
Treat change as not private. Keep it separate from your mixed outputs; never spend both in one transaction.
Amount and timing correlation¶
- Unequal amounts. Equal outputs are the whole trick — see how it works. The moment an amount is unique, value-matching links it straight through the join.
- Consolidation. Mixing and then immediately sweeping several mixed outputs into one address reunites your anonymity set into a single, obvious cluster.
- Timing. "Joined at 14:02, spent at 14:05" is a strong heuristic. Latency between the join and the next hop is part of your privacy.
Address reuse and post-mix behaviour¶
This is the biggest self-inflicted leak, and no coordinator can protect you from it:
- Reusing a mixed address links every payment to or from it.
- Combining mixed and un-mixed UTXOs in one spend re-associates them.
- Sending a freshly mixed coin straight to a KYC exchange hands the analyst both ends.
Good habits after the join matter as much as the join itself.
Anonymity-set quality — Sybil attacks¶
Set size is not set quality. If one actor controls most of the "participants" in a round, your real cover is far smaller than the output count suggests — a Sybil attack. A meaningful set needs genuinely independent participants, not just many outputs. Bigger and real is what counts.
What the coordinator can — and cannot — see¶
Honesty about the trust boundary, including for our own hosted service:
The coordinator can see¶
- Your inputs, destination and change address for the round
- The timing of your request
- Your IP address — unless you connect over Tor
The coordinator cannot do¶
- Move your funds — you sign locally, keys never leave your machine
- Forge or redirect outputs
- Sign on your behalf
So a coordinator learns the very input→output linkage you're hiding from the public chain. You are trading public-chain privacy for trust in the coordinator not to log or leak. Self-custody signing, connecting over Tor, and a coordinator that doesn't retain data narrow that trust — but they don't remove it, and you should choose a coordinator accordingly. Our reference implementation exists so you can verify what the coordinator actually does.
Network-level metadata¶
Your IP is exposed to the coordinator and to any Bitcoin node you broadcast through, independently of what happens on-chain. Use Tor for the whole flow; on-chain privacy with a clear-net IP trail is half a solution.
What this means for you¶
Do¶
- Route everything over Tor
- Keep mixed coins separate from change and un-mixed UTXOs
- Wait before spending after a join
- Prefer larger, genuine anonymity sets
- Understand your set size before you rely on it
Don't¶
- Consolidate mixed + un-mixed coins in one spend
- Send mixed coins straight to a KYC service
- Reuse addresses
- Treat a mix as "untraceable" or "100% anonymous"
Why we lead with the limits
A tool that's honest about where it stops is one you can actually reason about. CoinJoin raises the cost and uncertainty of transaction-graph analysis — a real, useful, probabilistic gain. It is not invisibility, and anyone who sells it as invisibility is selling you a risk.