Privacy model¶
What it protects
CoinJoin gives you an anonymity set: the group of outputs your coin is now indistinguishable from. Honesty is the only durable privacy claim — it raises the cost of transaction-graph analysis, it is not invisibility.
What it hides — and what it doesn't¶
| Hides | Does not hide |
|---|---|
| ✓ Which input funded which equal output, within the set | ✗ Amounts that aren't equalised (and the change) |
| ✓ A direct on-chain link between sender and receiver | ✗ Timing, and that a CoinJoin happened at all |
| ✓ Common-input-ownership heuristics, for the joined inputs | ✗ Address reuse or careless post-mix spending |
Privacy is probabilistic, not absolute
A CoinJoin raises the cost and uncertainty of chain analysis; it doesn't make a coin "untraceable". Good post-mix habits matter as much as the join itself.
The anonymity set, concretely¶
The set is just: how many participants could plausibly be the source of a given coin? Two is weak; a hundred is strong. Bigger set, more cover.
The floor. A round won't broadcast until at least five distinct participant accounts have joined at the same denomination — so your coin blends with a minimum of five, and usually more. Honesty about the number: accounts are free to create, so that five is a floor on accounts, not a guarantee of five independent people. A determined actor could register several accounts to pad a round — see what CoinJoin can't hide.
Two things shrink the set in practice:
- Unequal amounts — a unique value is a fingerprint that links an output straight back to an input.
- Sybil participants — if one actor controls most of the "participants" in a round, your set is smaller than it looks. Set design and a real participant pool both matter.