Bitcoin Privacy 101: CoinJoin and Beyond
A CoinJoin merges several people's payments into one transaction so that no observer can tell which output belongs to which input. It attacks exactly one assumption, the one chain-analysis firms lean on hardest: that every input to a transaction has the same owner. It does not hide amounts, it does not hide timing, and it does not survive careless spending afterwards.
That last sentence is the part most guides skip, and it is the reason a lot of people who thought they had privacy did not have any. The technique is sound. The way it gets used is usually where it falls apart.
What does a CoinJoin actually do?
Greg Maxwell posted the idea to Bitcointalk on 22 August 2013, and the whole thing rests on one property of the protocol that he put in bold at the time: the signatures inside a transaction are completely independent of each other. Nothing in Bitcoin says one person signed them all. That was always just an assumption analysts made because it is usually true.
So a group can agree on a set of inputs to spend and a set of outputs to pay, then each person signs only their own input, and the pieces get merged into one valid transaction. Maxwell's own description of the result is the important bit: such a transaction is "externally indistinguishable from a transaction created through conventional use."
The Bitcoin wiki calls the assumption being attacked the common-input-ownership heuristic, and describes it as "unreasonably effective" in practice. Break it and a large amount of clustering work stops being reliable. That is the entire product.
| Signal | Hidden by CoinJoin? | Why |
|---|---|---|
| Which output belongs to which input | Yes | Equal-valued outputs are interchangeable by construction |
| That the inputs share an owner | Yes | Each participant signed only their own input |
| The amounts involved | No | Every value is written on chain in the clear |
| The change outputs | No | Change is whatever is not equal-valued, so it is obvious |
| That a CoinJoin happened at all | No | Equal-output transactions are a recognisable pattern |
| Your IP address | No | Separate problem, separate fix (Tor, your own node) |
| What you do with the coins next | No | This is where most of the privacy is actually lost |
Where does it leak?
Amounts are the first hole. The wiki's framing is blunt: value goes in, value minus fee comes out, and an adversary can simply search the chain for output amounts that match. Equal-valued outputs exist precisely to defeat that search, which is why serious implementations use them and why the fixed denominations feel so awkward to use.
Change is the second hole, and it follows from the fix for the first. If the anonymous outputs are the equal ones, then the odd-sized leftovers announce themselves. Every participant walks out of a CoinJoin holding one clean output and one output that is still fully attached to their past.
The third hole is you. This is the one that matters most and gets discussed least.
Spend three mixed outputs together and you have signed them all in one transaction, which is the exact pattern CoinJoin exists to break. Combine a mixed output with an unmixed one and it is worse: you have handed over both histories and welded them together. Send the result straight to an exchange account in your legal name and the whole exercise was theatre.
Timing helps analysts too. So does using a wallet whose fee-estimation habits and script-type choices produce a recognisable fingerprint, which is a documented technique for spotting change outputs. And if you connect to somebody else's node over a plain connection while doing any of this, the network layer can leak what the chain layer did not. Running your own full node removes that entire category of problem and costs about the price of a used laptop.
Which CoinJoin tools are actually running in 2026?
This is where most articles on this subject are quietly out of date, because the answer changed twice in eighteen months and not in the direction anybody expected.
Wasabi Wallet. The software is alive and maintained. Version 2.8.1 was published on 22 July 2026 and added Taproot addresses by default. What ended is the coordinator. zkSNACKs, the company that built Wasabi, discontinued its coinjoin coordination service on 1 June 2024. As of 29 July 2026 the Wasabi site ships no default coordinator at all and tells users to "find a third-party Wasabi Coordination Service Provider". The wallet still functions perfectly well as an ordinary wallet.
JoinMarket. Still going, and structurally different in a way that now looks prescient. There is no coordinator to shut down. It is a market: some participants offer liquidity for a fee, others pay it, and the matching happens peer to peer. Release 0.9.12 landed on 21 April 2026, with commits into late April. It is command-line heavy and genuinely harder to use than Wasabi, which is the price of that structure.
Samourai Wallet and Whirlpool. Gone, and not coming back. The servers and domain were seized in April 2024. Both founders pleaded guilty on 30 July 2025 to one count of conspiracy to operate a money transmitting business that transmitted crime proceeds. Keonne Rodriguez was sentenced to five years on 6 November 2025, William Lonergan Hill to four years on 19 November 2025. Any guide still telling you to open Whirlpool is describing a service that does not exist.
| Tool | Status, 29 July 2026 | Model | What we checked |
|---|---|---|---|
| Wasabi Wallet | Software maintained, no default coordinator | Coordinated, WabiSabi | v2.8.1 published 22 Jul 2026; site directs users to third-party coordinators |
| JoinMarket | Maintained and running | Peer-to-peer market, no coordinator | v0.9.12 released 21 Apr 2026, commits to 27 Apr 2026 |
| Samourai / Whirlpool | Shut down | Coordinated | Servers seized Apr 2024; founders sentenced Nov 2025 |
| Payjoin | Specified, BIP status Deployed | Two-party, no coordinator | BIP-78 header read direct from the BIPs repository |
| Silent payments | Specified, BIP status Complete | Wallet-level, no soft fork needed | BIP-352 header; Layer listed as Applications |
| Individual third-party coordinators | Not verified | Coordinated | We could not confirm which are operating. Check before trusting one |
Is any of this legal?
Using a wallet that improves your privacy is not itself a crime in the United States, and the Samourai case did not hold otherwise. What the founders pleaded guilty to was operating a money transmitting business that moved criminal proceeds. The government's evidence was not that they wrote privacy software; it was that they marketed the service to criminals. The sentencing release quotes Hill recommending Whirlpool to a darknet-forum user as "a much better option" for cleaning illicit funds, and Rodriguez describing the business internally as "money laundering for bitcoin".
That distinction is doing real work, and it cuts both ways. It means an ordinary person using an ordinary privacy tool is in a different position from somebody running a service. It also means the operators of coordination services now face a risk they did not price in before 2024, which is exactly why zkSNACKs stopped and why the remaining options skew towards designs with nobody at the centre to prosecute.
The practical friction is separate from the legal question. Some exchanges have flagged, delayed, or frozen deposits with recent CoinJoin history. That is a business policy, not a law, and it varies by company and by jurisdiction. If your coins are going to end up at a regulated exchange, find out that company's policy before you plan around it, not after. Nothing here is legal advice, and privacy law is very much local: this is one of the few Bitcoin topics where an hour with a lawyer in your own country is worth more than any article.
What else is there besides CoinJoin?
Quite a lot, and some of it is better suited to ordinary use.
Payjoin is specified in BIP-78, whose status in the BIPs repository reads Deployed. The merchant contributes one of their own inputs to your payment. The transaction that results looks like an ordinary two-input spend, so unlike a CoinJoin it raises no flag, and the amount recorded on chain is not the amount you paid. Every Payjoin in the wild also makes the common-input assumption slightly less trustworthy for everybody, including people who never use it.
Silent payments, BIP-352, solve a different problem: publishing a single reusable address without the address reuse that normally comes with it. The payer derives a fresh output for you from your published static address, so nobody watching the chain can total your receipts. Its BIP status is Complete and its layer is Applications, which is the detail worth noticing. It needs no soft fork, only wallets that implement it.
Plain hygiene is unglamorous and beats all of the above for most people. Never reuse an address. Do not consolidate outputs from unrelated sources into one transaction without deciding to. Keep coins from different origins in separate accounts, and label them, which is what coin control in a decent wallet is for. Our guide to address types covers why your wallet hands you a new address every time, and the threat model guide is the right place to start if you have not decided who you are actually hiding from.
Who are you doing this for?
Answer that before touching any of the tools, because the honest answers point in very different directions.
If the concern is a nosy counterparty, a landlord, an employer, or a merchant who can see your entire net worth the moment you pay them from a reused address, then address hygiene and a fresh address per payment solve most of it for free. That describes the overwhelming majority of people who look into this.
If the concern is a commercial rival reading your supplier payments off a public ledger, or a business that would rather not publish its cash position, then you are in the territory where deliberate structuring of transactions matters, and so does keeping business coins away from personal ones.
| Who can see your finances | How common | What actually helps |
|---|---|---|
| A merchant or counterparty you paid | Nearly everyone | A fresh address per payment. Nothing else needed |
| Anyone who has your address | Nearly everyone | Stop reusing addresses. This is the whole fix |
| Your wallet's server operator | Most people | Run your own node |
| A commercial rival reading the ledger | Businesses | Separate accounts, coin control, Payjoin |
| A chain-analysis firm on contract | Rarer | Structured spending over time, not one transaction |
| A state actor with subpoena power | Rare | No consumer tool is sufficient by itself |
If the concern is a state actor with subpoena power, no consumer tool on this page is going to be sufficient on its own, and the failure will probably not be cryptographic. It will be the exchange that has your passport, the phone in your pocket, or the transaction you made in a hurry three years ago. Privacy is a property of a whole pattern of behaviour over years, not a button.
| Leak | How common | Cost to fix | Fix |
|---|---|---|---|
| Address reuse | Very common | Free | A fresh address per payment. Your wallet already does this |
| Querying someone else's node | Default behaviour | One-off hardware | Run your own node |
| Careless consolidation | Common | Free, needs attention | Coin control; keep origins in separate accounts |
| Change output linkage | Every transaction | Awkward | Payjoin, or careful handling of post-mix change |
| Amount correlation | Every transaction | Awkward | Equal-output CoinJoin, splitting across spends |
| KYC records at an exchange | Most holders | Cannot be undone | Nothing retroactive. Only future choices |
And there is one thing worth saying plainly, because the subject attracts a lot of nervous hedging: wanting financial privacy is not suspicious. Nobody thinks it is strange that your bank statement is not published. Bitcoin is unusual among payment systems in that its ledger is public by design, so the privacy that is ambient elsewhere has to be reconstructed deliberately here. That is a property of the tool, not a confession about the user.
What actually moves the needle
In rough order of return on effort, and none of the top three involve a CoinJoin at all:
- Stop reusing addresses. One address per payment. It is free, every wallet does it automatically, and it removes the single most reliable signal analysts have.
- Run your own node. Otherwise you are telling somebody else's server exactly which addresses to associate with your IP, every time your wallet syncs. See running a full node.
- Use coin control and keep origins separate. Coins from an exchange that knows your name and coins from a private sale should not meet inside one transaction unless you chose that.
- Prefer Payjoin where a merchant offers it. No extra transaction, no fingerprint, and it helps other people too.
- If you use a CoinJoin, plan the exit before the entry. Decide in advance how the outputs get spent, separately and unhurriedly. The mix is the cheap part.
- Watch what a block explorer shows about your own addresses. It is the same view an adversary has, and it is free.
One last thing that should temper any confidence here. Chain analysis is an active industry with real budgets, and the heuristics in this article are the published ones. The unpublished ones are, by definition, not in any guide. Anyone who tells you a specific technique makes you untraceable is selling something, and the honest version of this subject is a running estimate rather than a solved problem. Treat privacy the way you treat security: as a habit that has to hold up over years, where one careless transaction undoes a lot of careful ones.
Related on BTCLinks
Sources
- Greg Maxwell, "CoinJoin: Bitcoin privacy for the real world", Bitcointalk, 22 August 2013. The original proposal. Source of the independent-signatures property and the "externally indistinguishable" quote. Verified 2026-07-29.
- Bitcoin wiki: Privacy. Source of the common-input-ownership heuristic and the "unreasonably effective" description, the change-detection heuristics including address reuse and wallet fingerprinting, and the amount-correlation and equal-output change weaknesses. Verified 2026-07-29.
- Wasabi Wallet. Confirms version 2.8.1 and that no default coordinator is provided, with the instruction to find a third-party coordination service provider. Read 2026-07-29.
- Wasabi Wallet releases. Version 2.8.1 published 22 July 2026, including Taproot addresses by default. Verified 2026-07-29.
- JoinMarket releases. Version 0.9.12 published 21 April 2026; most recent commit 27 April 2026. Verified 2026-07-29.
- IRS Criminal Investigation: Samourai Wallet founders plead guilty. Source of the 30 July 2025 plea date and the single count of conspiracy to operate a money transmitting business. Verified 2026-07-29.
- IRS Criminal Investigation: Samourai Wallet founders sentenced. Source of the 6 and 19 November 2025 sentencing dates, the five and four year terms, and both quoted internal communications. Verified 2026-07-29.
- BIP-78: A Simple Payjoin Proposal. Status read as Deployed from the specification header. Verified 2026-07-29.
- BIP-352: Silent Payments. Status read as Complete, Layer as Applications, from the specification header. Verified 2026-07-29.
Some links are affiliate links. As an Amazon Associate we earn from qualifying purchases. Not financial advice.