Consolidation of mixed outputs

[n0nce]

After talking about Anonymous UTXO consolidation through LN a few months ago, I'd like to hear a few opinions about consolidation of (traditionally) mixed outputs.
With this I mean mixing through ChipMixer, CoinJoin, JoinMarket and the like.

I pondered on this a bit and I see a few reasons for and against it. Some questions seem trivial or silly, but I'm just trying to give food for thought and discussion.

[1] Firstly, if you're looking to consolidate many small inputs, you could send everything to the mixer 1 input at a time. This way you won't link them when sending.
Next, send all the mixed, anonymous outputs to one address in one transaction.

It should be reasonably secure except from one aspect which is tracing wallet sizes. However if the inputs weren't linked to each other before mixing, it should be fine, right?

[2] If you perform a UTXO mix on ChipMixer and don't want to end up with many little UTXOs, you may consider doing one transaction that bundles all those output chips into one fresh UTXO.
Since chips can be chosen in relatively large sizes, I don't think that having too many little output chips is really a realistic risk, so best would be to just make them large enough and withdraw each one to a fresh new address?

[3] Consolidating change. As we all know, using a common change address is one big privacy risk in Bitcoin. However if you deal with mixed coins and separate change addresses, you're generally speaking fine; but you quickly rack up a lot of 'change UTXOs' that you will sooner or later need to join together. Is it a good idea to individually mix change UTXOs and then join them, what do you think?


By the way, if you want to get notified about low mempool fees to consolidate small inputs, this is the thread to watch: [May 2022] Mempool empty! Use this opportunity to Consolidate your small inputs!

[BlackHatCoiner]

It should be reasonably secure except from one aspect which is tracing wallet sizes. However if the inputs weren't linked to each other before mixing, it should be fine, right?

Tracing wallet sizes? Like?

As we all know, using a common change address is one big privacy risk in Bitcoin.

It's a big privacy risk if you can trace what I'm doing with it. But, if I just mix all of my change in one transaction, I don't think it's so bad. Making it official that I'm the owner of those UTXO's doesn't harm much, and you've pretty much already known it.

Of course, if they appear to be a lot, then you might not want to reveal you own that much money. In any case, it's better to split your inputs in several transactions.

[o_e_l_e_o]

The best thing you can do is not create change at all. This was very easy to do when ChipMixer was launched and Bitcoin was ~$1,500, since the smallest chip - 0.001 BTC - was only worth around $1.50. So any payment you wanted to make you could round up to the nearest $1.50, have no change output, and not really mind paying an extra buck (or just add the extra on to the fee). Now that 0.001 BTC is worth $30 or more, then it isn't so economical.

You can still avoid creating change outputs with careful UTXO selection. Or instead of rounding up your payment as described above, round up your basket - throw in a couple more cans of beer or an extra month subscription or whatever else you were buying to bring the total up to whatever UTXO you have available so you can avoid creating change. Or just let the merchant keep the rest as a tip. Other options are merchants which will let you open an account or tab with them, top up that account with any amount, and then spend from your available balance.

The way that I deal with the change I do create is usually via ChipMixer, because I find it more economical than trying to coinjoin lots of small change outputs. If I already have some bitcoin stored on ChipMixer under a voucher, then I can just add any change in to that same stack to better hide it. So if, for example, I have 0.012 BTC in a voucher on ChipMixer, than after a couple of small change deposits I can withdraw a 0.016 chip, which prevents them being linked from people looking at individual sizes as you suggest.

If I ever have to deal with any really small change outputs, I usually just fire them off to the donation address of something like Tor, Tails, EFF, etc.

[stompix]

Tracing wallet sizes? Like?

I don't know if he's referring to this but it's one of the types of backtracking chainalysis tries to do when it comes to those, it goes back in time looking for any possible transactions that would match the input that is missing from their history, for example when an address that is tracked deposits coins on a known exchange address it will try to match an outgoing sum from the same exchange or consolidations further down in time that match the value deposited.

Is it a good idea to individually mix change UTXOs and then join them, what do you think?

I made the mistake of sending freshly coins mixed to exchanges, but I've never and I don't plan on ever linking mixed coins, as o_e_l_e_o said, it's better to have them split in reasonable amounts based on your needs and spending habits that will not create change which is of a too-large value to ignore. Rather than trying to consolidate 5 addresses with 10$ worth to pay for a subscription, I would rather break in 5 a 500$ one and use one of the fractions.

That being said I do have a ton of "dust" in my wallets but I've always postponed any consolidation simply because at this point one screwup and years of mixing have been for nothing, so I'll just let it sit there till I can buy a house with the change from a protonvpn payment 

[NotATether]

What if instead of mixing your entire input amount at once, you break the amount into successive mixing sessions, so long as the broken inputs are still fairly large (anything less than $500 is strictly a no-no)?

Then you could combine up to 1 output from each session, and the trackers would not know any better, because the splitted outputs themselves from each broken-up session are not linked together.


Of course, if you could hypothetically have your own private coinjoin network of senders, you'd be able to create long chains of transactions fairly easily without being detected as such. Because most commercial trackers have a limit on the chain length to track - maybe 50 for example - so they won't rewind the chain any further to check.

[witcher_sense]

[1] Firstly, if you're looking to consolidate many small inputs, you could send everything to the mixer 1 input at a time. This way you won't link them when sending.

But if inputs came from a mixing service and therefore have no connection to each other, why not just consolidate them in one transaction before sending them to a mixer again? What traces are you leaving in this case? That some anonymous person used a particular mixing service several times and later decided to mix their funds again but in a single transaction, in my view, doesn't tell much because it is still unknown to an observer where funds have landed up after a final mixing round. The thing is UTXO consolidation always involves certain trade-offs, but sending everything (mixed outputs) in a single transaction is at least less time-consuming and, more importantly, a lot less block space-consuming. Please note that I was talking about a specific case in which you are using the same mixing service both for the obfuscation of your inputs and their subsequent consolidation. If your inputs are from completely different sources (Wasabi, JoinMarket, Whirlpool, Chipmixer, Mercury, etc), then it definitely makes more sense to send them one by one to a mixing service before consolidating them.

[o_e_l_e_o]

That being said I do have a ton of "dust" in my wallets

An option here might be to try to find a service which will accept such small inputs in exchange for either a Lightning payment or a Monero payment without too much in the way of fees, and consolidate them that way before converting them back to a Bitcoin UTXO (although you would obviously have minimal privacy when considering the service you were using).

But if inputs came from a mixing service and therefore have no connection to each other, why not just consolidate them in one transaction before sending them to a mixer again? What traces are you leaving in this case?

You might be lowering the amount of privacy you gain. If I consolidate a bunch of different sized outputs in a single transaction which then sends (for example) 1 BTC to a mixer, and then immediately withdraw a 1 BTC output, then there is a potential link there. If I separately send 0.164 BTC, 0.051 BTC, 0.391 BTC, and so on, particularly spread out over a period of days rather than within a few minutes of each other, and then later withdraw 1 BTC, then I obfuscate that link as my deposits are obscured by everyone else's deposits during the same time.

[NotATether]

An option here might be to try to find a service which will accept such small inputs in exchange for either a Lightning payment or a Monero payment without too much in the way of fees, and consolidate them that way before converting them back to a Bitcoin UTXO (although you would obviously have minimal privacy when considering the service you were using).

There we go.

Monero is particularly private, so sending your money through a mostly-private exchange such as LocalMonero, using it all to buy XMR for BTC and then back again, and withdrawing in chunks instead of the whole thing (the chunks must be large enough to negate the repeated withdrawal fee) would be a good starting point for untainting mixer outputs - it will be flagged by an exchange as from some other exchange should the transaction chain between the internal addresses in the exchange be long enough.

You won't have to worry about being tracked on the Monero chain because of its use of bulletproofs which makes it harder to unmask the identity of the transaction inputs (by putting in a bunch of spent inputs as fakes). This assumes the exchange won't sell you over though.

[n0nce]

It should be reasonably secure except from one aspect which is tracing wallet sizes. However if the inputs weren't linked to each other before mixing, it should be fine, right?

Tracing wallet sizes? Like?

The idea is: if you had a total of 0.7 BTC in a wallet previously and after the consolidation, it adds up to slightly less than 0.7; a correlation could be made.

As we all know, using a common change address is one big privacy risk in Bitcoin.

It's a big privacy risk if you can trace what I'm doing with it. But, if I just mix all of my change in one transaction, I don't think it's so bad. Making it official that I'm the owner of those UTXO's doesn't harm much, and you've pretty much already known it.

Reused change addresses not only allow tracing what you're doing with the change but also tracing what you're doing with the rest of your BTC. Let's say I'm a merchant and you pay me some BTC; I can look at the change address and see other deposits. I can follow the transactions of these deposits and see that you also sent BTC to other (known or unknown) addresses; which could be exchanges (authorities can call them and ask 'who is the human behind address X'), stores or friends of yours that I now know you have some sort of connection to.

Therefore I think you need to send the inputs to the mixer individually and only combine the mixed outputs, right?
It might also depend on the mixer in question; honestly I'm most familiar with ChipMixer and I don't know whether you can even send multiple UTXOs to e.g. CoinJoin and get out one consolidated output (like in CM with user-choosable chip sizes).

The best thing you can do is not create change at all. This was very easy to do when ChipMixer was launched and Bitcoin was ~$1,500, since the smallest chip - 0.001 BTC - was only worth around $1.50. So any payment you wanted to make you could round up to the nearest $1.50, have no change output, and not really mind paying an extra buck (or just add the extra on to the fee). Now that 0.001 BTC is worth $30 or more, then it isn't so economical.

So you just got tons of 0.001BTC chips from ChipMixer and used them in full when paying something? Wouldn't that make for pretty large (and expensive) transactions? Or would you create and withdraw appropriately sized chips / UTXOs on the spot?

You can still avoid creating change outputs with careful UTXO selection. Or instead of rounding up your payment as described above, round up your basket - throw in a couple more cans of beer or an extra month subscription or whatever else you were buying to bring the total up to whatever UTXO you have available so you can avoid creating change. Or just let the merchant keep the rest as a tip. Other options are merchants which will let you open an account or tab with them, top up that account with any amount, and then spend from your available balance.

All sound like pretty cool options; the last one surely the most convenient one and with 0 'loss'!

The way that I deal with the change I do create is usually via ChipMixer, because I find it more economical than trying to coinjoin lots of small change outputs. If I already have some bitcoin stored on ChipMixer under a voucher, then I can just add any change in to that same stack to better hide it.

So if, for example, I have 0.012 BTC in a voucher on ChipMixer, than after a couple of small change deposits I can withdraw a 0.016 chip, which prevents them being linked from people looking at individual sizes as you suggest.

I tried to bring this idea up but wasn't sure how to correctly phrase it. Sending multiple outputs to a single CM mix, individually, will keep them completely unlinked, right? If they're below the minimum of 0.001, I guess you could 'LN mix them' and then send to CM afterwards. It may be less secure and whatnot, but if you can't afford to just throw away 30 bucks it may be an option.

If I ever have to deal with any really small change outputs, I usually just fire them off to the donation address of something like Tor, Tails, EFF, etc.

That's pretty cool; but I wonder how long it will be sustainable; 0.001BTC might be well over 100$ in the future; in some countries like Colombia, BTC0.001 is already over 100k of their home currency COP. I'm not sure as to how much purchasing power it sums up there, though.

[DaveF]

To me at least it also depends on the amount of the dust and how much time and effort and money you want to put into it.

There are a few exchanges that don't need anything more then an email address to sign up and will give you a new address with each deposit. They do have miinnium deposit amounts but will credit you once you hit it in total usually 0.001

So in theory it would be known that all these outputs went to one exchange and the exchange would know what email address they were linked to but that is about it.

You could then exchange the coins to a privacy based coin like XMR to another exchange that just requires an email to sign up and exchange them back to BTC

Downsides:
2 x exchange fees
2 x withdraw fees
A lot of time for what may not be a lot of money in the end
If you don't use public Wi-Fi or the like there is still the risk of being found out
You have to trust the exchanges with the funds

-Dave

[n0nce]

Tracing wallet sizes? Like?

The idea is: if you had a total of 0.7 BTC in a wallet previously and after the consolidation, it adds up to slightly less than 0.7; a correlation could be made.

A wallet could have multiple addresses and blockchain data alone sometimes not enough to determine whether set of address belong to same address/person. But if you meant an address rather than a wallet, you could set higher fee or use option to use multiple address as destination.

I tried to keep it vague; for instance some people inadvertently leak multiple addresses of a wallet online, give the xpub to a non-trustworthy party or - the easiest - address reuse. But sure, if you 'follow protocol', addresses in a wallet shouldn't be linked, so total wallet amount is unknown to the outside.

If I ever have to deal with any really small change outputs, I usually just fire them off to the donation address of something like Tor, Tails, EFF, etc.

That's pretty cool; but I wonder how long it will be sustainable; 0.001BTC might be well over 100$ in the future; in some countries like Colombia, BTC0.001 is already over 100k of their home currency COP. I'm not sure as to how much purchasing power it sums up there, though.

If Bitcoin price keep increasing, IMO it's likely ChipMixer will introduce smaller chip amount.

I hope they will; as far as I know it has never happened yet. A few months back, when 1x 0.001BTC chip was over 50 bucks (or now at roughly 30), they didn't make them smaller either; and as o_e_l_e_o said it was the same size when Bitcoin was $1,500 a pop.

To me at least it also depends on the amount of the dust and how much time and effort and money you want to put into it.

There are a few exchanges that don't need anything more then an email address to sign up and will give you a new address with each deposit. They do have miinnium deposit amounts but will credit you once you hit it in total usually 0.001

So in theory it would be known that all these outputs went to one exchange and the exchange would know what email address they were linked to but that is about it.

You could then exchange the coins to a privacy based coin like XMR to another exchange that just requires an email to sign up and exchange them back to BTC

Downsides:
2 x exchange fees
2 x withdraw fees
A lot of time for what may not be a lot of money in the end
If you don't use public Wi-Fi or the like there is still the risk of being found out
You have to trust the exchanges with the funds

-Dave

Creative way of (ab)using an exchange for gaining instead of losing privacy! Since we're speaking about small amounts, actually an 'instant exchanger' might be perfect for this.
These platforms like https://fixedfloat.com/; they require no registration at all. I don't know if you can deposit multiple times there, though.

[BlackHatCoiner]

[...]

There are two things I don't understand from your response:

• What's "untainting mixer outputs"? Haven't we already made it clear that "taint" is an arbitrary rule? Mixing and trying to have your outputs "untainted" is contradictory.
• What's the benefit of mixing with BTC <--> XMR <--> BTC compared to mixing directly with BTC <--> BTC? If it's time, which is the only think I can think of, that's where vouchers and chips take place.

Reused change addresses not only allow tracing what you're doing with the change but also tracing what you're doing with the rest of your BTC. Let's say I'm a merchant and you pay me some BTC; I can look at the change address and see other deposits. I can follow the transactions of these deposits and see that you also sent BTC to other (known or unknown) addresses; which could be exchanges (authorities can call them and ask 'who is the human behind address X'), stores or friends of yours that I now know you have some sort of connection to.

True, but doesn't this answer on why you shouldn't keep change at all? As said by Leo above, whenever you're going to have a decent change left over from a transaction, send them to ChipMixer instead. Or, if you're thinking of buying in bulk, make your purchase and send the rest to ChipMixer.

What I said is: If you have change in x outputs, which are essentially linked from your previous transactions, it doesn't matter that much to broadcast 1 transaction where you spend them all, or x transactions where you spend 1 in each.

[witcher_sense]

<…>

The biggest downside of this method is that your account may be frozen after you made a deposit and you will no longer be able to withdraw your funds or consolidate them unless by sacrificing your privacy by providing your real identity. If you still consider exchanges a means to merge your small inputs, a simpler solution would be using a nice bitcoin-only gambling website like bustadice where, as you said, you need nothing but an email address to sign up and where it is highly unlikely that you will be asked for documents. If you like, you can gamble with part of the funds to further obscure the link between your initial amount and your withdrawal amount.

If I consolidate a bunch of different sized outputs in a single transaction which then sends (for example) 1 BTC to a mixer, and then immediately withdraw a 1 BTC output, then there is a potential link there.

Fair point, but you are not obligated to withdraw immediately and in a single transaction.

[DaveF]

Also, and since I do like the service you can use Bitrefill and buy gift cards if it's available where you are located.

https://www.bitrefill.com/signup?code=mibrahcu <-- referral link
https://www.bitrefill.com <-- non referral link

They have the option of adding BTC to your account. They will convert it to a 'cash balance' at the time you send it and each time you deposit you get a new address.
The minimum is $1.00 at the time of sending.

So in theory you could create an account with just an email add a bunch of small amounts of BTC, withdraw to a gift card that you can use in person.

A bit more limited then an exchange since they have to offer service where you are and you have to want to use a gift card at one of the merchants they offer. But still an option.

EDIT TO ADD: If you do use the referral link above and make a qualifying purchase I will know what email address you signed up with, no way of tying it back to you but wanted to put it out there.

-Dave

[ABCbits]

A wallet could have multiple addresses and blockchain data alone sometimes not enough to determine whether set of address belong to same address/person. But if you meant an address rather than a wallet, you could set higher fee or use option to use multiple address as destination.

I tried to keep it vague; for instance some people inadvertently leak multiple addresses of a wallet online, give the xpub to a non-trustworthy party or - the easiest - address reuse. But sure, if you 'follow protocol', addresses in a wallet shouldn't be linked, so total wallet amount is unknown to the outside.

I get the point, but people who bother use mixer/coinjoin (even with risk blacklisted from some service) is likely have better privacy practice and unlikely doing example you mentioned.

They have the option of adding BTC to your account. They will convert it to a 'cash balance' at the time you send it and each time you deposit you get a new address.
The minimum is $1.00 at the time of sending.

So in theory you could create an account with just an email add a bunch of small amounts of BTC, withdraw to a gift card that you can use in person.

It seems neat idea, but i wonder if there's privacy implication if you keep doing it for long time? I know Bitrefill give new address for each purchase, but i don't remember whether they also give new address for each deposit.

[o_e_l_e_o]

So you just got tons of 0.001BTC chips from ChipMixer and used them in full when paying something? Wouldn't that make for pretty large (and expensive) transactions? Or would you create and withdraw appropriately sized chips / UTXOs on the spot?

Let's say I deposited 0.1 BTC to ChipMixer. I then wanted to pay for something which was 0.0207 BTC. I would withdraw a 0.016, 0.004, and 0.001 chip, pay the merchant 0.021 BTC (not minding that I just overspent by 50 cents or so) and leave the other 0.079 BTC on ChipMixer as a voucher until I next needed it. No change created. But as I said before, this isn't really economical anymore since the lost 50 cents in this example is now ~$10.

I tried to bring this idea up but wasn't sure how to correctly phrase it. Sending multiple outputs to a single CM mix, individually, will keep them completely unlinked, right?

Well, a single ChipMixer session provides a single deposit address, so no, it would link all the outputs. The way to do it is to deposit any UTXOs you don't mind being linked in a single session, withdraw a voucher for the total amount of your deposit, and then destroy that session. Repeat with another sessions with another set of UTXOs and withdraw another voucher. Repeat as many times as necessary - you can do as little as one deposit per session if you want (bearing in mind the minimum deposit limits). Once you have multiple vouchers, you can open yet another new session and combine all the vouchers together, and then make a single large withdrawal.

[DaveF]

It seems neat idea, but i wonder if there's privacy implication if you keep doing it for long time? I know Bitrefill give new address for each purchase, but i don't remember whether they also give new address for each deposit.

Yes they do. I just tried it, sent BTC to the given address and as soon as it was confirmed and I went back there was a new deposit address.
And even if there is an 'upper limit' of the addresses they will give you all you need is another email and you can start the process again.

Perhaps not the best or even an ideal way of doing things but it does work.

EDIT TO ADD: If you do use the referral link in the post above and make a qualifying purchase I will know what email address you signed up with, no way of tying it back to you but wanted to put it out there.
Although LeoRockz@aol.com might point back to someone :-)

-Dave

[o_e_l_e_o]

And even if there is an 'upper limit' of the addresses they will give you all you need is another email and you can start the process again.

Probably worth pointing out that using more than one account is against their terms and you risk getting hit with KYC demands, which obviously defeats the whole purpose here:

Any Customer using more than one Bitrefill account, or any other expedient, in order to circumvent the limits below, is in breach of these Terms and can have its account, or accounts, suspended until customer due diligence is successfully completed.

Also, do they have a minimum deposit amount or do they charge a processing fee? I can't imagine they would be too thrilled by receiving dozens of 1000 sat outputs and having to consolidate them all.

Although LeoRockz@aol.com might point back to someone :-)

Drat! I've been doxxed! Time to abandon this account I guess.

[n0nce]

Reused change addresses not only allow tracing what you're doing with the change but also tracing what you're doing with the rest of your BTC. Let's say I'm a merchant and you pay me some BTC; I can look at the change address and see other deposits. I can follow the transactions of these deposits and see that you also sent BTC to other (known or unknown) addresses; which could be exchanges (authorities can call them and ask 'who is the human behind address X'), stores or friends of yours that I now know you have some sort of connection to.

True, but doesn't this answer on why you shouldn't keep change at all? As said by Leo above, whenever you're going to have a decent change left over from a transaction, send them to ChipMixer instead. Or, if you're thinking of buying in bulk, make your purchase and send the rest to ChipMixer.

What I said is: If you have change in x outputs, which are essentially linked from your previous transactions, it doesn't matter that much to broadcast 1 transaction where you spend them all, or x transactions where you spend 1 in each.

Oh, the issue with this is that I assumed the change doesn't all land in the same address. I'm not sure if there's a standard way; as far as I know, change is handled a bit differently from one wallet to another.

<…>

The biggest downside of this method is that your account may be frozen after you made a deposit and you will no longer be able to withdraw your funds or consolidate them unless by sacrificing your privacy by providing your real identity. If you still consider exchanges a means to merge your small inputs, a simpler solution would be using a nice bitcoin-only gambling website like bustadice where, as you said, you need nothing but an email address to sign up and where it is highly unlikely that you will be asked for documents. If you like, you can gamble with part of the funds to further obscure the link between your initial amount and your withdrawal amount.

Well, those gambling sites could also close your account, though. So I see no benefit there; the moment you use a centralized party, there is going to be some risk involved.

Also, and since I do like the service you can use Bitrefill and buy gift cards if it's available where you are located.
~ snip ~

I really like this idea; these gift cards come in handy anyway from time to time; even as a small birthday gift or simply to purchase something on Amazon. I've only used the service through Lightning so far and didn't know you can also create an account and top it up little by little.

So you just got tons of 0.001BTC chips from ChipMixer and used them in full when paying something? Wouldn't that make for pretty large (and expensive) transactions? Or would you create and withdraw appropriately sized chips / UTXOs on the spot?

Let's say I deposited 0.1 BTC to ChipMixer. I then wanted to pay for something which was 0.0207 BTC. I would withdraw a 0.016, 0.004, and 0.001 chip, pay the merchant 0.021 BTC (not minding that I just overspent by 50 cents or so) and leave the other 0.079 BTC on ChipMixer as a voucher until I next needed it. No change created. But as I said before, this isn't really economical anymore since the lost 50 cents in this example is now ~$10.

This implies you fully entrust those remaining 0.079 BTC to CM though; not that I'd ever doubt them, but in general I try to minimize such trust. It could be that there is a problem with the website and I can't access it right when I need to or similar sorts of issues, but otherwise it seems like a viable option if the Bitcoin price was a bit lower or the smallest chip size was reduced.

I tried to bring this idea up but wasn't sure how to correctly phrase it. Sending multiple outputs to a single CM mix, individually, will keep them completely unlinked, right?

Well, a single ChipMixer session provides a single deposit address, so no, it would link all the outputs. The way to do it is to deposit any UTXOs you don't mind being linked in a single session, withdraw a voucher for the total amount of your deposit, and then destroy that session. Repeat with another sessions with another set of UTXOs and withdraw another voucher. Repeat as many times as necessary - you can do as little as one deposit per session if you want (bearing in mind the minimum deposit limits). Once you have multiple vouchers, you can open yet another new session and combine all the vouchers together, and then make a single large withdrawal.

Yup, makes sense; so basically restore the session for each output as long as the output's size is large enough; link smaller outputs by submitting them during one session to reach the minimum size.. You'll maybe pay a bit more though, since every time you create a new session and deposit some coins, they'll be 'truncated' to 0.001 amounts, right?

Although LeoRockz@aol.com might point back to someone :-)

Drat! I've been doxxed! Time to abandon this account I guess.

It's been nice knowing you!

[BlackHatCoiner]

Oh, the issue with this is that I assumed the change doesn't all land in the same address. I'm not sure if there's a standard way; as far as I know, change is handled a bit differently from one wallet to another.

Oh, wait, you meant literal reuse of the change address? Which wallet does such thing?