Can Coinjoin transactions be traced? Busting Bitcoin privacy myths!

[Kruw]

I don't know what ur getting at, but every Blockchain transactions can be traced

That's the myth I'm busting.

[Kruw]

Postmix transactions can be traced to premix funds when outputs from child rounds of the same premix transaction are consolidated. Consolidation of mixed outputs from the initial round may be unavoidable since users do not have control over whether or not they remix:

The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.

The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

Analysis of input-output mappings in coinjoin transactions with arbitrary values by Jiri Gavenda, Petr Svenda, Stanislav Bobon, and Vladimir Sedlacek (Masaryk University, Czechia): https://arxiv.org/pdf/2510.17284

[1440000bytes]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

[ABCbits]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

I only found these information which state different thing, where it seems he only earn from leftover satoshi. CMIIW.

[1440000bytes]

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

Filters and settings -> Since -> Click on the date and select 1 October 2025

[ABCbits]

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

Filters and settings -> Since -> Click on the date and select 1 October 2025

Thanks for pointing it out.

In rare cases the output decomposition contains change (maximum of 10 000 sats per coinjoin), this leftover goes to the coordinator. This is because creating such small amounts would harm privacy and ends up being more expensive than just forfeiting it.

Despite the documentation says, it seems it's not as rare as people may expect and total of left over satoshi would be that much.

[BlackHatCoiner]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

Good finding. It turns out that running a coordinator can be a very profitable business.

Despite the documentation says, it seems it's not as rare as people may expect and total of left over satoshi would be that much.

I think the documentation is addressing the user. I've rarely experienced this output decomposition going to the coordinator, but if a hundred people join a round, it's natural that a fraction of them will pay. I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

[1440000bytes]

I think the documentation is addressing the user. I've rarely experienced this output decomposition going to the coordinator, but if a hundred people join a round, it's natural that a fraction of them will pay. I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

Multiple inputs can belong to the same user so you don't need 100 users for a coinjoin and most users do multiple rounds.

[lontivero]

Hey, Wasabi maintainer here. Let me address this point about the service because I think it is important and it is not always clear for users.

Wasabi coordinators are FREE in the sense that they have no way to charge users any fee for the service. Wasabi has to deal with potentially malicious coordinators run by unknown actors and for that reason, unlike the original version, having a mechanism for them to take money from users is too much risk. That's why the protocol doesn't have a concept for a coordination fee, which means that neither the client nor the coordinator understand what a coordination fee is.

A coordinator operator provides a service without having any chance to charge any fee and without having any way to exclude anyone for not paying/tipping. That's why even when in English the word "free" is a bit overloaded and we don't use it in our documentation, in this context it could be acceptable to say that the service is free.

In the old days of Wasabi when the service was provided by a company that had a mechanism to charge users a coordination fee and exclude those who refused to pay, the decomposition leftovers were paid as mining fees. In other words, after registering the output with all the coordination fees, the rest went to miners. Again, what is currently taken by coordinators was previously left to miners.

The question then is not whether it is free or not but whether it is run altruistically or not. You can run a coordinator, and even when you cannot charge any fee, you can still have an expectation to get some money, and that's not bad. After all, coordinators need to pay for hosting, certificates, maintain a web page, and ensure the system works. However, coordinator runners know that the chances of getting any money are extremely low for a very long time until it gets some traction, if any. And still, there are coordinators that have been running for many, many months and have earned 0 (zero) sats. So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

[Kruw]

I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

This was a configurable option in the BTCPay Server implementation. I have an open issue about adding this option to Wasabi Wallet - https://github.com/WalletWasabi/WalletWasabi/issues/13752

You can run a coordinator, and even when you cannot charge any fee, you can still have an expectation to get some money, and that's not bad.

Hmm is lontivero actually satoshi?? 

If you're sad about paying the fee, you could always turn the tables and run a node yourself and maybe someday rake in a 0.44 fee yourself.

[1440000bytes]

So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

It is neither free nor altruistic. In fact, everyone associated with Wabisabi seems to be dishonest.

[lontivero]

So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

It is neither free nor altruistic. In fact, everyone associated with Wabisabi seems to be dishonest.

It is dishonest to launch accusations without any argumentation. I have exposed my reasoning explaining why I think it is okay to say that it is free. What you do is not okay.

[Kruw]

Archimedes proved you could bound the uncountable.

WabiSabi Coinjoins flip this, creating so many possible interpretations (2^600) that exact calculation is impossible.

Why that's a feature, not a bug, and why "trust me bro" critics misunderstand information theory.

https://primal.net/maxhillebrand/3ed5c94fdc678620

[BlackHatCoiner]

[...]

I remember I had attempted to compute the Boltzmann score of one of your coinjoins. The program never finished. 

[Kruw]

Is there any particular reason why taproot addresses are preferred over segwit?

You're not going to like the answer, lol. It's a bug: The ratio should be ~50/50

This may be the answer? https://github.com/orgs/WalletWasabi/discussions/14024#discussioncomment-15707912