Can Coinjoin transactions be traced? Busting Bitcoin privacy myths!

[Kruw]

I don't know what ur getting at, but every Blockchain transactions can be traced

That's the myth I'm busting.

[Kruw]

Postmix transactions can be traced to premix funds when outputs from child rounds of the same premix transaction are consolidated. Consolidation of mixed outputs from the initial round may be unavoidable since users do not have control over whether or not they remix:

The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.

The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

Analysis of input-output mappings in coinjoin transactions with arbitrary values by Jiri Gavenda, Petr Svenda, Stanislav Bobon, and Vladimir Sedlacek (Masaryk University, Czechia): https://arxiv.org/pdf/2510.17284

[1440000bytes]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

[ABCbits]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

I only found these information which state different thing, where it seems he only earn from leftover satoshi. CMIIW.

[1440000bytes]

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

Filters and settings -> Since -> Click on the date and select 1 October 2025

[ABCbits]

Do you mind explaining how Kruw get 0.2BTC per month according to that website?

Filters and settings -> Since -> Click on the date and select 1 October 2025

Thanks for pointing it out.

In rare cases the output decomposition contains change (maximum of 10 000 sats per coinjoin), this leftover goes to the coordinator. This is because creating such small amounts would harm privacy and ends up being more expensive than just forfeiting it.

Despite the documentation says, it seems it's not as rare as people may expect and total of left over satoshi would be that much.

[BlackHatCoiner]

Can you remove the misleading message from your signature that says "Coinjoin for FREE" when you are earning ~0.2 BTC per month with the https://coinjoin.kruw.io/ coordinator?

Good finding. It turns out that running a coordinator can be a very profitable business.

Despite the documentation says, it seems it's not as rare as people may expect and total of left over satoshi would be that much.

I think the documentation is addressing the user. I've rarely experienced this output decomposition going to the coordinator, but if a hundred people join a round, it's natural that a fraction of them will pay. I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

[1440000bytes]

I think the documentation is addressing the user. I've rarely experienced this output decomposition going to the coordinator, but if a hundred people join a round, it's natural that a fraction of them will pay. I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

Multiple inputs can belong to the same user so you don't need 100 users for a coinjoin and most users do multiple rounds.

[lontivero]

Hey, Wasabi maintainer here. Let me address this point about the service because I think it is important and it is not always clear for users.

Wasabi coordinators are FREE in the sense that they have no way to charge users any fee for the service. Wasabi has to deal with potentially malicious coordinators run by unknown actors and for that reason, unlike the original version, having a mechanism for them to take money from users is too much risk. That's why the protocol doesn't have a concept for a coordination fee, which means that neither the client nor the coordinator understand what a coordination fee is.

A coordinator operator provides a service without having any chance to charge any fee and without having any way to exclude anyone for not paying/tipping. That's why even when in English the word "free" is a bit overloaded and we don't use it in our documentation, in this context it could be acceptable to say that the service is free.

In the old days of Wasabi when the service was provided by a company that had a mechanism to charge users a coordination fee and exclude those who refused to pay, the decomposition leftovers were paid as mining fees. In other words, after registering the output with all the coordination fees, the rest went to miners. Again, what is currently taken by coordinators was previously left to miners.

The question then is not whether it is free or not but whether it is run altruistically or not. You can run a coordinator, and even when you cannot charge any fee, you can still have an expectation to get some money, and that's not bad. After all, coordinators need to pay for hosting, certificates, maintain a web page, and ensure the system works. However, coordinator runners know that the chances of getting any money are extremely low for a very long time until it gets some traction, if any. And still, there are coordinators that have been running for many, many months and have earned 0 (zero) sats. So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

[Kruw]

I don't understand why the wallet software does not allow the user to claim that output with an anonymity score of 1.

This was a configurable option in the BTCPay Server implementation. I have an open issue about adding this option to Wasabi Wallet - https://github.com/WalletWasabi/WalletWasabi/issues/13752

You can run a coordinator, and even when you cannot charge any fee, you can still have an expectation to get some money, and that's not bad.

Hmm is lontivero actually satoshi?? 

If you're sad about paying the fee, you could always turn the tables and run a node yourself and maybe someday rake in a 0.44 fee yourself.

[1440000bytes]

So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

It is neither free nor altruistic. In fact, everyone associated with Wabisabi seems to be dishonest.

[lontivero]

So, I think it is okay to say that the service is provided for free, and it is also correct to say that they are run in pursuit of an altruistic goal.

It is neither free nor altruistic. In fact, everyone associated with Wabisabi seems to be dishonest.

It is dishonest to launch accusations without any argumentation. I have exposed my reasoning explaining why I think it is okay to say that it is free. What you do is not okay.

[Kruw]

Archimedes proved you could bound the uncountable.

WabiSabi Coinjoins flip this, creating so many possible interpretations (2^600) that exact calculation is impossible.

Why that's a feature, not a bug, and why "trust me bro" critics misunderstand information theory.

https://primal.net/maxhillebrand/3ed5c94fdc678620

[BlackHatCoiner]

[...]

I remember I had attempted to compute the Boltzmann score of one of your coinjoins. The program never finished. 

[Kruw]

Is there any particular reason why taproot addresses are preferred over segwit?

You're not going to like the answer, lol. It's a bug: The ratio should be ~50/50

This may be the answer? https://github.com/orgs/WalletWasabi/discussions/14024#discussioncomment-15707912

[Kruw]

Please note that these descriptions target the protocol level, wallet level implementation details are not applicable to these explanations

...

- Can payjoins be traced?

Not from the outside. However, the disadvantage of payjoins compared to other coinjoins is that the sender and receiver are completely aware of the coins owned by the other participant, which introduces a trusted single point of failure.

Here's a great example of why the scope of my descriptions does not include wallet level implementation details: This article explains methods for fingerprinting payjoins - https://payjoin.org/blog/2026/03/25/wallet-fingerprints-payjoin-privacy/

[Kruw]

Analysis of input-output mappings in coinjoin transactions with arbitrary values by Jiri Gavenda, Petr Svenda, Stanislav Bobon, and Vladimir Sedlacek (Masaryk University, Czechia): https://arxiv.org/pdf/2510.17284

CoinJoin ecosystem insights for Wasabi 1.x, Wasabi 2.x and Whirlpool coordinator-based privacy mixers by Petr Svenda + Jiri Gavenda (Masaryk University, Czechia) and Vasilios Mavroudis + Chris Hicks (The Alan Turing Institute): https://petsymposium.org/popets/2026/popets-2026-0061.pdf

[Kruw]

WabiSabi -> ZeroLink -> WabiSabi is better than WabiSabi alone: https://github.com/orgs/WalletWasabi/discussions/14798

[BlackHatCoiner]

WabiSabi -> ZeroLink -> WabiSabi is better than WabiSabi alone: https://github.com/orgs/WalletWasabi/discussions/14798

In your step 2, you write:

2. Use ZeroLink to consume the standard denomination outputs in 1 input-1 output rounds that don't create any toxic change

I presume what you mean is that the user has some standard denominations from the former WabiSabi coinjoin, and that he uses each of these private coins as inputs for 1-input 1-output ZeroLink rounds. But how is this complicated process more desired? If the user joins a ZeroLink round, he will have to break the standard denominations into smaller ones to be able to pay the mining fee, and then joins another WabiSabi round. Why not just join a WabiSabi round twice? I do not see any monetary benefit, neither a privacy.

[Kruw]

I presume what you mean is that the user has some standard denominations from the former WabiSabi coinjoin, and that he uses each of these private coins as inputs for 1-input 1-output ZeroLink rounds. But how is this complicated process more desired? If the user joins a ZeroLink round, he will have to break the standard denominations into smaller ones to be able to pay the mining fee, and then joins another WabiSabi round. Why not just join a WabiSabi round twice? I do not see any monetary benefit, neither a privacy.

This was my initial thought as well. I had previously claimed that ZeroLink was obsolete, under the impression that WabiSabi was a desirable replacement for every scenario. However, WabiSabi COMBINED with ZeroLink wins out for several cases. Each protocol fills a gap that the other one suffered from:

ZeroLink Only:

- Inputs do not have uniform matching values, creates toxic change
- Inputs can't be consolidated without leaking common ownership
- Multiples of the base output denomination are created for whales
- Gathering liquidity and remixing is difficult
- Change from postmix payments create a privacy dead end

WabiSabi Only:

- The round's inputs are not revealed until output registration starts, reducing efficiency
- Batched payments are not guaranteed to be private, and marginally reduce the efficiency for other participants
- More costly than ZeroLink and Payjoin, 600-700 vBytes per tx
- Discards ~100 sats in dust per round to avoid toxic change
- Marginally worse DoS protection than ZeroLink Only

WabiSabi + ZeroLink:

- Inputs have uniform matching values, and do not create toxic change
- No consolidation occurs in rounds, 1 input per user
- No denomination multiples are created for whales, 1 output per user
- No additional block space is consumed to store arbitrary values in multiple outputs (only 100 vBytes per tx), and no dust is discarded
- Gathering liquidity is automatic and remixes are cost minimized
- Change outputs from postmix payments are never created when spending ZeroLink outputs with WabiSabi
- A ZeroLink round can be run in descending/ascending order (or flushes after some UTXO threshold trigger) using each WabiSabi denomination as input amounts, improving amount flexibility
- ZeroLink's DoS protection is enhanced by only whitelisting WabiSabi/JoinMarket outputs for ZeroLink's inputs, since this requires a sunk mining fee cost for attackers, fixing this problem:

I know you didn't mention it, but I disagree with this conclusion in section 7 of the WabiSabi paper:

Denial of service is not costless because unspent transaction outputs are a limited resource.

This is incomplete because the marginal cost of a DoS attack is zero if you are going to spend your UTXO anyways.

Anyways, I will now close this thread since its concept has been superseded: https://bitcointalk.org/index.php?topic=5588773.0