Privacy & Anonymity

Pseudonymity, chain analysis, and CoinJoin — the reality of Bitcoin privacy and how to protect it.

4 min readLast updated: August 15, 2026

Key points

Bitcoin is pseudonymous, not anonymous — this article explains how chain-analysis techniques like the common-input-ownership heuristic can trace transactions, alongside privacy-enhancing technologies such as CoinJoin, Taproot, and Silent Payments. It also covers the growing regulatory pressure on privacy tools since 2024, including the arrests of Samourai Wallet's operators and the conviction of Tornado Cash developer Roman Storm.

Pseudonymous, Not Anonymous

Bitcoin is often mistakenly called "anonymous," but it's more accurately described as "pseudonymous." Every transaction is permanently recorded on the blockchain, and if an address is linked to an individual, their entire transaction history becomes traceable.
Bitcoin addresses are like usernames on the internet. No name is written on them, but all activity under the same address is linked together.
Once an address is connected to a real identity (through exchange KYC, public donation addresses, etc.), it becomes technically possible to trace all past and future transactions from that point.

Chain Analysis Techniques

Common-Input-Ownership Heuristic: When a transaction has multiple inputs, they're assumed to belong to the same entity. This is the most fundamental and powerful chain analysis technique.
Change Address Detection: When you send Bitcoin, the leftover returns as "change." Identifying this change address reveals wallet ownership. Amount patterns, address format differences, and wallet software fingerprints all serve as clues.
Amount & Timing Correlation: Searching the blockchain for specific amounts or timestamps narrows down transaction parties.
Through "data fusion" — combining these techniques — individually trivial information leaks compound into severe privacy breaches.

The Danger of Address Reuse

Address reuse is one of the biggest threats to privacy. Using the same address repeatedly links all associated transactions to a single entity.
"Forced address reuse attacks" also exist: attackers deliberately send small amounts to already-used addresses, hoping wallet software will spend them alongside other coins, exposing additional addresses through the common-input-ownership heuristic.
The solution is simple: use a new address for every transaction. Modern wallet software (HD Wallets, BIP-32) does this automatically.

Privacy-Enhancing Technologies

CoinJoin: Combines multiple users' transactions into one, breaking the common-input-ownership heuristic. Implemented in Wasabi Wallet and JoinMarket.
PayJoin (P2EP): Both sender and receiver contribute inputs to the transaction. External observers cannot determine which addresses belong to which party.
Lightning Network: Off-chain transactions minimize on-chain footprint. Onion routing prevents even intermediate nodes from knowing the sender and recipient.
Tor / VPN: Routing Bitcoin node traffic through the Tor network prevents IP address leaks.

Privacy Best Practices

Run a full node: Verifying and broadcasting transactions through your own node prevents third-party servers from learning your balance and transaction patterns.
New address per transaction: Use HD Wallets (BIP-32/44) and generate a fresh address for every receipt.
Coin control: Manually select UTXOs in your wallet to prevent mixing coins from different sources.
Minimize KYC: Exchange KYC permanently links addresses to real names. Keep KYC to the minimum required, and move funds to new addresses after withdrawal.
Privacy begins with defining "who you're hiding from." Define your threat model and implement appropriate countermeasures.

Taproot and the Evolution of Privacy

Taproot (BIP-340/341/342), activated in 2021, significantly improved Bitcoin's privacy.
Schnorr signatures make multisig transactions indistinguishable from regular transactions. A 3-of-5 multisig looks identical to a single-signature transaction.
MAST (Merkelized Alternative Script Trees) ensures that unused script branches aren't revealed on the blockchain. Even complex smart contracts only expose the executed path.
These improvements make chain analysis more difficult and raise the privacy floor for all users. The more Taproot is adopted, the greater its effect.

Regulatory Pressure on Privacy Wallets (2024–2026)

April 2024: U.S. DOJ indicted two operators of Samourai Wallet for "unlicensed money transmission" and "money laundering conspiracy." The operation of their CoinJoin mixing service "Whirlpool" was central to the charges.
Same month: Wasabi Wallet (operated by ZKSNACKs) withdrew its service from the U.S. market.
August 2023: Tornado Cash (Ethereum mixer) developer Roman Storm was indicted and arrested — bringing the legal risk of developing privacy tooling itself into sharp focus. A 2025 jury found him guilty of conspiracy to run an unlicensed money-transmitting business while deadlocking on the money-laundering and sanctions counts.
These events established the dramatic precedent that open-source developers of privacy tools may face criminal liability.
As of 2026, legally available non-custodial CoinJoin services have significantly diminished. Migration to Bitcoin-native privacy features (Taproot, MuSig2, Silent Payments, etc.) is accelerating.

Silent Payments & Next-Generation Privacy (BIP-352)

Silent Payments (BIP-352) is a new protocol that fundamentally solves the address-reuse problem for the receiver.
The receiver publishes a "Silent Payment Address" (prefixed sp1q...). The sender derives a different regular Bitcoin address (uniquely identifiable only by the receiver) mathematically from this silent address on each transaction.
Result: each on-chain transaction targets a fresh address — making chain analysis linking back to the receiver infeasible.
2024-2026: Implementations have rolled out in Sparrow Wallet, Cake Wallet, and others, with Bitcoin Core support still in development. Use cases include donations and e-commerce payments — any setting where the same payee receives multiple transfers.
Silent Payments does not require any Bitcoin protocol change and is achieved at the application layer, enabling gradual adoption.

Privacy & Anonymity

Pseudonymous, Not Anonymous

Chain Analysis Techniques

The Danger of Address Reuse

Privacy-Enhancing Technologies

Privacy Best Practices

Taproot and the Evolution of Privacy

Regulatory Pressure on Privacy Wallets (2024–2026)

Silent Payments & Next-Generation Privacy (BIP-352)

Primary sources

Read next

Related Topics

Citation / 引用情報