CoinJoin

Anna pays for a service and does not want the recipient to easily trace her other funds. But Bitcoin has no private bank statement: its transaction history is public. A transaction spends earlier unspent outputs, called UTXOs, and creates new ones. An output records an amount and the conditions for spending it. When an ordinary payment uses several such outputs, an analyst often assumes one person controls them. That is a useful guess—a heuristic—not proof. CoinJoin breaks the assumption by bringing several owners into one transaction. It does not rewrite the past; it changes how confidently relationships can be inferred from public records. [1]

In a simplified example, Anna and Pavel each have an output worth 100 500 sat. Sat stands for satoshi, bitcoin’s smallest unit. They arrange a transaction giving each a new output of 100 000 sat; the remaining 1 000 sat is the shared network fee. This teaching example excludes additional service fees. A coordinator or the communicating wallets prepares a proposal. A digital signature is a verifiable authorization made with a private key, the secret data that gives its holder the ability to sign. The key itself is not disclosed. Each person checks their own output address, amount, fees and the complete conditions before signing their inputs. The coordinator alone has neither the keys nor permission to spend someone else’s funds. If a required signature never arrives, this transaction cannot be validly completed. That protection assumes correct software and verification of the proposal: signing a payment to a fraudster’s address would defeat it. [1] [5]

In the example, someone looking only at the blockchain sees two new outputs of equal value. The amount alone does not reveal which belongs to Anna and which to Pavel. That does not automatically mean one-in-two odds or guaranteed anonymity: the observer may know one address or have another clue. In real transactions, recognizable change, different amounts, output types or timing can help identify the links. The anonymity set means the candidates an observer cannot distinguish, not simply the number of people registered for a round. A wallet’s score is an estimate under a particular model, not a promise about what every observer knows about you. [1] [4]

Being able to steal money and being able to learn something are different powers. A simple coordinator may know the input-to-output links; other protocols hide them using cryptographic techniques. Network information, such as IP addresses and connection times, also matters. Another problem is a Sybil Attack: one adversary appears as many participants, knows their own outputs and reduces uncertainty about the remaining ones. A participant can also refuse to sign and disrupt the whole round. That makes the specific participation rules and defenses against flooding or sabotage, known as DoS, important. A large input count alone does not settle these questions. [1] [4]

Anna later combines her new output with funds withdrawn from an exchange that knows her identity. This may give an observer a fresh link where she had tried to create ambiguity. Reusing addresses or combining several outputs into one—a consolidation—can have a similar effect. Coin Control lets you choose which UTXOs the wallet spends, helping keep different contexts separate. It is not a button for absolute privacy. A recipient may know the payer, and a service may keep its own records. Privacy therefore remains a concern after a successful round; it is not just a property of one transaction’s shape. [5]

First identify which information you want to protect, and from whom. A curious recipient, the coordinator and a network observer do not have the same capabilities. Then check who holds the keys, what the application signs, what costs it charges and how it handles the resulting outputs. A service to which you first send funds for custody has a different trust model from non-custodial CoinJoin. CoinJoin adds no special Bitcoin rule: nodes verify an ordinary transaction and its conditions. A node is a computer running software that checks Bitcoin transactions and blocks. CoinJoin does not remove an exchange’s or recipient’s records, or promise how a particular service will treat a payment. Understanding those boundaries helps a beginner more than an ‘anonymous’ label in an application. [1] [5]

Gregory Maxwell publicly explained CoinJoin in August 2013. The idea required no network rule change, but people still needed a way to find one another and cooperate. JoinMarket demonstrated a market approach: the person organizing a joint transaction pays others to make funds available for participation. Coordinated protocols organize this differently. WabiSabi, for example, supports varying amounts and anonymous credentials that let a participant demonstrate entitlement to outputs without simply revealing their connection to inputs. CoinJoin therefore should not be equated with a single application, nor should every variant be assumed to require only equal outputs. [1] [2] [4]

Maxwell’s post explains the basic idea, a particular wallet’s documentation describes its workflow, and the WabiSabi research paper describes protocol properties. These are different layers of evidence. At this review, the original JoinMarket client/server repository is archived; it serves here as historical and technical material, not an installation recommendation. PayJoin under BIP 78 is a related collaboration between payer and recipient in which both contribute inputs. It generally does not target a large group of equal outputs. When comparing approaches, ask who cooperates, what they can learn and what the person and their wallet actually check before signing, rather than relying on the shared word ‘privacy’. [1] [2] [3] [4] [5] [6]