CoinJoin

A transaction is only a list of inputs and a list of outputs, and nothing in the data says which paid which. Gregory Maxwell published the idea on August 22, 2013, and working code followed within days. What a coinjoin buys is ambiguity rather than invisibility, and it can create friction with exchanges when the coins come back.

How it works

Chain analysis leans on one assumption above all others: inputs signed into the same transaction belong to the same person. A coinjoin makes that assumption produce a wrong answer on purpose.

Several participants each contribute one or more inputs and each request an output of an identical size. Every participant signs only their own inputs, so nobody can steal from anybody, and if a participant walks away before signing, the transaction simply never happens. When it is broadcast it looks like one payment with many inputs and many equal outputs, and an analyst reading the chain has no way to pair them up. With five equal outputs, each one has five plausible owners; run the result through further rounds and the candidate set multiplies.

Two pieces of plumbing make it usable. A coordinator collects registrations and assembles the transaction, and blind signatures keep even the coordinator from learning which requested output goes with which input. Wasabi's WabiSabi protocol extended that to arbitrary amounts using credentials rather than fixed denominations.

The awkward part is leftovers. If you enter with 0.013 BTC and the pool denomination is 0.01, the extra 0.003 comes back as change that is provably linked to your input. Privacy people call it toxic change, and treating it as unrelated to the mixed output is the mistake that undoes the whole exercise. The same discipline applies afterwards: spend two mixed outputs together and you have re-linked them yourself.

Why this matters when you buy bitcoin

Coinjoin tooling shrank sharply in 2024, and any honest page has to lead with that. On April 24, 2024 the US Department of Justice charged the two founders of Samourai Wallet, whose Whirlpool service was the most-used bitcoin coinjoin implementation, with conspiracy to operate an unlicensed money transmitting business and money laundering. Whirlpool and its companion service Ricochet had processed more than 80,000 BTC, over 2 billion dollars at the time of the transactions. Both men pleaded guilty in July 2025 to the unlicensed transmitter count and were sentenced in November 2025, Keonne Rodriguez to five years and William Hill to four. Days after the arrests, zkSNACKs blocked US users from Wasabi's coordinator and shut it down entirely on June 1, 2024.

The regulatory direction was already set. In October 2023, FinCEN proposed a rule designating cryptocurrency mixing as a class of transactions of primary money laundering concern under section 311 of the USA PATRIOT Act, which would impose reporting duties on US financial institutions that touch mixed funds. That is aimed at institutions, not at individuals, but it explains why exchanges have grown cautious.

For someone buying bitcoin the practical consequences are concrete. Every large venue reviewed on this site verifies identity, and several run blockchain analytics on deposits, so sending coins with recent coinjoin history straight back to an exchange account in your name can trigger a review, a request for source-of-funds documents, or a frozen withdrawal. Legality also varies across the 231 country guides here: owning and moving your own bitcoin is legal in most of them, while operating a mixing service is a licensing question in many and a criminal one in some.

Most people asking about coinjoin do not actually need it. The privacy leaks that affect ordinary buyers are address reuse, careless input selection, and posting an address publicly. Fix those first, with a fresh address per payment and coin control on every send, and you will have closed the gaps that analytics firms rely on most.

Anatomy of a five-way round

Whirlpool is worth describing precisely, because it was the design most bitcoiners actually used. It ran four fixed pools of 0.001, 0.01, 0.05, and 0.5 BTC, and each round was a transaction with five inputs and five outputs.

Take the 0.01 BTC pool. Five people register, the coordinator builds a transaction consuming their five inputs and paying five outputs of exactly 0.01 BTC, and everyone signs. Nobody watching can tell which of the five outputs was funded by which input, and the coordinator cannot either. A one-time entry fee of 5 percent of the pool denomination, 0.0005 BTC in this pool, bought unlimited free remixes afterwards, so an output could re-enter round after round and grow its candidate set each time.

The economics are the honest catch. A 5 percent entry fee on the smallest pool is meaningful money on a small stack, and the transaction itself carries mining fees like any other. Anyone treating a coinjoin as free is not counting.

CoinJoin vs payjoin

A coinjoin announces itself. Equal outputs and many inputs are a recognizable pattern, which is why analytics tools tag these transactions on sight, and why the tagging is what causes trouble with exchanges. A payjoin hides in plain sight instead: it is a real payment between two parties where the receiver quietly adds an input, so the result looks like an ordinary spend and simply misleads anyone measuring it. CoinJoin needs a coordinator, other participants, and a fee. Payjoin needs only a payment you were making anyway and a receiver whose software supports it.