CoinJoin and Payjoin

Why CoinJoin

Bitcoin transactions are public and traceable. Chain-analysis firms cluster addresses using two heuristics:

1. Common-input ownership: all inputs to a transaction are assumed to belong to one spender.
2. Change detection: outputs are bucketed into "spend" vs "change" by amount and script-type heuristics.

CoinJoin defeats heuristic 1 by having multiple unrelated spenders construct one transaction together. Done well (equal-amount outputs, multiple rounds, no input/output linkability) it pushes chain analysts back to off-chain signals: KYC at fiat on-ramps, IP correlation, address reuse.

How it works

        Alice's input ──┐
        Bob's input ────┼──► Joint TX ──┬──► 0.1 BTC (Alice'?)
        Carol's input ──┘               ├──► 0.1 BTC (Bob'?)
                                        ├──► 0.1 BTC (Carol'?)
                                        └──► change outputs

All inputs are signed by their owners; signatures are valid only when all inputs are present. Each participant verifies that their own output is included before signing. The coordinator (which can itself be untrusted) handles registration, blind-signs output addresses, and broadcasts the final tx.

Generations of CoinJoin

1. Joinmarket (2015–)

Order book of makers (always available, paid a small fee) and takers (initiating the join). Decentralized, no central coordinator. Trade-off: complex peer discovery, Sybil-prone fee market.

2. Wasabi 1.0 (ZeroLink, 2018)

Coordinator-driven, equal-output (0.1 BTC denomination), Chaumian-blinded outputs so the coordinator never sees who owns what. Around 100 participants per round.

3. Wasabi 2.0 / WabiSabi (2022)

WabiSabi (Keyless Anonymous Credentials Scheme) replaced equal-output denominations with arbitrary-amount mixing using zero-knowledge anonymous credentials. Effects:

• Variable amounts, much wider anonymity sets (no longer limited to a 0.1 BTC bucket).
• More efficient per user (one transaction can mix many denominations).
• The coordinator can charge fees without seeing user identity.

4. Whirlpool (Samourai, 2019–2024)

Equal-output (5 denominations) with Tor-only registration. Strict no-link between rounds. Operationally separate from Wasabi. Status: a US DOJ enforcement action in April 2024 effectively shut down operations; users moved to alternatives.

5. Joinstr (2023–)

Nostr-based coordinator-less CoinJoin. Uses Nostr relays for coordination; PSBT exchange happens over Nostr DMs. Early-stage but interesting for sovereignty: there is no single party to coerce.

6. Payjoin (BIP-78, 2020–)

A two-party CoinJoin between sender and receiver. The receiver contributes their own inputs to the payment, breaking the common-input heuristic for that single transaction without needing a coordinator or anonymity set.

Without Payjoin:
   Alice (1.0) ──► Bob (0.5) + Alice change (0.5)
   Heuristic: input is Alice's. Smaller output is change.

With Payjoin:
   Alice (1.0) + Bob (0.3) ──► Bob (0.8) + Alice change (0.5)
   Heuristic now thinks: 1.3 BTC spender owns both inputs. Wrong.

Payjoin doesn't need a coordinator. The receiver runs a small endpoint. It disrupts the common-input-ownership heuristic, but additional inputs and outputs can increase transaction weight and fees.

Privacy math

For an equal-output CoinJoin with n participants, the per-output anonymity set is n for that round. Multi-round mixing (Whirlpool, Wasabi 2.0 cascades) compounds: 3 rounds × 100 users = 1M combinations.

But:

• Address reuse kills it instantly.
• Spending unmixed change with mixed coins re-links them (the "change link" attack).
• Unique amount fingerprints in subsequent spends can re-link.
• Coordinator-side timing analysis can correlate registration to broadcast.
• Exchange and merchant deposits identify individual outputs.

Wallet hygiene matters as much as the join itself.

Tools

Trade-offs

Strengths

• On-chain privacy without a separate chain. Stays under Bitcoin's settlement guarantees.
• No trusted coordinator. Modern coordinators are blind; even compromised coordinators cannot link.
• Composable with Lightning, hardware wallets, and exchange withdrawals.

Limitations

• Fee cost. CoinJoin transactions are larger and pay coordinator fees.
• Slow. Wasabi rounds take minutes; JoinMarket can take longer waiting for makers.
• Operational pitfalls. One mistake (address reuse, mixing with KYC'd coins) collapses the privacy gain.
• Regulatory exposure. Several jurisdictions and exchanges flag CoinJoin outputs; chain-analysis vendors tag mixing transactions.
• Anonymity set is not anonymity. A 100-person set narrows further with off-chain context.

Attack surface

Operational recipe

1. Withdraw from a KYC source to a fresh address.
2. CoinJoin (multiple rounds) via Wasabi 2.0 or Joinmarket.
3. Spend mixed UTXOs only; never co-spend with non-mixed UTXOs.
4. For payments to merchants, prefer Lightning (next-best privacy) or Payjoin if accepted.
5. Avoid exchange round-trips that link mixed back to KYC.

Primary sources

• Maxwell: CoinJoin, Bitcoin privacy for the real world
• ZeroLink: The Bitcoin Fungibility Framework
• WabiSabi: Centrally Coordinated CoinJoins with Variable Amounts
• BIP 78: Payjoin
• Joinstr documentation
• JoinMarket implementation

For related payment-privacy choices, see Silent Payments for reusable Bitcoin addresses, Zcash for shielded pools, and BTCPay Server for running a payment processor. The P2P acquisition comparison covers custody and identity disclosure when obtaining bitcoin.