Mixers, CoinJoin and obfuscation in graphs

Mixers and CoinJoin transactions are designed to break exactly the links that tracing depends on. Analysts meet them constantly: in thefts and ransomware cases, but also in the wallets of ordinary people who value financial privacy. You need to recognize each design in a graph, know what it really hides, apply the known weaknesses carefully, and report the result without overstating what the chain shows.

What obfuscation does to a graph

All mixing techniques aim to replace a deterministic edge (this output was spent by that transaction) with a set of equally plausible candidates. The size of that set is the anonymity set: the number of participants, deposits or outputs among which a given coin could be. Three families exist:

CoinJoin patterns

A CoinJoin is a single Bitcoin transaction built by several users, each contributing inputs and receiving outputs. Because all outputs of the same value look alike, an observer cannot tell which participant owns which. A fictional example in the style of a 0.05 BTC pool:

txid 8e21…a0f4   5 inputs, 5 outputs
in   0.05031200  bc1q…r8cw   (new coin, pays the mining fee)
in   0.05000000  bc1q…2ufj   (remix of an earlier mix output)
in   0.05000000  bc1q…kq7n   (remix)
in   0.05024600  bc1q…9fhe   (new coin)
in   0.05000000  bc1q…w3ld   (remix)
out  0.05000000  × 5 to five fresh bc1q addresses
fee  0.00055800

The signature is unmistakable: five equal outputs, five inputs from unrelated histories and no change output. The common-input ownership heuristic fails here, because the inputs belong to different people; clustering tools must detect CoinJoins and exclude them (see the lesson The common-input ownership heuristic).

The main designs differ in structure:

• Whirlpool (Samourai Wallet, also Sparrow): fixed pools of 0.001, 0.01, 0.05 and 0.5 BTC, typically five inputs and five equal outputs per mix. A preparatory transaction (tx0) splits a user's coin into pool-sized pieces and pays the fee, so leftover "change" appears in the tx0, not in the mix. Remixes are free, so coins often pass through many mixes.
• WabiSabi (Wasabi Wallet 2.x, from 2022): a coordinator uses anonymous credentials so that users can register inputs and outputs of varied amounts. Outputs fall on a set of standard denominations, rounds are large, and there are several groups of equal outputs rather than one.
• JoinMarket: no central coordinator. "Takers" pay "makers" a fee to join a CoinJoin on demand. Rounds are smaller, typically with one equal-output group plus change outputs for most participants.

Coordinators have changed over time. After the founders of Samourai Wallet were arrested in April 2024, its Whirlpool coordinator went offline, and the company behind Wasabi's default coordinator stopped its service on June 1, 2024. Other coordinators and forks continue, so date any statement about which designs are active.

Detecting CoinJoins in SQL is a matter of counting equal outputs:

WITH eq AS (                                    -- largest group of equal outputs per tx
  SELECT transaction_hash, value, COUNT(*) AS n_equal
  FROM outputs
  WHERE block_number BETWEEN 870000 AND 871000
  GROUP BY transaction_hash, value
)
SELECT t.hash, t.input_count, t.output_count, MAX(eq.n_equal) AS max_equal
FROM transactions t
JOIN eq ON eq.transaction_hash = t.hash
WHERE t.block_number BETWEEN 870000 AND 871000
GROUP BY t.hash, t.input_count, t.output_count
HAVING MAX(eq.n_equal) >= 5 AND t.input_count >= 5;

The CTE groups each transaction's outputs by value; the outer query keeps transactions with at least five inputs and at least five identical outputs. Expect false positives, such as exchange or mining-pool payouts of identical amounts (which usually have one or few inputs, hence the input condition), and false negatives for WabiSabi rounds, whose equal-output groups can be small. Production detectors add rules for known structures, such as the five-by-five shape typical of Whirlpool.

Centralized mixers

A centralized mixer is a custodial service: the user deposits coins, and after a delay the operator pays out the same amount minus a fee from a reserve of other people's coins, often split across several addresses and times. On-chain, the deposit goes into the mixer's cluster and the payouts come from unrelated coins, so the trail ends exactly as it does at an exchange (see the lesson Following value through exchanges and services). The operator, not the blockchain, holds the link, which is why takedowns matter: ChipMixer, which European authorities estimate laundered about 152,000 BTC from 2017, was taken down on March 15, 2023, and its servers and records were seized. Any custodial service with deposit and withdrawal functions can be abused the same way; in the Bitfinex 2016 case, analysts reported that a darknet market served as a makeshift mixer.

Smart-contract mixers

Tornado Cash, launched on Ethereum in 2019, is the best-known smart-contract mixer. Each pool accepts one fixed amount; the ETH pools take 0.1, 1, 10 or 100 ETH. A depositor sends that amount with a commitment, a hash of two secrets (a nullifier and a random value), which the contract adds to a Merkle tree and logs in a Deposit event. Later, the user withdraws to any address by submitting a zero-knowledge proof (a zk-SNARK) that they know the secrets behind some commitment in the tree, plus a nullifier hash that prevents the same deposit being withdrawn twice. A fresh withdrawal address has no ETH for gas, so a relayer can submit the withdrawal and take a fee from it; the Withdrawal event records the recipient, nullifier hash, relayer and fee.

The proof reveals nothing about which deposit is being withdrawn, so within a pool every earlier, unspent deposit is a candidate. The US Treasury, when it sanctioned the protocol in August 2022, said it had been used to launder more than $7 billion since 2019, including more than $455 million stolen by the Lazarus Group. The sanctions were lifted in March 2025 after a court ruling; the contracts never stopped working.

What can and cannot be inferred

What the chain always shows: who deposited, how much and when; who withdrew, how much and when; and that mixing took place. What it hides is the link between them, unless users leak it. Known leaks:

• Address reuse: the same address deposits and withdraws.
• Gas funding: the depositor's address pays gas for a withdrawal to a different address, or funds the withdrawal address directly.
• Linked pairs: depositor and withdrawer have transacted with each other before or after.
• Amount fingerprints: an unusual total, such as 13.7 ETH deposited as 10 + 1 + 1 + 1 + 0.1 × 7 and withdrawn in the same combination soon after.
• Timing: a withdrawal minutes after a deposit in a quiet pool, when few other deposits are candidates.
• CoinJoin-specific: unmixed change that goes back to the user's wallet ("toxic change"), and post-mix consolidation, where several mixed outputs are spent together, re-linking them.

A study of Tornado Cash and a similar mixer on another chain (Wang and colleagues, "On How Zero-Knowledge Proof Blockchain Mixers Improve, and Worsen User Privacy", ACM Web Conference 2023) applied five such heuristics and found that they reduced the reported anonymity sets of the Ethereum pools by about 27% on average. That shows leaks are common; it also shows that most of the anonymity set survives for careful users.

Chain hopping and privacy wallets

Mixing often combines with chain hopping, swapping into another asset, especially a privacy coin such as Monero, where amounts and counterparties are hidden by default (see the lesson Other chain designs analysts meet). The visible trail then ends at the swap and may reappear when funds are swapped back. Privacy wallets add coin control, network privacy (for example, connecting through Tor) and built-in CoinJoin, so their users leave fewer of the leaks above.

When you report, state the pool or service, the amounts and times in and out, the size of the candidate set and which leak, if any, supports a link. "Address B withdrew 100 ETH three blocks after A's deposit, and A paid B's gas" is a finding. "B's funds are tainted because they came from Tornado Cash" applies poison taint to every user of a pool, most of whom have no link to your case.

Exam focus: the anonymity set and the three families of mixing (CoinJoin, centralized mixer, smart-contract mixer); recognizing a CoinJoin from equal outputs and why the common-input heuristic fails on it; the structural differences between Whirlpool, WabiSabi and JoinMarket; how a smart-contract mixer works (fixed pools, commitment, zk-SNARK proof, nullifier hash, relayers); why custodial mixers break the trail like exchanges; the leaks that can link deposits and withdrawals (address reuse, gas funding, linked pairs, amount and timing, toxic change, consolidation); chain hopping into privacy coins; reporting candidate sets rather than applying poison taint to mixer users.