Mixers, CoinJoin and privacy coins · Lesson 2 of 5
CoinJoin
8 min read
CoinJoin transactions are where tracing most often turns into argument. Prosecutors want to know whether the funds "went through" a mix and came out at an exchange; defense experts know that published de-mixing methods have no validated error rate for modern designs. This lesson builds on the structures described in the IDFE-BA lesson Mixers, CoinJoin and obfuscation in graphs and teaches you to separate what the chain proves, what a heuristic suggests and what only a wallet or a record can show.
Two different claims: detection and de-mixing
Two questions are easily confused, and they carry very different error profiles.
Detection asks: is this transaction a CoinJoin, and of which design? It rests on structure (equal-output groups, input and output counts, pool denominations, fee patterns) and can be validated against ground truth. Stütz and colleagues (2022) trained a classifier on 28,890 transactions supplied by a Wasabi coordinator and reported 99.98% accuracy with a false-positive rate of 0.0114%; a simpler threshold rule reached 99.31% accuracy with no false positives and a 1.38% false-negative rate. For Whirlpool they traversed mixes from their first transactions, cross-checked against an independent dataset. Across July 2018 to February 2022 they identified 30,251 Wasabi and 223,597 Whirlpool transactions.
De-mixing asks: which output belongs to which input? That is a control claim about people, and no published study offers a field-validated error rate for linking a modern CoinJoin output to a specific input. Detection findings can be stated as facts with a cited error rate. De-mixing findings are heuristic links or inferences and must be graded accordingly (see the lesson Tracing to an evidential standard).
Who knows the mapping
The design decides who, if anyone, holds the input-to-output mapping. That decides where evidence can come from. Dates matter: the Samourai coordinator went offline after its founders' arrest in April 2024, and the company running Wasabi's default coordinator stopped on June 1, 2024, while other coordinators continued.
| Design (context) | Structure | Who knows the mapping |
|---|---|---|
| Whirlpool | Fixed pools, five inputs and five equal outputs; a preparatory tx0 creates pool-sized coins and holds the leftover change | Each user knows only their own coins; the coordinator was designed not to link inputs to outputs |
| Wasabi 1.x | Large rounds with one main equal-output group, change outputs for participants | Each user for their own coins; coordinator designed not to link (blind signatures) |
| Wasabi 2.x (WabiSabi) | Arbitrary input amounts, outputs in standard denominations, very large rounds | Each user for their own coins; coordinator designed not to link (anonymous credentials) |
| JoinMarket | A taker pays makers to join; one equal group plus change for most participants | The taker knows the whole mapping; each maker knows its own coins |
The practical conclusion: the most reliable de-mixing evidence is not a heuristic but a wallet. A participant's wallet records which outputs are its own, often with labels and full coin histories. Under lawful authority, wallet files, backups and synced data on a seized device can resolve every CoinJoin the subject took part in (see the lessons Wallets on seized devices and Wallet recovery under lawful authority). A JoinMarket taker's wallet resolves the whole transaction. A seized coordinator, by contrast, may hold round logs, registration times and network data, but by design it should not hold the mapping; verify what it actually contains before promising anything.
Post-mix behavior and toxic change
Users and their software leak links after the mix. These are the patterns published research and casework rely on:
- Toxic change: the unmixed remainder (in Whirlpool, the tx0 change; in other designs, change outputs inside the CoinJoin). It is deterministically linked to the user's pre-mix coins. If it is later spent together with post-mix outputs, the common-input heuristic links those outputs to the same wallet.
- Consolidation: several post-mix outputs spent together, re-linking them to one controller and often recreating the original amount.
- Pre-mix funding patterns: Stütz and colleagues describe a "star" pattern, one entity funding several CoinJoin inputs, and a "collector" pattern, several post-mix outputs flowing to one wallet.
- Amount arithmetic: post-mix outputs that sum, after fees, to the pre-mix amount and arrive together at a service.
- Arbitrary-value mapping: where amounts are not equal, the input-output mapping becomes a subset-sum problem. Atlas (2014) used amount matching of this kind to link inputs to outputs in a wallet provider's early CoinJoin feature.
Gavenda and colleagues (ESORICS 2025) measured how much consolidation erodes the anonymity set: an average post-mix decrease of 10–50% across Whirlpool, Wasabi 1.x and Wasabi 2.x, with Wasabi 2.x below 20% because its users remix heavily. They also estimated that even for a median-sized real Wasabi 2.x round, enumerating every possible mapping is computationally infeasible, so users keep substantial privacy unless an analyst has outside information.
Published research and its error rates
| Study | What it measured | Ground truth | What a report may take from it |
|---|---|---|---|
| Stütz et al. (2022) | Detection of Wasabi and Whirlpool transactions; volumes; post-mix patterns | Coordinator-supplied transactions; test mixes | Detection error rates for that design and period |
| Gavenda et al. (2025) | Anonymity-set loss from consolidation; mapping enumeration | Emulated rounds and aggregate chain data | That leaks are common, with an aggregate scale; not a per-output error rate |
| Atlas (2014) | Amount matching in an early CoinJoin service | Analysis of that service's transactions | A historical design weakness; not transferable to equal-output designs |
Three rules follow. Cite the design and period a figure applies to. Never convert an aggregate anonymity-set reduction into a probability that a particular output is the subject's. And disclose that de-mixing heuristics lack validated field error rates, before the defense raises it (see the lesson Disclosure and defense scrutiny).
A worked case
A ransom of 0.20000000 BTC reaches the subject's address (grade A). A tx0, 7c2e…91ab, splits it into three pre-mix coins of about 0.0503 BTC, a service-fee output and 0.0471 BTC of change. Each pre-mix coin enters a different five-by-five mix and is remixed several times. Nine days later this transaction appears:
txid e5d0…3a77 3 inputs, 1 output
in 0.05000000 bc1q…h4tn (post-mix output of mix 2b91…0c4d)
in 0.05000000 bc1q…p9we (post-mix output of mix 61fa…d802)
in 0.04710000 bc1q…z6qc (change output of tx0 7c2e…91ab)
out 0.14690000 bc1q…dx7e (deposit address, Exchange K per label)
fee 0.00020000The examiner reasons step by step:
- Arithmetic. 0.05 + 0.05 + 0.0471 = 0.1471 BTC in; 0.1469 out plus 0.0002 fee. The amounts reconcile.
- What is deterministic. The tx0 change came from the ransom (grade A). The two post-mix outputs came out of their mixes (grade A as flows). Nothing deterministic connects the subject's pre-mix coins to these particular outputs.
- The heuristic. The co-spend of toxic change with two post-mix outputs indicates one controller for all three inputs. Exceptions such as PayJoin or a collaborative spend are implausible for a one-output consolidation, but the claim remains a single heuristic: grade C.
- What the heuristic does not show. It does not show that these outputs carry the ransom value. The wallet may have mixed other coins. The claim is about control, not flow.
- The third pre-mix coin. No leak was found. It is reported as untraced, not as "probably in the same wallet".
- Next step. Request Exchange K's records for
bc1q…dx7e. If the account holder is the subject, the control claim gains independent corroboration and rises to grade B. If a device is seized, the wallet data may settle it.
What can and cannot be claimed
| Statement | Basis | Status |
|---|---|---|
"Transaction 2b91…0c4d is a five-by-five Whirlpool-style CoinJoin." | Structure; published detection error rates | Supported, cite the rate |
| "The subject's pre-mix coin was an input to it." | Deterministic spend | Supported, grade A |
"Output bc1q…h4tn was controlled by the wallet that held the tx0 change." | Toxic change co-spent with post-mix outputs | Supported as grade C; B if records corroborate |
| "Output 3 of the mix is the subject's because the subject joined it." | One of five candidates | Not supported; report the candidate set |
| "The subject's ransom funds are now at Exchange K." | Control link plus value assumption | Overstated; say that the wallet linked to the ransom deposited 0.1469 BTC there |
| "All outputs of the mix are tainted." | Poison rule | Not supported |
Exam focus: the difference between CoinJoin detection (validated, low published error rates) and de-mixing (no validated field error rate); who knows the mapping in Whirlpool, Wasabi 1.x, WabiSabi and JoinMarket, and why wallet data on a seized device is the strongest de-mixing evidence; toxic change, consolidation, star and collector patterns, amount arithmetic and subset-sum mapping; Stütz et al. (2022) and Gavenda et al. (2025) findings and their limits; that a co-spend link is a control claim, not a flow claim; grading and wording CoinJoin findings and reporting untraced value honestly.