Bitcoin is pseudonymous, not anonymous. Every payment you ever make is on a public ledger forever, and the moment one address gets tied to your name (an exchange withdrawal, a payment to a friend, a merchant receipt), chain-analysis firms can start walking the graph. CoinJoin is the classic countermeasure: a collaborative transaction that makes your coins indistinguishable from everyone else's.
How It Works
A CoinJoin is one big transaction built by many participants together. Each person contributes an input, and the transaction pays out equal-value outputs to fresh addresses. If a hundred people each receive an identical 0.01 BTC output, an outside observer cannot say which output belongs to which input. Every coin that comes out has a hundred possible owners.
That count is the anonymity set, and it is the whole game: one round in a hundred-person mix leaves a 1 percent guess, and repeated rounds compound it further. The coordinator that assembles the transaction never controls funds. You sign only your own input, and only after checking the transaction pays you back correctly. A dishonest coordinator can refuse to cooperate, but it cannot steal.
What It Defeats
Chain analysis leans on assumptions, and the biggest is common input ownership: all inputs to a transaction belong to one entity. CoinJoin breaks that assumption on purpose, and the ambiguity spreads through every later transaction that touches the mixed coins. What it does not do is hide that a CoinJoin happened. The transaction shape is recognizable on-chain, which is why some exchanges flag freshly mixed deposits. Mixing is legal in most places (privacy is not a crime), but know your counterparty's attitude before sending mixed coins to one.
Post-Mix Hygiene: Where Privacy Is Actually Won
Most people who lose their CoinJoin privacy lose it afterward, with one careless spend. The rules:
- Never merge mixed and unmixed coins. Combining a mixed UTXO with a KYC exchange coin in one transaction re-links the mix to your identity and undoes everything. This is the number one error.
- Do not consolidate mixed outputs. Spending several mixed coins together announces they share an owner. Spend them one at a time.
- Watch the change. Change from spending a mixed coin is linked to you. Label it, remix it, or treat it as non-private. Never blend it back into the clean pool.
- Let coins age. Spending minutes after mixing invites timing analysis. Wait days when you can.
All of this is UTXO management in action, and it is why coin control and labeling matter so much.
Your Node, Your Privacy
Mixing while your wallet asks a stranger's server about your addresses is bailing water with the tap on. A public server learns exactly which addresses are yours, mixed or not. Run your own node and point Sparrow at it, so the only party watching your wallet is you.
The State of the Tools
An honest note: the tooling here shifts. In 2024 the two big centralized coordinators (Whirlpool and Wasabi's) shut down under legal pressure on their operators, which is exactly the failure mode centralization invites. JoinMarket, a decentralized maker-and-taker marketplace with no coordinator to shut down, kept working, at the cost of a steeper learning curve. Check what is current before you rely on any implementation, and favour designs with no central operator. The concepts in this guide outlive any particular tool.
Before spending mixed coins, ask: am I on my own node, am I using coin control, are all inputs mixed coins only, and has enough time passed since the mix? Four yeses or do not send.
Related guides. Master UTXO management first, and see PayJoin for privacy that hides in plain sight. Privacy is a favourite meetup topic.