Blame Round

A blame round is the recovery mechanism a CoinJoin protocol triggers when a round fails to finalize because one or more participants disrupted it — most commonly by registering inputs and then never delivering a signature. Rather than discarding all the work and forcing everyone to start from scratch, the coordinator re-runs the necessary phases with only the cooperative participants, so an honest subset can still produce a valid mixed transaction. The blame round is what turns a fragile group ceremony into a system that degrades gracefully under both accidents and attack.

Why disruption is a real threat

A CoinJoin transaction is only valid once every input carries a valid signature — that all-or-nothing property is exactly what makes the protocol non-custodial and safe to join. But it hands each participant a veto: one peer who goes offline, or deliberately withholds a signature, stalls everyone. Without a remedy, an attacker could grief rounds almost for free — register a few cheap UTXOs, watch dozens of honest users burn time, repeat — degrading the service until users drift away and the achievable anonymity set shrinks for everyone. Since a mix's privacy value scales with how many honest participants show up, an attack on liveness is ultimately an attack on privacy itself.

How the blame mechanism works

When the signing deadline passes with signatures missing, the coordinator identifies exactly which registered inputs failed to deliver — this is attributable, since each participant committed to specific inputs during input registration. Those inputs are excluded, and a fresh round begins immediately among the remaining participants, who re-register and rebuild the transaction without the saboteurs. Several blame iterations can chain back-to-back if new disruptors surface, whittling the group down to a cooperative core. The honest majority loses minutes, not funds: at no point in any round does anyone surrender custody, so the worst a disruptor can inflict is delay and a somewhat smaller final mix.

Making sabotage expensive

Exclusion alone is not enough — an attacker could return next round with the same coins. So protocols temporarily blacklist the UTXOs of participants who failed to sign: banned coins cannot re-enter rounds for a cooldown period, and repeat offenses earn longer bans. Because the penalty attaches to the coin rather than to any registrable identity, a determined attacker must keep committing fresh bitcoin to keep griefing — turning what would be a free denial-of-service into one with a real, rising capital cost. Honest users who merely dropped offline pay a brief timeout; industrial-scale disruption becomes economically self-defeating. It is a fee-market answer to an adversarial problem, in the best Bitcoin tradition.

Why it matters for sovereign users

Timing matters to the design as well: blame rounds run with shortened phase timeouts, since every honest participant is already connected and warmed up, so recovery typically costs far less time than the original round did. The result is that even a round hit by multiple disruptors usually settles within a handful of minutes — an annoyance absorbed, not a service outage.

The blame round embodies a principle worth internalizing: permissionless systems must assume hostile participants and design so that honesty wins anyway, without appeals to authority or identity. It means a handful of bad actors cannot deny you access to fungibility-improving collaborative transactions — the round simply routes around them, the same way the network routes around a misbehaving node. The mechanism operates alongside the CoinJoin coordinator, whose failure-handling duties it defines, and it is the reason coordinated mixing remained usable even under active, well-funded disruption campaigns rather than collapsing at first contact with an adversary.