CoinJoin

CoinJoin is a privacy technique, first proposed by Bitcoin Core contributor Gregory Maxwell in 2013, in which several independent participants combine their payments into a single transaction. Each user contributes inputs and receives outputs, but because everyone signs only their own inputs, no participant ever takes custody of anyone else's coins. The result is one large transaction whose internal input-to-output mapping is ambiguous to an outside observer.

Why Equal Outputs Matter

The privacy gain depends on using equal-value (uniform) output amounts. If everyone receives, say, an identical 0.01 BTC output, a blockchain analyst cannot tell which input funded which output by matching amounts. With mismatched values, the mapping is often trivially reconstructable. Equal-value CoinJoins turn deterministic tracing into a probabilistic guess, lowering the confidence of any clustering attempt and weakening the common-input-ownership heuristic across the whole network.

Tradeoffs to Understand

CoinJoins are conspicuous: their structured equal outputs are easy to flag on-chain, and some exchanges treat post-mix coins with extra scrutiny. They also cost coordination and miner fees, and any leftover change can re-link coins if spent carelessly. CoinJoin improves anonymity-set size rather than guaranteeing anonymity — privacy still depends on disciplined coin control afterward. As a self-custody practice, it pairs naturally with running your own node so you are not leaking your UTXO set to a third-party server.

For related concepts, see our entries on PayJoin and the Common-Input-Ownership Heuristic that CoinJoin is designed to defeat.

Anonymity Sets and Why Rounds Compound

The privacy a CoinJoin buys is usually described as an anonymity set: the number of participants whose equal-value outputs are indistinguishable from yours. One round with fifty peers means an observer can only say your coin is one of fifty candidates. Remixing compounds this — each additional round multiplies the candidate histories an analyst must consider, which is why serious implementations encourage multiple rounds rather than a single pass. The set is also only as strong as its weakest behavior: if most participants immediately sweep their outputs to an exchange under their own name, the effective set shrinks for everyone who remains.

Coordinator Models

Someone has to assemble the transaction. Centralized coordinators collect registrations, build the template, and gather signatures — crucially without ever taking custody, since each participant signs only their own inputs and can verify their outputs are present before signing. The coordinator still learns network-level metadata, which is why registrations are typically made over Tor and why blinded registration schemes exist to stop the coordinator linking a user's inputs to their outputs. Decentralized and peer-to-peer variants remove the fixed coordinator at the cost of harder liquidity and denial-of-service resistance. In every honest design the failure mode is a refused or stalled round, never stolen funds.

Costs are worth understanding up front: participants pay their share of the miner fee for a large transaction, coordinators typically charge a service fee, and assembling a well-populated round takes time — liquidity is the scarce resource, and thin participation means either waiting or accepting a smaller set. Privacy here is bought with patience as much as with sats.

After the Mix: Discipline Decides the Outcome

CoinJoin output is raw material, not a finished product. The non-uniform change from a mix (often called toxic change) still carries your pre-mix history and must never be merged with mixed outputs; spending mixed and unmixed coins together in one transaction re-links everything via the input-ownership heuristic. Careful UTXO labeling, separate wallets for separate identities, and patience between mix and spend are what convert an anonymity set into lasting privacy — a discipline that belongs to the broader practice of OPSEC.