CoinSwap

CoinSwap is an on-chain privacy protocol, first sketched by Greg Maxwell in 2013 and later developed into the Maxwell-Belcher protocol, in which two parties trade coins of equal value (minus fees) without either side being able to steal. Unlike CoinJoin, where everyone signs one recognizable transaction with equal-sized outputs, a CoinSwap produces transactions that look like ordinary, unrelated payments. The result is that the link between a person's old coins and their new coins is severed on the public ledger — not obscured inside a crowd, but simply absent.

How a swap works

Alice and Bob each lock funds into a 2-of-2 multisignature address, then release them to each other under contract terms that make the exchange atomic: hash-time-locked contracts (HTLCs) guarantee that either both parties receive the other's coins or both are refunded after a timeout, so neither can walk away with both sides. CoinSwap predates the Lightning Network as one of the earliest practical applications of HTLCs on Bitcoin, and Lightning's payment channels are recognizably the same trick industrialized. The privacy payoff comes from what an observer cannot do: Alice's receiving address is never connected to her funding address by any transaction, so nothing on the transaction graph ties her history together. Belcher's later design work sharpened the concept further — routing swaps through multiple makers so no single counterparty sees both ends, splitting amounts across transactions to defeat amount correlation, and using multi-transaction constructions so the on-chain footprint resembles unremarkable everyday payments.

CoinSwap versus CoinJoin

The two attack surveillance differently. A CoinJoin is visible by construction — its equal-output structure announces that mixing happened, and privacy comes from ambiguity about which output belongs to whom, the size of the anonymity set. A CoinSwap hides the fact that anything happened at all: to a chain analyst it reads as ordinary spends. That property is stronger in one crucial way — steganographic privacy protects even against observers who penalize visible mixing — but it costs coordination complexity, counterparty liveness, and time-locked capital while a swap completes.

Why it matters for fungibility

CoinSwap improves privacy for people who never use it. Once any ordinary-looking payment could plausibly be a swap, the confidence behind every clustering heuristic drops across the board — an analyst asserting that input ownership implies common control must now hedge against the possibility that the coins changed hands invisibly. It is a direct attack on the common-input-ownership heuristic and the broader surveillance model built on it, and in that sense a contribution to Bitcoin's fungibility as money rather than merely to individual users' privacy.

Status and sober expectations

Honesty requires the caveat: CoinSwap remains significantly harder to implement than CoinJoin, and it has seen experimental implementations rather than mass adoption — the engineering around timeout safety, fee negotiation, and maker economics is genuinely difficult. Treat it as a maturing tool and a proof of what the protocol permits, not as production infrastructure to rely on today. For a sovereign Bitcoiner the practical takeaway is layered defense: disciplined coin hygiene now, visible mixing where appropriate, and a close watch on swap-based tools as they harden — because the endgame they point at, privacy that leaves no trace of itself, is the right one.

The practical hierarchy for on-chain privacy runs from habits to protocols. Fresh addresses, careful coin selection, and refusing to consolidate carelessly cost nothing and stop the easy clustering. Collaborative transactions — CoinJoin for visible mixing, PayJoin for quiet heuristic poisoning — add active defense with mature tooling. CoinSwap occupies the ambitious end: stronger properties, weaker tooling, and a design worth understanding even before it is ready to rely on, because it defines what complete on-chain privacy would look like. A reasonable operator uses the first two tiers today and tracks the third. And since every swap ends with coins under new keys, the fundamentals still gate everything: keys you generated yourself, backups you have tested, and the patience to move deliberately — privacy tools amplify good custody, they never substitute for it.