the introduction

Bitcoin is often referred to as digital money, but this comparison is questionable. If Alice pays ten dollars in cash, Bob will never know where the money came from. If he then gave this money to Carol, Carol would not know that the money was in Alice's possession before that.

Bitcoin is different due to its public nature. Anyone can easily monitor the history of a particular coin (or to be precise, its unspent transaction output (UTXO). This is like writing the amount of the transaction and the names of its participants on paper money every time it is used.

However, public address aliases ensure that users' identities will not be easily exposed. But Bitcoin is not a completely private currency. Methods for analyzing blockchain networks are becoming more sophisticated and can track addresses and identify identities with increasing efficiency. Along with other monitoring methods, an entity or body can reveal the identities of digital currency users. To address this problem, techniques have emerged over the years to hide the connections between transactions.

What is currency mixing?

In general, currency mixing may refer to any activity that involves obfuscating money by exchanging it for other money. But in the cryptocurrency space, coin mixing refers to a service provided by a third party. Service providers usually take users' currencies (in addition to a small fee) and give them currencies that are not related to the sent currencies. These services are also known as scattering services or mixing services.

The security and anonymity of these centralized services, of course, makes them questionable. Users are not guaranteed that their funds will be returned to them from the mixing service or that the returned coins are not corrupt in some way. Another aspect to keep in mind when using mash-up services is that your IP address and Bitcoin wallet addresses can be logged by third parties. Ultimately, users give up control of coins in the hope that untraceable coins will be returned to them.

Another method that some find more interesting is CoinJoin transactions, which create a high degree of reasonable doubt as to the source of the coins. In other words, after a CoinJoin transaction is made, a user cannot be definitively linked to their previous transactions. Many CoinJoin solutions provide decentralized alternatives to mixing services. Although a coordinator may be involved in the process, users do not need to sacrifice custodianship of their coins.

What is CoinJoin?

CoinJoin transactions are a proposal first introduced by Bitcoin developer Gregory Maxwell in 2013. In a collection of posts he wrote, Maxwell provides a brief overview of the design of these transactions, and how they can be used to achieve huge privacy gains without changing the protocol.

At its core, a CoinJoin transaction involves combining inputs from multiple users into a single transaction. Before we explain how (and why) this happens, let's look at the structure of a normal transaction.

Bitcoin transactions are made up of inputs and outputs. When a user wants to make a transaction, he takes the unspent transaction output as input, defines the output, and puts his signature on the input. It is important to note that each input is signed independently of the others, and users can place multiple outputs (i.e. send coins to different addresses).

If we look at a transaction with four inputs (each worth 0.2 BTC) and two outputs (0.7 BTC and 0.09 BTC), there are a few things we can assume. First, we see a payment of some sort being carried out – the sender sends one of these outputs to someone, and the rest goes back to the sender. Because it used four inputs, the larger output is likely intended for the recipient. Note that there is 0.01 BTC missing from the output, this is the fee given to the miner.

It is also possible that the sender wanted a large unspent output from a small output, so he put in a small input to end up with the 0.7 BTC he wanted to send.

There is an assumption we can make based on the fact that each input is signed in isolation from the other inputs. Four parties can participate in this transaction and sign the transactions. Here lies the principle that makes CoinJoin transactions efficient.

How do CoinJoin transactions work?

The idea is that multiple parties will coordinate to create a transaction, with each party providing the desired inputs and outputs. When all the inputs are combined, it is impossible to confirm which output follows which user. See the following figure:

Here we have four participants who want to hide the connections between their transactions. These participants coordinate among themselves (or through a coordinator) and announce the inputs and outputs they desire.

The coordinator will take all the information and make a transaction out of it, and each participant will sign it before sending it to the network. Once participants sign, the transaction cannot be modified without invalidating it. So there is no possibility of the coordinator running away with the money.

This transaction is like a black box for mixing transactions. Remember that you can actually destroy unspent transaction outputs and create new ones. The link between the old and new outcomes is the same treatment, but it is not possible to distinguish between the participants. The most we can do is say that a participant gave an input into this transaction and may be the new owner of one of the resulting outputs.

But even this is not guaranteed. Who can say that there are four participants in the transaction we mentioned previously? Is it one person sending coins to four addresses he owns? Or two people making separate purchases and 0.2 BTC will go back to their respective addresses? Or are they four people sending coins to other participants, or returning coins to themselves? Can't be sure.

Privacy through denial

The fact that CoinJoin transactions exist is sufficient in itself to cast doubt on the methods used to analyze the transactions. We can infer that CoinJoin transactions have been made in many cases, but we cannot know who the owners of the output are. As they grow in popularity, it can't be assumed that all inputs are necessarily owned by the same user – a huge leap for privacy in the cryptocurrency ecosystem.

In the previous example, we said that the owner of one of its outputs could be any of the four participants in the transaction, and this number is known as the blind set. The more people in the encryption group, the less likely it is that their transactions will be linked to the original owner. Fortunately, recent implementations of CoinJoin transactions make it easier for users to trustlessly combine inputs with dozens of other users, providing a high degree of deniability. Recently, a transaction involving 100 people was successfully carried out.

Concluding thoughts

Transaction mixing tools are an important addition to the arsenal of any user who takes their privacy seriously. Unlike proposed privacy upgrades (such as confidential transactions), it is compatible with the protocol as it stands.

For those who trust the integrity and conduct of third parties, mash-up services are an easy solution. But for those who prefer verifiable, non-custodial alternatives, the CoinJoin alternatives are better. These transactions can be performed manually for technology-savvy users, or using software that simplifies more complex mechanisms. There are already a number of these tools that are constantly increasing in popularity, as users seek to improve the level of privacy.