Privacy Basics
Bitcoin is pseudonymous, not anonymous. Every transaction is permanently public on the blockchain. The chain doesn't know your name — until something links your name to an address. Once that link exists, every transaction you've ever made on that key tree becomes traceable.
How privacy leaks happen
KYC at exchanges. Most centralized exchanges require ID verification. When you withdraw to a wallet you control, the exchange permanently links your identity to that address.
Address reuse. Sending multiple transactions to the same address links them all to each other.
Combining UTXOs. When a transaction has multiple inputs, observers learn those inputs belong to the same person. This is called the common-input-ownership heuristic and chain-analysis firms use it constantly.
Change address fingerprinting. Some wallets create distinctive change patterns that identify the wallet software you use.
IP-level metadata. Broadcasting a transaction reveals your IP unless you use Tor or a privacy-aware node.
Practical defenses
Do
- +Generate a fresh receive address for every new payment
- +Run your own node so you don't leak balance queries to third parties
- +Use Tor for wallet network traffic where possible
- +Mentally compartmentalize: KYC-tainted coins separate from sovereign coins
Don't
- −Reuse addresses
- −Consolidate KYC and non-KYC coins in the same transaction
- −Post your address publicly tied to your name unless that's intentional
- −Trust 'mixers' or 'tumblers' that have ever exit-scammed (most have)
Coin control
Advanced wallets (Sparrow, Electrum, Bitcoin Core) let you choose which UTXOs to spend in each transaction. This is powerful for both fees and privacy:
- Spend KYC coins for KYC purchases (already linked)
- Spend non-KYC coins for non-KYC purposes
- Avoid combining UTXOs from different "compartments"
CoinJoin and collaborative privacy
CoinJoin is a privacy technique where multiple users combine their inputs into one large transaction, breaking the common-input heuristic. Wasabi and JoinMarket are the most-used implementations.
This is not a "mixer" — there's no custodian taking your coins. You sign your own inputs and outputs throughout.
CoinJoin has legal grey-area depending on jurisdiction. Research the rules where you live.
Chain analysis
Firms like Chainalysis, CipherTrace, and Elliptic sell tools that link addresses to identities by combining:
- Exchange KYC data
- Public clusters from leaked data
- Heuristics like the common-input-ownership rule
- Cross-chain links
Privacy is an arms race. The defaults of using Bitcoin "normally" leak a lot. Specific practices preserve more.