Adoption and Actual Privacy of Decentralized CoinJoin Implementations in Bitcoin

TL;DR

This study analyzes the adoption and privacy implications of decentralized CoinJoin implementations in Bitcoin, revealing significant adoption levels, traceability issues, and privacy vulnerabilities affecting users and regulators.

Contribution

First comprehensive measurement of CoinJoin adoption and privacy, using high-accuracy algorithms to detect transactions and analyze privacy risks in Bitcoin's ecosystem.

Findings

Detected over 254,000 CoinJoin transactions between 2018 and 2022

Mixed coins valued at approximately 4.74 billion USD

Traceability of addresses reduces anonymity and impacts user privacy

Abstract

We present a first measurement study on the adoption and actual privacy of two popular decentralized CoinJoin implementations, Wasabi and Samourai, in the broader Bitcoin ecosystem. By applying highly accurate (> 99%) algorithms we can effectively detect 30,251 Wasabi and 223,597 Samourai transactions within the block range 530,500 to 725,348 (2018-07-05 to 2022-02-28). We also found a steady adoption of these services with a total value of mixed coins of ca. 4.74 B USD and average monthly mixing amounts of ca. 172.93 M USD) for Wasabi and ca. 41.72 M USD for Samourai. Furthermore, we could trace ca. 322 M USD directly received by cryptoasset exchanges and ca. 1.16 B USD indirectly received via two hops. Our analysis further shows that the traceability of addresses during the pre-mixing and post-mixing narrows down the anonymity set provided by these coin mixing services. It also shows that the selection of addresses for the CoinJoin transaction can harm anonymity. Overall, this is the first paper to provide a comprehensive picture of the adoption and privacy of distributed CoinJoin transactions. Understanding this picture is particularly interesting in the light of ongoing regulatory efforts that will, on the one hand, affect compliance measures implemented in cryptocurrency exchanges and, on the other hand, the privacy of end-users.