CoinJoin Implementation Signatures

tactic

Core idea

CoinJoin is not one thing. Each implementation builds its transactions to its own recipe, and those recipes are distinctive enough to name the software from the transaction alone. Knowing which implementation you are looking at tells you what the anonymity set actually is and whether the boundary is as solid as it looks.

Components

JoinMarket: a taker pays a set of makers for liquidity. For a CoinJoin with N makers the transaction has N plus 1 equal sized outputs, as many change outputs as the participants need, and at least N inputs. Unlike the others, JoinMarket uses no fixed denominations, so the output size is whatever the taker chose. N defaults to a random pick between 8 and 10. Transaction parameters are stable: nVersion 2 and nLockTime 0. The wallet organises funds into mixdepths to avoid address reuse.
Wasabi: restricted to a published list of fixed denominations, so outputs matching a value on that list are likely Wasabi. It can produce CoinJoins outside the list, though that appears uncommon. Wasabi defaults to 21 inputs and refuses to run a round with fewer.
Samourai (Whirlpool): the co-founders were arrested and the site seized on 25 April 2024, and the Whirlpool mixing service was shut down. Historical Whirlpool transactions remain on chain and remain recognisable.
The coordinator question: Wasabi shut down its own coordinator after the Samourai seizure, but the software still works against third party coordinators. Users run their own or find others through public coordinator lists. Treat “the coordinator was seized” as a change of operator, not an end of activity.

When to use

Whenever a trace hits an equal-value multi-party transaction and you need to characterise the boundary rather than just declare it opaque. Also when you want to know whether a mixer under investigation is outsourcing part of its liquidity to a public CoinJoin ecosystem, which several do.

Avoid when

These signatures identify software, not intent and not ownership. Using CoinJoin is legal in most jurisdictions and a lot of participants are ordinary privacy conscious users. Denomination matching in particular produces false positives, since any transaction can coincidentally carry a listed value.

Example

While walking a mixer’s peel chain, one branch terminated in a transaction whose structure matched a Wasabi CoinJoin. That identification was itself the evidence: the address feeding it was a customer exit rather than a service address, which let the analyst discard that branch and keep walking the real chain. A separate branch traced back to an exit from JoinMarket, confirming the mixer sourced liquidity there.

CoinJoin / Mixer Detection, Bitcoin Transaction Shape Taxonomy, Post-Mixer Bitcoin Tracing, Wallet Fingerprinting from Transaction Parameters, Types of Mixers and Tumblers, Bitcoin UTXO Clustering Heuristics