Bitcoin's base layer is pseudonymous, not private. Every transaction is public forever, and chain-analysis firms are professionally competent at linking addresses to real identities using exchange KYC data, address clustering, and behavioral patterns. CoinJoin is the main defense — a technique that combines many people's UTXOs into a single transaction with many outputs, breaking the direct on-chain link between where coins came from and where they went.
The technique itself is straightforward. The tooling around it has been through an enforcement gauntlet since 2023 and looks very different today than it did a few years ago. Understanding what still works and what carries real legal risk is now a prerequisite to using Bitcoin privately.
What CoinJoin does, mechanically
A CoinJoin is a single Bitcoin transaction with multiple senders and multiple recipients, all combined into one on-chain event. If 10 users each contribute 0.1 BTC and receive 0.1 BTC out, the chain-analysis firm looking at the transaction cannot tell which output belongs to which input. From the outside, all 10 outputs are equally likely to be any of the 10 senders.
This assumes the outputs are of equal size — that is where the anonymity comes from. If the outputs are different sizes, the analyst can match input-output pairs by amount and the technique fails. Real CoinJoin tools enforce equal-output sizes and can chain rounds together for stronger effect.
The result is not perfect anonymity — a determined adversary with enough context (timing, subsequent behavior, off-chain data) can often narrow it down. But CoinJoin genuinely breaks the deterministic link that chain analysis relies on for most workflows.
The 2024 enforcement wave
In April 2024, US federal prosecutors arrested Samourai Wallet's developers and charged them with money-laundering conspiracy for operating Whirlpool, a popular CoinJoin service. Weeks later, Wasabi Wallet — the other major CoinJoin implementation — announced it would sunset its coordinator and stop offering CoinJoin services to US users.
Both cases were shocking because neither service took custody of user funds. They provided software; users ran it. The theory of prosecution — that providing privacy tools amounts to money laundering — has not been tested in court yet, but it changed the operating landscape overnight.
By late 2024, the mainstream custodial-coordinator model of CoinJoin was effectively gone. What remains is decentralized coordination (JoinMarket), niche tools, and a broader ecosystem shift toward Lightning and other privacy techniques.
What still works today
**JoinMarket**: the pre-Whirlpool, pre-Wasabi model — peer-to-peer coordinated CoinJoin without a central operator. Users offer their coins as "makers" (earning fees) or take liquidity as "takers" (paying fees). Because there is no central coordinator to arrest, JoinMarket has continued operating throughout the enforcement wave. It is significantly more technical than Wasabi's polished UI ever was — you install it as a command-line tool and configure your bitcoind alongside it.
**Ashigaru**: a Whirlpool-successor project that some Samourai users have migrated to. Similar mixing structure but with different coordinator infrastructure. Availability and legal status remain in flux.
**Lightning Network**: not a CoinJoin per se, but Lightning payments are naturally private — routing through the network breaks the on-chain link the same way. For everyday transactions where privacy matters, using Lightning for the transaction and CoinJoin (or PayJoin) for occasional base-layer housekeeping is the most practical stack.
**PayJoin (BIP-78)**: a two-party CoinJoin variant where the sender and receiver combine inputs. Less powerful than mass CoinJoin but requires no coordinator and no waiting for peers. Support is patchy — Sparrow Wallet is the main desktop implementation, and adoption on the merchant side is limited.
What broke or is legally risky
**Whirlpool (Samourai)**: shut down, developers under indictment. Users who still hold coins that went through Whirlpool are not themselves at legal risk (using a service is not the same as running it), but the service is not accepting new mixes.
**Wasabi 2.0's coordinator**: shut down for US-based users. The Wasabi software still exists and can theoretically connect to other coordinators, but the ecosystem of coordinators is thin.
**Mixing services** (Tornado Cash for Ethereum, ChipMixer, etc.): these are custodial mixers, not CoinJoin. They have been targets of OFAC sanctions since 2022. Using a sanctioned mixer is a legal risk in most Western jurisdictions.
Where exchanges stand
Most large centralized exchanges will refuse deposits that came directly from a CoinJoin output. Chain-analysis firms flag CoinJoin transactions as high-risk, and exchanges use those flags to close accounts, freeze deposits, or file suspicious activity reports.
The workaround: send CoinJoin outputs through a Lightning payment or several intermediary hops before depositing to an exchange. This works because chain-analysis heuristics look for direct CoinJoin exposure, and separated hops reduce the flag score. But it is a workaround, not a fix — some exchanges apply deeper heuristics that catch this.
For anyone using Bitcoin primarily through exchanges, on-chain CoinJoin is largely incompatible with the exchange relationship. This is unfortunate but it is the operational reality.
What CoinJoin buys you
CoinJoin makes a specific set of chain-analysis techniques stop working. It breaks direct input-output linking. It does not:
- Hide your total holdings (an observer sees the total value moving into and out of your CoinJoin cluster)
- Anonymize you against a well-funded government adversary with subpoena power over exchanges
- Protect against IP-address correlation if you broadcast from your own address without Tor
- Prevent behavioral analysis (spending patterns, address reuse after the mix)
CoinJoin is a tool against commercial chain-analysis and passive on-chain observation. It is not a shield against a targeted investigation with legal tools.
The honest privacy stack in 2026
For a user who genuinely wants Bitcoin privacy without pulling the legal-risk lever:
1. Buy Bitcoin peer-to-peer where possible (Bisq, Robosats, HodlHodl) rather than KYC exchanges. 2. Run your own node — chain-analysis firms cannot infer your interests from your queries if you are not querying their infrastructure. 3. Use Lightning for regular payments; the routing breaks on-chain linkability naturally. 4. For occasional base-layer privacy, use PayJoin (via Sparrow Wallet with a supporting merchant) or JoinMarket for full CoinJoin. 5. Never reuse addresses. Even without any privacy tooling, always generating a fresh receive address is the single biggest privacy improvement most users can make.
Note the omission: no mainstream CoinJoin service that "just works" the way Wasabi did before 2024. That gap is real, and it is why Bitcoin privacy today requires more effort than it did two years ago.
The legal question
Using CoinJoin is not illegal in most jurisdictions. Running a CoinJoin coordinator has become legally fraught in the US and EU after 2024 enforcement. The current safe assumption: user-side privacy tooling remains permissible; service-provider infrastructure carries real risk.
None of this is legal advice. If you are considering CoinJoin for anything more than modest personal use, talking to a lawyer familiar with financial regulation in your jurisdiction is worth the fee.
