CoinJoin is a shared bitcoin transaction where many people combine their inputs and outputs into one, so it is no longer clear which input paid which output. It is a legitimate privacy tool that criminals also use to launder funds, so exposure to it usually raises a wallet's risk score rather than proving guilt.
What is CoinJoin, in plain English?
Normally a bitcoin transaction has clear inputs and outputs, so tracing which coins went where is straightforward. CoinJoin scrambles that. Several participants pool their coins into a single collaborative transaction, with many inputs going in and many equal-sized outputs coming out. Because the outputs are indistinguishable, an observer cannot reliably tell which participant's input funded which output.
The intent is privacy. Bitcoin is a public ledger, and without a tool like this anyone can follow a person's entire financial history. CoinJoin breaks the deterministic link so ordinary users can keep their balances and counterparties private. It is a legitimate technique, and using it is not by itself evidence of wrongdoing.
The complication is that the same property that protects privacy also helps launder funds. A criminal can push dirty coins through a CoinJoin to muddy their origin. So for a compliance team, coins coming out of a CoinJoin are treated as mixed: their history is now lower-confidence, which raises risk without proving guilt. The honest reading is that legitimate privacy and laundering look alike here.
How a CoinJoin round works
- Gather — Participants join a round. Many users signal they want to mix a set amount of bitcoin together.
- Combine — Inputs pooled into one transaction. Everyone's inputs are collected into a single transaction with equal-sized outputs.
- Sign — All parties sign. Each participant signs, and the coordinated transaction settles on-chain at once.
- Result — Links obscured. Outputs are interchangeable, so it is unclear which input paid which output.
- Legitimate — Privacy. A user simply wants their ordinary activity kept private.
- Illicit — Laundering. A criminal pushes dirty coins through to muddy their origin.
Who is involved?
Who | Their role |
The participants | Individual users, legitimate or not, who contribute inputs to the shared transaction. |
The coordinator | The service or protocol that assembles the round and equal-sized outputs. |
The analyst | Assigns lower confidence to post-mix funds and weighs the surrounding context. |
Exchanges and VASPs | Decide how to treat deposits with CoinJoin exposure under their risk policy. |
What it looks like in practice
In practice
An exchange sees a deposit whose recent history includes a large collaborative transaction with dozens of equal-sized outputs, the signature of a CoinJoin. The trace back to the true origin now carries lower confidence, because the mix broke the deterministic link.
Rather than auto-blocking, the analyst weighs the whole picture: the amount, how many hops sit between the mix and the deposit, whether anything before the mix was already flagged, and the customer's profile. A privacy-conscious user and a launderer can produce the same on-chain shape, so the decision rests on context around the mix, not the presence of the mix alone.
Why it matters to operators
CoinJoin forces a judgment call that a simple allow-or-block rule handles badly. Post-mix funds carry genuinely lower-confidence history, so ignoring the exposure understates risk. But a CoinJoin is also a lawful privacy tool used by ordinary people, so treating every exposure as proof of laundering over-blocks legitimate customers and can be unfair. The right posture is to raise risk and look closer, not to convict on the mix alone.
The practical nuance is that poorly constructed rounds can sometimes be partly unwound with heuristics, recovering some confidence about origin. So the analytical work is to squeeze what signal remains, weigh the context before and after the mix, and record the reduced confidence honestly rather than pretending the trail is either clean or damning.
What to watch in the data
- Equal-sized outputs in one transaction. Many uniform outputs with many inputs is the classic CoinJoin footprint.
- Lowered confidence, not proof. Treat post-mix funds as mixed and reduce attribution confidence rather than declaring guilt.
- Context around the mix. Check what the funds touched before and after; a flagged source feeding a mix is more concerning than a clean one.
- Hop distance from the mix. Funds one hop out of a CoinJoin differ from funds many hops removed.
- Legal status of the coordinator. Some mixing services are sanctioned; the specific tool and its posture change the risk.
Quick questions
Is using CoinJoin illegal?
In most places, no. It is a privacy tool, and using it is not by itself evidence of a crime. The complication is that laundering produces the same on-chain pattern, so exposure raises risk and warrants a closer look rather than an automatic conclusion.
Why does CoinJoin exposure raise a risk score?
Because it deliberately breaks the link between a coin's origin and its current holder, lowering confidence in the history. That reduced traceability is what the score reflects. It signals uncertainty, not confirmed illicit activity.
How is CoinJoin different from a mixer?
A CoinJoin is a specific collaborative bitcoin transaction structure where participants pool into one transaction. A mixer is a broader category of services that pool and redistribute funds to break links. CoinJoin is one privacy technique; mixers include many custodial and decentralized designs.
Can a CoinJoin be unwound?
Sometimes, partly. Poorly built rounds can be attacked with heuristics that recover some probable input-to-output links. Well-constructed rounds resist this, so any recovered confidence should still be treated as probabilistic.
Should I block every deposit with CoinJoin history?
Not automatically. Blanket blocking punishes legitimate privacy users. Weigh the amount, hop distance, what the funds touched before and after, the coordinator's legal status, and the customer profile before deciding.
What if the mixer is sanctioned?
That changes the calculus sharply. Exposure to a sanctioned mixing service can carry legal prohibitions, not just elevated risk. Distinguish a merely risky privacy tool from a sanctioned one, because the obligations are different.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.