Digital Surveillance and Bitcoin Privacy

Bitcoin is not anonymous. Every transaction stays on a public ledger forever, and chain analysis companies, firms that trace payments across that ledger, tie those payments to you in three ways. The first is the ID an exchange checked when you bought (the “know your customer” check, or KYC). The second is your IP address, the number that identifies your internet connection, which your wallet or browser shows to every server it asks about your coins. The third is patterns in the transactions themselves, such as coins spent together. This guide shows you each of those trails and the step that closes it.

You will learn how to buy without handing over an ID, how to keep exchange coins and private coins in separate wallets, how to look up your own balance without telling a stranger’s server, and how to set up a hardware wallet that opens to a decoy if you are ever forced to unlock it. The mistakes section lists the slips that undo all of this, and the chain analysis lesson explains how the tracking works.

Step-by-Step Guide

The seven steps below close those three trails; the figure shows which step closes which.

Three trails that lead to you, each with what closes it. Exchange records: your ID is on file, so coins you withdraw lead to your name; buy without an ID, peer to peer, into a wallet never linked to you (step 2). Your IP address: servers you ask see it next to the addresses you look up; Tor hides your IP address and your own node answers your wallet (steps 1 and 6). Transaction patterns: coins spent together are assumed to have one owner; keep one wallet per source, and CoinJoin cuts old links (steps 3 and 5). — **Surveillance follows three trails, and each has its own fix.** Your name comes from the exchange, your location from the IP address you ask with, and the link between your coins from how you spend them. The steps below close them one by one.

Establish a Tor-based operating environment
Download and verify Tails, which you start from a USB stick in place of your usual system, or Whonix, which runs as two virtual machines on your computer. A dedicated device is best. All Bitcoin-related network traffic should be routed through the Tor network, so your Internet Service Provider and other local observers see only that you use Tor, and the Bitcoin nodes and services you reach never see your IP address. Both systems do this for you: Tails gives you no internet access until it has connected to Tor, and Whonix forces every connection through Tor or blocks it, so nothing leaks by accident. This single step closes one of the largest metadata vectors that surveillance systems exploit: your IP address connecting to Bitcoin nodes and services. Tor cannot stop an observer who watches both your connection and the far end from matching the timing.
Acquire Bitcoin through non-KYC channels
Use peer-to-peer platforms such as Bisq, RoboSats, or HodlHodl to purchase Bitcoin without providing identity documents. Pay with cash-by-mail, cash deposits, or prepaid cards acquired with cash. Each acquisition should use a fresh receiving address generated from a wallet that has never been associated with your identity. The goal is to break the link between your legal identity and the on-chain footprint from the moment of first acquisition, since surveillance systems primarily rely on exchange-provided KYC data as their anchor point.
Break deterministic links before moving funds to cold storage
Before sending acquired Bitcoin to a long-term storage address, break the on-chain link between the acquisition source and your storage wallet. Update (November 2026): Samourai Wallet and its Whirlpool coordinator were seized by the DOJ/FBI in April 2024 and no longer operate, zkSNACKs switched off Wasabi’s default coordinator on 1 June 2024, and the original JoinMarket software was archived in April 2026, with its maintainers warning not to use it; earlier guides that pointed you at those services are now dead ends. The living options are Wasabi with an independent coordinator you choose (a coordinator is the server that gathers participants and assembles the CoinJoin); Ginger Wallet, a Wasabi fork with its own coordinator; and JoinMarket NG, an independent reimplementation of JoinMarket’s decentralized maker/taker CoinJoin with no central coordinator. PayJoin (BIP78) is a lighter step for when you pay someone: it breaks the common-input-ownership heuristic inside that payment, but it doesn’t cut your trail the way a CoinJoin does. Our CoinJoin lesson compares them. A community fork, Ashigaru, relaunched Whirlpool in 2025 on a new Tor-only coordinator of its own, but be honest about the trade-off: it is still a centralized coordinator (the same structural single point of failure that ended Samourai) and charges an entry fee of 5% of the pool size. Whichever tool you use, remixing helps but is no guarantee, so treat any round count as a rough guide; wait variable amounts of time between rounds, and avoid merging post-mix UTXOs with unmixed funds afterward, as doing so re-establishes the traceability that CoinJoin removed.
Use a hardware wallet with passphrase-protected hidden wallets
Configure your hardware wallet (Coldcard, Trezor, or similar) with a PIN and a passphrase, an extra word or phrase added to your recovery words. The words alone open a decoy wallet; the words plus the passphrase open a different wallet that holds your savings. If you are ever forced to unlock the device, you can hand over the decoy. Make it believable: put in an amount you are prepared to hand over that fits what an attacker might expect you to hold, because attackers know passphrase wallets exist and a token balance looks like a trick. Back up the passphrase on paper or metal, apart from the recovery words and ideally in another place: lose it and the savings are gone. When you travel, the safest plan is to leave behind anything that can move your savings; the physical security lesson explains why.

One set of recovery words, written on paper or metal and never kept digitally, opens two different wallets. The words alone open a decoy wallet holding a believable amount you are prepared to hand over. The words plus the passphrase open your savings, in a different wallet. A wrong or missing passphrase gives no error: it just opens a different wallet. Back the passphrase up apart from the words; lose it, and the savings are gone. — **A passphrase turns one set of words into two wallets.** If someone forces you to unlock your device, the words alone show the decoy, so give it an amount that looks real. Your savings sit behind the passphrase, which you back up apart from the words.

Segregate funds by privacy level
Maintain separate wallets for KYC-linked Bitcoin and non-KYC Bitcoin. Never send funds between these wallets or combine UTXOs from both sources in a single transaction. Use distinct hardware devices or at minimum distinct passphrase wallets for each category. Label each UTXO in your wallet software with its source and privacy level. This segregation prevents chain analysis firms from linking your identity-verified Bitcoin to your private holdings through common-input-ownership heuristics.
Run your own Bitcoin full node over Tor
Set up a full node (Bitcoin Core, or a node package like Umbrel or Start9) and configure it to connect exclusively through Tor. Point your wallet software to your own node rather than relying on third-party servers. When you use a public Electrum server or a block explorer API, the server operator can log every address you query, building a profile of your holdings. Your own node processes these queries locally, eliminating that surveillance vector entirely.
Practice operational security in daily usage
Never search for your own Bitcoin addresses on public block explorers from a non-Tor browser. Avoid discussing specific transaction amounts or addresses on social media or messaging platforms. Use a dedicated email address (created over Tor) for any Bitcoin-related service accounts. Disable Bluetooth and Wi-Fi on devices used for signing transactions. Each of these habits closes a potential information leak that surveillance systems aggregate to build identity profiles.

Common Mistakes to Avoid

Mixing KYC and non-KYC UTXOs in a single transaction

When you combine an input from a KYC exchange withdrawal with a non-KYC UTXO in the same transaction, chain analysis software applies the common-input-ownership heuristic. This links your verified identity to all outputs and associated addresses, retroactively destroying the privacy of your non-KYC coins. Always keep these fund sources in entirely separate wallets and never spend from both in a single transaction.

Two ways to pay a shop 0.03 BTC from a wallet holding a 0.1 BTC coin withdrawn from an exchange, which carries your name, and a 0.05 BTC coin bought peer to peer with no ID. Both coins in one transaction: it pays 0.03 BTC to the shop and returns 0.12 BTC as change; analysts assume one owner, so the private coin, the payment and the change all carry your name. Only the private coin: the transaction pays 0.03 BTC and returns 0.02 BTC as change; the exchange coin stays apart, and nothing ties the payment or the change to your name. Amounts are illustrative and fees are left out. — **Spend them together and your name spreads to every coin in the transaction.** Chain analysis assumes that coins spent together share an owner, so the private coin, the payment and the change all lead back to you. Keep exchange coins and non-KYC coins in separate wallets so that no payment can draw on both.

Reusing Bitcoin addresses across multiple transactions

Address reuse allows any observer to trivially aggregate your transaction history by watching a single address. Every incoming and outgoing payment becomes linked, revealing your balance changes over time and your transaction partners. Generate a fresh address for every receive operation, and configure your wallet software to enforce this behavior automatically. HD wallets make this straightforward since new addresses are derived deterministically from your seed.

Querying block explorers without Tor

Checking your transaction status on a website like mempool.space or blockchair.com from your home IP address reveals to the site operator which addresses and transactions belong to your IP. Over time, this builds a comprehensive map of your holdings. Always use Tor Browser when interacting with any blockchain data service, or better yet, query your own full node directly through a local interface.

Neglecting to verify downloaded wallet software

Downloading wallet software without verifying PGP signatures or checksums exposes you to supply-chain attacks. A compromised wallet binary could transmit your private keys or transaction data to an attacker, or generate addresses controlled by the attacker. Before installing any wallet application, download the developer’s PGP public key from multiple independent sources, verify the release signature, and confirm the file checksum matches the signed value.

Using public Wi-Fi for Bitcoin transactions

Public Wi-Fi networks operated by hotels, airports, and cafes frequently log connection metadata and may perform deep packet inspection. Even if your Bitcoin traffic is encrypted, the network operator can match your device’s MAC address (the hardware ID it shows the network) with the timing and destination of your connections. If you must use public Wi-Fi, send everything through Tor, so the operator sees only that you are connecting to Tor and never a direct Bitcoin connection. Tails does this for you and also changes your MAC address by default. If being seen to use Tor is itself a risk, connect through a bridge, a secret Tor relay that hides that you are connecting to Tor. A VPN in front of Tor only adds a company that sees you connect, and the Tor Project generally recommends against combining the two.

Frequently Asked Questions

Does using Bitcoin automatically protect me from financial surveillance?

No. Bitcoin’s blockchain is a public ledger, and every transaction is permanently visible to anyone. Without specific privacy measures such as CoinJoin, Tor routing, and proper UTXO management, your Bitcoin transactions may actually be more traceable than traditional bank transfers. Chain analysis companies maintain extensive databases that link on-chain activity to real-world identities through exchange KYC records, IP address logging, and behavioral heuristics. Privacy on Bitcoin requires deliberate, consistent effort at every stage from acquisition to spending.

Can chain analysis firms trace CoinJoin transactions back to my identity?

A properly executed CoinJoin breaks the deterministic link between inputs and outputs, meaning an observer cannot prove which output belongs to which participant. However, privacy can still degrade if you merge CoinJoin outputs with identified coins, if you spend post-mix UTXOs in predictable patterns, or if the CoinJoin coordinator itself is compromised. A market with no central coordinator, such as JoinMarket’s maker/taker market (now reached through JoinMarket NG rather than the archived original software), takes the coordinator out of the picture; there the taker who builds each CoinJoin learns which outputs belong to the makers, so takers get the stronger privacy. Combined with strict post-mix spending discipline, that significantly reduces these risks.

How does running a full node protect against surveillance?

When your wallet looks up its addresses through a public Electrum server, a block explorer API or someone else’s node, you transmit your addresses and transaction queries to someone else’s infrastructure. That server operator can log which addresses you look up, correlating them with your IP address to identify your wallet holdings. A full node downloads and validates the entire blockchain locally, so all address lookups and transaction verifications happen on your own hardware. Combined with Tor, this prevents external parties from knowing which specific transactions or addresses are relevant to you.

Three ways to look up your wallet, and what each server learns. A public server run by a stranger sees your IP address and all your addresses. A public server reached over Tor no longer sees your IP address, but it still sees your addresses. Your wallet can instead ask your own node at home, which reaches its Bitcoin peers over Tor: no stranger sees your addresses, and peers don't see your home IP address. Tor hides who is asking; only your own node keeps what you ask private. — **Tor hides who is asking; only your own node hides what you ask.** A public server over Tor sees a different IP address but the same list of addresses. With your own node the questions never leave your home, and putting the node itself on Tor keeps your home IP address from its peers.

What are the risks of using a VPN instead of Tor for Bitcoin privacy?

A VPN shifts trust from your ISP to the VPN provider, who can still log your traffic metadata and potentially associate your IP with Bitcoin activity. A no-logs promise doesn’t settle it: as the Electronic Frontier Foundation puts it, even when a company claims not to log connection data, “this is not a guarantee of good behavior.” A provider can also be compelled by legal processes to reveal user data. Tor, by contrast, routes traffic through three independent relays so that no single relay knows both the origin and destination of a connection, though an observer who can watch both ends can still match them by timing. For Bitcoin privacy specifically, Tor provides meaningfully stronger protection because it eliminates the single point of trust that a VPN represents.

Two routes from you to a website. With a VPN, the route passes one company, which sees both your IP address and where you go. With Tor, the route passes three relays: the guard sees your IP address but not where you go, the middle relay sees neither, and the exit sees where you go but not your IP address. No single Tor relay knows both who you are and where you go. — **A VPN moves your trust to one company; Tor splits it across three relays.** The VPN company sees who you are and where you connect. With Tor, the relay that knows your IP address never learns where you go.

Is it possible to use Bitcoin privately while still complying with tax obligations?

Yes. Privacy and tax compliance are not mutually exclusive. You can maintain private transaction practices (CoinJoin, Tor, own node) while still accurately reporting capital gains and income to tax authorities. The key distinction is between privacy from public surveillance and evasion of legal obligations. Proper record-keeping of acquisition costs, disposal events, and realized gains allows you to fulfill tax requirements without exposing your full transaction history, wallet balances, or behavioral patterns to the public blockchain analysis ecosystem.

Related Resources

Part of our free Bitcoin course: This topic is covered in Bitcoin Privacy: Why It Matters and How Chain Analysis Works, from the Advanced Bitcoin Security & Privacy course.

Filed under: Bitcoin Privacy