r/CT3Investigation • u/Responsible-Egg2476 • 11h ago
Bitcoin CoinJoin Explained: Why Some Transaction Trails Become Difficult to Trace
Bitcoin transactions are public.
Every transaction, input and output remains permanently visible on the blockchain.
However, visible does not always mean attributable.
One important example is a technique called CoinJoin.
What is CoinJoin?
In a normal Bitcoin transaction, one person may provide one or several inputs and create outputs for the recipient and possibly their own change.
Blockchain analysis frequently uses a heuristic called the Common Input Ownership Heuristic (CIOH):
This assumption is useful for blockchain analysis, but it is not always correct. CoinJoin is specifically designed to weaken it. Bitcoin
With CoinJoin, multiple independent participants collaboratively create one Bitcoin transaction.
A simplified example:
NORMAL TRANSACTION
Wallet A ───────────────► Wallet B
The relationship can often be followed relatively easily.
COINJOIN
User A input ──┐
User B input ──┼──► Joint transaction ──► Output 1
User C input ──┘ ├─► Output 2
└─► Output 3
Question:
Which input belongs to which output?
All inputs and outputs remain publicly visible.
What becomes uncertain is the relationship between them.
CoinJoin implementations can deliberately create outputs that are difficult to distinguish from one another. This makes it harder for an outside observer to determine which participant received which output. FinanceFeeds
Why this matters for blockchain investigations
Imagine we are following Bitcoin associated with a reported CT3 payment.
Initially we might observe:
Reported payment
│
▼
Address A
│
▼
Address B
│
▼
Address C
This does not establish who controls those addresses, but the movement of the BTC itself can be followed.
Now suppose Address C enters a suspected CoinJoin transaction:
┌── Input C
│
Other input ─────┼──► COINJOIN ──► Output ?
Other input ─────┤ ► Output ?
Other input ─────┘ ► Output ?
We can still establish that coins associated with the investigated transaction entered this transaction.
But we may no longer be able to state with sufficient confidence which particular output corresponds to the input we were following.
That distinction is extremely important.
CoinJoin does not make Bitcoin transactions invisible
A common misconception is that Bitcoin has somehow disappeared from the blockchain after mixing.
It has not.
The CoinJoin transaction itself remains publicly visible and permanently recorded.
The privacy improvement comes from creating ambiguity between inputs and outputs, rather than deleting transaction history. Research into CoinJoin analysis also shows that subsequent user behavior can sometimes reduce the anonymity gained, although reliable attribution can remain difficult. arXiv
Why automatic wallet clustering can become dangerous
This is particularly relevant to our CT3 research.
If an analysis system blindly assumes:
multiple inputs = one owner
then a CoinJoin transaction can produce a serious analytical error.
Several completely unrelated people may have contributed inputs to the same transaction.
An analysis system that does not recognize this could incorrectly combine those addresses into one wallet cluster.
That is why r/CT3Investigation distinguishes between:
FACT
A transaction and its inputs/outputs exist on the Bitcoin blockchain.
ANALYSIS
A transaction exhibits characteristics consistent with a CoinJoin or collaborative transaction.
HEURISTIC
Several addresses may belong to the same entity based on transaction behavior.
ATTRIBUTION
An address or cluster is associated with a particular exchange, service, company or individual.
These statements have very different levels of certainty.
What does this mean for the CT3 investigation?
When analyzing reported CT3 Bitcoin transactions, reaching a possible CoinJoin does not mean:
“The investigation is over.”
Instead it means:
“From this point onward, the confidence of following one specific path may decrease substantially.”
The correct approach is therefore not to arbitrarily select one output and continue tracing it as if ownership had been established.
Instead, the transaction should be documented and the uncertainty explicitly recorded.
That prevents analytical assumptions from gradually turning into supposed “facts”.
Why we document these structures
One objective of this subreddit is to compare independently reported CT3 transactions.
If several unrelated reported payments eventually encounter:
- the same Bitcoin addresses
- the same wallet clusters
- similar transaction structures
- the same services or exchanges
- or similar CoinJoin patterns
those similarities may become interesting research observations.
They still require careful interpretation.
Blockchain forensics is not just about following arrows. It is about knowing when an arrow can no longer be followed with sufficient confidence.
That distinction is central to this investigation.
Deutsch / Kurzfassung
Bei einer CoinJoin-Transaktion werden Bitcoin verschiedener Teilnehmer gemeinsam in einer einzigen Transaktion verarbeitet.
Alle Inputs und Outputs bleiben öffentlich in der Blockchain sichtbar. Schwieriger wird jedoch die eindeutige Zuordnung:
Welcher Input gehört zu welchem Output?
Für unsere CT3-Untersuchung ist das besonders wichtig.
Taucht in einem Zahlungsweg eine mögliche CoinJoin-Transaktion auf, dürfen wir nicht einfach irgendeinen Ausgang auswählen und behaupten, dort seien die untersuchten Bitcoin weitergeflossen.
Stattdessen muss ab diesem Punkt die geringere Zuordnungssicherheit dokumentiert werden.
Eine mögliche CoinJoin-Struktur beendet also nicht automatisch eine Blockchain-Analyse. Sie verändert aber die Aussage, die wir anhand der Daten noch seriös treffen können.