Lecture 6: Bitcoin and Anonymity

What this lecture covers

Following the mining lecture, this one tackles one of Bitcoin's most debated properties: how anonymous is it really? The lecture distinguishes pseudonymity from true anonymity, explains why Bitcoin only offers the former, and surveys the techniques researchers and practitioners have proposed to deanonymize users as well as the techniques proposed to protect them. It also treats the ethics of anonymous money directly rather than avoiding the question.

By the end, you should be able to explain the difference between pseudonymity and anonymity, describe how transaction graph analysis and network-layer analysis can link Bitcoin addresses to real identities, and compare mixing, CoinJoin, Zerocoin and Zerocash as increasingly strong (and increasingly hard to deploy) anonymity techniques.

Key ideas

• Pseudonymity vs anonymity: computer scientists define anonymity as pseudonymity plus unlinkability; Bitcoin gives you pseudonymous addresses but does not, by itself, prevent those addresses from being linked together or to you.
• Anonymity set: rather than aiming for complete unlinkability, anonymity is measured by the size of the set of other transactions or addresses an observer cannot distinguish yours from.
• Shared spending reveals control: when a transaction combines multiple input addresses, that is evidence those addresses are controlled by the same person, and this linkage can be extended transitively into large clusters.
• Change address heuristics: because most wallets use a change address only once, researchers can often guess which output of a multi-output transaction is change, letting them grow address clusters further.
• Network-layer deanonymization: broadcasting a transaction can reveal the IP address of its originating node, independent of anything recorded on the blockchain; routing Bitcoin traffic through Tor mitigates this.
• Mixing: sending coins through an intermediary that mixes deposits together breaks the direct link between input and output addresses, though a trustworthy, standardized mixing ecosystem barely exists in practice.
• CoinJoin: a decentralized alternative where multiple users jointly build one transaction with combined inputs and outputs, avoiding the need to trust a centralized mixing service, at the cost of peer discovery and denial-of-service problems.
• Zerocoin and Zerocash: protocol-level anonymity schemes using zero-knowledge proofs that replace trust in a mix with trust in cryptography, at the cost of being separate altcoins rather than compatible extensions of Bitcoin.

Walkthrough

What anonymity means, and quantifying it (2:35)

The lecture opens by contrasting claims that Bitcoin is anonymous (e.g. a Wikileaks donation page) with claims that it is not. It defines pseudonymity as interacting under a persistent alias, and anonymity as pseudonymity plus unlinkability, illustrating the distinction with the difference between Reddit-style persistent handles and 4chan-style unattributed posts. It explains that pseudonymous profiles are fragile: a single real-world interaction, such as paying for coffee, can link a whole profile to your identity, and side channels like activity-time correlation can do the same. It introduces the anonymity set as the practical way to quantify anonymity, and warns that intuitive techniques like taint analysis are weak measures compared to careful, adversary-specific analysis.

The ethics of anonymity and precedents like Tor (13:04)

The lecture directly addresses money laundering concerns, arguing that the hard part of laundering is moving large sums into and out of the currency system, not tracing flows within Bitcoin, and recommends keeping anonymity technology and law-enforcement policy as separate concerns. It draws an extended parallel to Tor, which enables both legitimate privacy uses (journalists, ordinary users, even law enforcement) and illegitimate ones, and notes that society has generally judged Tor's existence worthwhile despite its misuse, with the US State Department among its funders.

The history of anonymous e-cash (18:24)

Before Bitcoin, David Chaum proposed blind signatures in 1982 to build anonymous electronic cash. The lecture walks through a simplified version: a bank maintains balances and a spent-coins list, and issues a blind signature on a serial number it never actually sees, letting a user later prove a coin is legitimate without the bank knowing who withdrew it. The scheme requires trusting a central bank with custody of funds, which the lecture uses to explain why anonymization and decentralization are in tension: interactive blinding protocols typically need a central party, and decentralized systems that avoid double-spending by recording everything publicly tend to weaken anonymity.

Linking addresses and transactions on the blockchain (28:21)

Using the example of Alice buying a teapot, the lecture shows how combining multiple inputs into one transaction reveals joint control of those addresses, and how this clustering can be applied transitively. It covers "idioms of use," such as detecting change addresses because wallets typically use them only once, and cites research that used these heuristics plus real transactions with services to label large address clusters (identifying Mt. Gox, Satoshi Dice, and others) and connect individual clusters to real identities through direct interactions or carelessness like posting addresses in forums.

Network-layer deanonymization and mixing (42:03)

The lecture explains how broadcasting a transaction can expose the originating IP address to observers on the peer-to-peer network, a problem largely solved by routing over Tor. It then introduces mixing services as intermediaries that break input-output linkage, contrasts them with online wallets (which offer only weak, custodian-trusted anonymity), and lays out four design principles for trustworthy mixing: chaining multiple mixes, standardizing chunk sizes, automating client software, and using all-or-nothing mixing fees. It acknowledges that almost no real-world mixing service follows these principles today.

Decentralized mixing with CoinJoin (1:07:48)

CoinJoin, proposed by Bitcoin developer Greg Maxwell, lets multiple users jointly construct one transaction with combined inputs and outputs, so no single party learns the full input-output mapping and no central mix needs to be trusted. The lecture works through the protocol and its three open problems: finding peers, hiding the input-output mapping (addressed by routing over Tor or dedicated mix networks), and denial-of-service resistance (addressed by proof of work, proof of burn, or cryptographic blaming protocols like CoinShuffle). It also flags subtler side channels, such as habitual fixed-amount transfers, and describes "merge avoidance" as a way to reduce these patterns.

Zerocoin and Zerocash (1:20:59)

The lecture introduces Zerocoin as a way to bake mixing directly into the protocol using zero-knowledge proofs: a cryptographic commitment ("zero coin") can later be redeemed for a base coin without revealing which original coin it came from, giving a cryptographic guarantee of anonymity rather than one based on trusting an intermediary. Zerocash extends this with more efficient cryptography (zk-SNARKs) so that transaction amounts themselves stay hidden, eliminating the need for a separate base coin. Both are not backward compatible with Bitcoin and would have to run as separate altcoins; Zerocash also requires a delicate one-time setup process whose secret parameters must be destroyed and never recovered.

Anonymous communication and Silk Road (1:20:15)

Closing the lecture, it explains how Tor's onion routing hides the link between sender and recipient through layered encryption across a chain of relays, and how hidden services like Silk Road used Tor rendezvous points and .onion addresses to keep their server location hidden while still processing payments in Bitcoin. It notes that Bitcoin anonymity becomes more powerful combined with anonymous communication, and closes by summarizing the whole spectrum of anonymity techniques from plain pseudonymous Bitcoin through Zerocash.

Before you watch

• Watch the earlier lecture on Bitcoin mining, since this lecture assumes familiarity with transactions, addresses, and how the blockchain is structured.
• A basic grasp of public-key hashes as Bitcoin addresses (from earlier lectures) is needed to follow the discussion of address clustering.

Check your understanding

1. What is the difference between pseudonymity and anonymity, and which one does Bitcoin provide by default?
2. How can combining multiple inputs into a single transaction reveal information an adversary can exploit?
3. Why do the lecturer's proposed mixing principles (chained mixes, standard chunk sizes, automated clients, all-or-nothing fees) matter for anonymity?
4. What problem does CoinJoin solve that centralized mixing services do not, and what new problems does it introduce?
5. Why can't Zerocoin or Zerocash simply be added to Bitcoin as a soft fork?