Mixing bitcoin using Whirpool can achieve anonymity. Here are a few tools to help maintain that privacy benefit when spending.

Considerations should be made when spending Whirlpool unspent transaction outputs (UTXOs) so that the anonymity benefits of mixing your bitcoin are kept intact. There are transaction tools that help you spend your post-mix bitcoin in a way that maintains anonymity, each tool offers different techniques and it's important to understand the differences so that you can always use the right tool for the job.

This article will explore some basic concepts related to the wallet structure around Whirlpool and demonstrate the post-mix spending tools built into Samourai Wallet and Sparrow Wallet.

Although this article focuses on using these tools from the post-mix wallet, they can be used from the other wallets as well.

In both Samourai Wallet and Sparrow Wallet, the Whirlpool implementation is such that there is a four wallet structure used. These four wallets are all managed by your wallet software in the background, and from the user's perspective, you can navigate between wallets seamlessly.

Structuring the wallets in such a way is important so that your UTXOs remain sequestered from each other, this way your UTXOs follow a logical path through the different stages along their way to the post-mix stage and arrive there without any deterministic links to prior transaction history.

Both Samourai Wallet and Sparrow Wallet have support for the following address formats:

Having support for all of these address types does not mean that they all work with Whirlpool. Whirlpool only works with P2WPKH addresses on both Bitcoin’s mainnet and testnet. Therefore the four wallets described below all handle receiving P2WPKH addresses only and can spend to P2PKH, P2SH, P2WPKH or P2TR addresses.

The wallet software uses different derivation paths to achieve the separate wallets. Derivation paths use different numbers to represent different details about the key path: “m / purpose' / coin_type' / identity'.” In the example below, the deposit wallet can handle a variety of address types, hence the “m/44'|m/49'|m/84'|m/47'” for each of the different purposes. The pre-mix, post-mix and bad bank wallets only handle the “m/84'” purpose.

In Samourai Wallet, you can toggle from your deposit wallet to your post-mix wallet by pressing the Samourai icon in the upper left-hand corner. 

In Sparrow Wallet, you can toggle between the four wallets using the tabs on the far left-hand side of the interface.

There are four pool sizes in Whirlpool: 0.5, 0.05, 0.01 and 0.001 BTC. This means that each Whirlpool output will be the same as the pool size. When you select UTXOs from your deposit wallet for Whirlpool CoinJoins, they go through a tx0 first. The results of this tx0 vary based on which pool size you select. For example, if you want to Whirlpool 10 bitcoin, the different pool sizes would produce these results through tx0:

Note that the Whirlpool coordinator fee remains the same regardless of how much bitcoin you are mixing. If you mix 1 BTC or 100 BTC in the 0.5 pool as an example, you will pay 0.0175 BTC for the coordinator fee either way.

Also note that the miner fee included with each pre-mix UTXO can accumulate to a large amount in miner fees as the number of pre-mix UTXOs increases. In the 0.001 pool example above, the total in miner fees is 0.099 BTC.

tx0 applies in both Samourai Wallet and Sparrow Wallet. A tx0 is always constructed in such a way that one or more inputs from your deposit wallet are divided into:

Here is an actual tx0 example, you can see that there was:

You can view this transaction on KYCP.org.

Each of the 16 equal-sized outputs will be individually selected for inputs to downstream Whirlpool CoinJoins. These outputs reside in the pre-mix wallet temporarily as available inputs to Whirlpool CoinJoins. As new Whirlpool transactions are initiated, the coordinator will look for available inputs such as these. The Whirlpool coordinator enforces strict rules that ensure no two outputs from the same tx0 or same wallet wind up in the same Whirlpool CoinJoin transaction. Each of these 16 outputs carries a small amount of extra bitcoin so that once they are selected as inputs, they can help cover the miners fee for the Whirlpool CoinJoin transaction.

The coordinator will randomly switch between creating transactions that have either two fresh participant UTXOs and three re-mix UTXOs or three fresh participant UTXOs and two re-mix UTXOs. The fresh participant UTXOs always cover the miner fee and the "free-rider" UTXOs always get to re-mix for free. This way, you only pay the Whirlpool coordinator fee once and then your UTXOs can remain in your post-mix wallet remixing for free for as long as you want to keep them there.

Special considerations should be given to toxic change from the tx0. By default, Samourai Wallet will prompt you to mark the toxic change UTXO as "unspendable" during the tx0 initiation. Marking this UTXO in such a way prevents your wallet from displaying it as an available UTXO and excludes it from your displayed balance.

You can always navigate to the three-dot menu in the upper right-hand corner of the Samourai Wallet application and select “Show unspent outputs,” scroll to the bottom of the list and you will see your toxic change listed under “Do Not Spend.” Select the UTXO of interest and then you can update the spending status to "Spendable" if you want to. Then it will be displayed as part of your deposit wallet balance and spendable again.

In Sparrow Wallet, the toxic change is automatically sent to your bad bank wallet after the tx0. You can go to the bad bank wallet tab and spend that UTXO from there at any time.

The issue with toxic change is that on-chain, it is still linked with the tx0 it came from. This means that it is also linked to all the previous transaction history of all the inputs to that tx0. So if an external observer was tracking the movement of bitcoin belonging to a known entity, then they would know that this toxic change output belongs to that entity. Therefore, using on-chain heuristics, the external observer could reasonably assume that any bitcoin combined with the toxic change in a future transaction also belongs to the known entity.

Using that logic, combining a toxic change UTXO with a post-mix UTXO would undo the anonymity benefits gained in Whirlpool. However, because of the wallet structure, you would really need to go out of your way and do something weird to commingle a toxic change UTXO and a Whirlpool output.

The "waterfall technique" is where you start with the largest pool size you can given your available UTXOs in the deposit wallet. Then you take that toxic change output and use it alone in the next largest pool size you can, then repeat this process until you are left with the smallest possible toxic change amount.

Another technique that is currently in development with Samourai Wallet is doing an atomic swap with Monero. This would require you to have a separate Monero wallet like Monerujo because Monero will not be implemented in Samourai Wallet. But basically you could construct the Bitcoin transaction that trustlessly swaps your bitcoin with a peer for their XMR to your Monero wallet and your toxic change goes to their Bitcoin wallet. Then at a later time you could swap back for bitcoin or you could spend that XMR, the options are wide open for you.

After moving from your deposit wallet to your pre-mix wallet through a tx0, your pre-mix UTXOs are ready to be included in Whirlpool CoinJoins. Your wallet and the Whirlpool coordinator automatically take care of this in the background after you initiate your tx0. Each output from a Whirlpool CoinJoin is one-of-five equal-sized outputs. To an external observer looking at a block explorer, they have no way to make a determination with certainty that a particular output belongs to a particular input. All of the five outputs have an equal probability of belonging to any of the five inputs. This concept is illustrated well with KYCP.org.

Here is another way to look at the same Whirlpool CoinJoin transaction, as a table listing the likelihood of value transfer between input and output.

Because all of the outputs are the same size and have the same likelihood of belonging to any given input, there is no distinguishing characteristic about them. This is anonymity, the quality or state of being indistinguishable from a crowd. Once this anonymity is achieved, you want to ensure you preserve it so that you can continue spending bitcoin on a public blockchain without revealing details that would reveal prior on-chain transaction history that exposes further details about you as an entity.

To learn more about anonymity sets in relation to Whirlpool CoinJoins, read this article.

BIP47 enables reusable payment codes that can be displayed like a static Bitcoin address on a website or a shop window, for example. The advantage with the payment code is that external observers cannot see any transaction history or balances from the payment code like they can with a Bitcoin address.

At a high level, details are combined from the payment codes belonging to both transaction participants, resulting in an index of addresses that is only known to the two participants. This way, anyone who approaches a publicly-displayed payment code and connects to it with the on-chain notification transaction will be able to send payments to the resulting addresses that are unique to that particular connection. There is no need for an active server to deliver a fresh address each time, as is the case with a payment server like BTCPay Server.

This is an example of a BIP47 payment code:

“PM8TJK7rnkDXabzmo4ZyxX49JxdLWhbFANDr4eBCwk1shDEs1qDysW5hFCFr6hschwJe4ny7C7GcSnsNPzBYvE6giabxfJyNSrAWRJYCoHMo7iveHned”

This can also be displayed as a QR code:

PayNyms on the other hand, are an implementation of BIP47 used in Samourai Wallet and Sparrow Wallet. PayNyms are derived from hashing your payment code to generate a unique robot avatar and a unique name. The avatar and name make it easier for humans to interpret and handle. Samourai Wallet maintains a directory of PayNyms if you want to explore, search and connect with others: https://paynym.is/. This is an opt-in directory that you can use to register your PayNym if you choose to do so from the app while initializing.

PayNyms can be used in a couple of different ways.

For one, you can use them to make direct payments to someone else's PayNym by making the on-chain connection and generating the index of secret addresses. When speaking specifically about non-collaborative PayNym payments, if you don't make the on-chain notification transaction, then the receiver will not know the addresses to observe between your wallets.

This should not be confused with collaborative transactions using PayNyms which only require that the PayNyms follow each other and not the on-chain notification transaction. In other words, if you import someone else's payment code to your wallet and start calculating address to send them bitcoin, unless the on-chain notification transaction is made, the receiver will not know which addresses to observe for those payments; in that scenario, you would want to communicate your payment code to them so they know how to derive those address and observe them. Once a payment code is scanned and the on-chain notification transaction is made, there is no need for collaboration from the receiver; you can just start sending payments to them.

The other way to use PayNyms is through collaborative transactions like Stowaway and StonewallX2, which will be covered in later sections.

First, making the on-chain connection will be demonstrated:

Once your on-chain connection has been confirmed, you can navigate back to your PayNym and press the paper airplane icon to initiate a payment to your contact from your deposit wallet. Simply enter the amount, review the transaction and broadcast.

Alternatively, you can spend from your post-mix wallet directly to your PayNym contact.

Sparrow Wallet also has all the same features as just described with sending direct PayNym payments with Samourai Wallet. The layout of the interface is just a little different.

Stowaway is a collaborative post-mix spending tool that obfuscates the amount being spent. The person you collaborate with will be the one receiving the spend. You provide some inputs, the receiver provides some inputs, you receive your change output, the receiver gets their change plus the amount you sent them, thus the actual amount spent is hidden in that total. The sender pays the full miner fee.

An external observer would have no way of knowing this transaction is anything different than what is presented at face value. The common input ownership heuristics are broken because of the multiple inputs and outputs, the consideration must be made that multiple people contributed to the inputs.

Anyone you are sending a Stowaway transaction to will need to be using Samourai Wallet or Sparrow Wallet with their PayNym. At a minimum, the PayNyms should be following each other but it is not necessary to make the on-chain notification transaction to "connect" the PayNyms.

Collaborators will need to have a way of communicating with each other out of band, like with a messaging app, phone call, etc.

To create a collaborative Stowaway transaction in Samourai Wallet, make sure you and your collaborator are following each other's PayNyms, it is not necessary to make the on-chain connection though.

The collaborating peer will receive their input to the transaction back with the amount you sent them added to the new output. The actual amount sent is obfuscated.

To create a collaborative Stowaway transaction in Sparrow Wallet, make sure you and your collaborator are following each other's PayNyms, it is not necessary to make the on-chain connection though.

You can review this transaction on your favorite Bitcoin testnet explorer, for example on mempool.space.

The amount sent was 69 sats, but you would never know that as an external observer to this transaction.

StonewallX2 is another collaborative spending tool that helps break on-chain heuristics and maintain anonymity. StonewallX2 transactions always have four outputs. The number of inputs can vary. At least two of those outputs are identical in size, this creates a decoy output the same size as the spend. The other two outputs are the change being returned to both collaborators. Unlike Stowaway transactions, StonewallX2 transactions can be spent to a third party — the spend does not have to be made to the collaborating partner. The collaborating peers in a StonewallX2 transaction split the miners’ fee 50/50. The input selection algorithm enforces that no UTXOs that share the same previous transaction will be used as inputs together in a new transaction.

Here is how a StonewallX2 (and a Stonewall) will look on-chain:

To create a StonewallX2 transaction in Samourai Wallet, make sure you and your collaborator are following each other's PayNyms, it is not necessary to make the on-chain connection though. Also, if the receiver of this collaborative spend is a PayNym then you need to be following them as well.

To create a StonewallX2 transaction in Sparrow Wallet, make sure you and your collaborator are following each other's PayNyms, it is not necessary to make the on-chain connection though. Also, if the receiver of this collaborative spend is a PayNym then you need to be following them as well.

You will wait a moment while your collaborating peer accepts the request and the transaction is built. Both peers are providing inputs to the transaction.

After a moment, you will be presented with a summary of the transaction that has been created. If everything looks good then select “Sign & Broadcast.”

Once the transaction is broadcast, you will receive a green check mark.

You can review this transaction on your favorite Bitcoin testnet explorer, for example on mempool.space.

The transaction has four outputs and two of them are the same size, one 25,000 sat spend and one 25,000 sat decoy. To an external observer they can not tell which outputs belong to the entity in control of any of the inputs.

Here is how a Stonewall (and a StonewallX2) will look on-chain. Stonewall is a non-collaborative spending tool that helps break on-chain heuristics and maintain anonymity. On-chain, Stonewall and StonewallX2 transactions are indistinguishable; they both always have four outputs. The number of inputs can vary. At least two of those outputs are identical in size, this creates a decoy output the same size as the spend. The other two outputs are the change being returned.

In the case of a Stonewall transaction, the wallet will build the transaction using multiple inputs and four outputs, only one is the spend and the other three are all sent back to the sender's wallet with one of them being the same size as the spend. Both Samourai Wallet and Sparrow Wallet will attempt to compose a Stonewall transaction by default when spending.

To make a Stonewall transaction with Samourai Wallet:

You can review this transaction on your favorite Bitcoin testnet explorer, for example on mempool.space.

The transaction has four outputs and two of them are the same size, one 42,000 sat spend and one 42,000 sat decoy. To an external observer they can not tell which outputs belong to the entity in control of any of the inputs. Three out of the four outputs are being returned to the sender's post-mix wallet.

To make a Stonewall spend with Sparrow Wallet:

Notice the difference in how the transaction is constructed when selecting the “Efficiency” setting; there are two outputs, the spend and the change:

Contrast that with selecting the “Privacy” setting; this builds a Stonewall transaction where there are four outputs including a decoy spend:

If everything looks good on the next screen, select “Sign.”

Once signed, you can broadcast the transaction.

You can review this transaction on your favorite Bitcoin testnet explorer, for example on mempool.space.

mempool_stonewall.png

The transaction has four outputs and two of them are the same size, one 690,000 sat spend and one 690,000 sat decoy. To an external observer they can not tell which outputs belong to the entity in control of any of the inputs.

Ricochet is a post-mix spending tool that creates multiple hops between the initial sending transaction and the final destination. This technique can be useful when sending bitcoin to a destination where the receiver will snoop back through your transaction history to determine if there is something about your UTXO they don't like.

Oftentimes this type of behavior is carried out by exchanges or some merchants; read this article by 6102 for more details on CoinJoin flagging. There is no industry standard that these flagging companies adhere to, they will arbitrarily decide how many hops back is within their own risk tolerance. But the five hops that Ricochet provides seems to be doing the job. Sparrow Wallet does not support Ricochet transactions. Samourai Wallet collects a 100,000 sat fee for this service.

To compose a Ricochet transaction in Samourai Wallet:

Otherwise, all five hops will occur in the same block, which may be preferable to you if time is of the essence.

Here is how this Ricochet transaction looks on testnet. You can follow the hops along the way.

This article explained how the wallet structure works in the Whirlpool-enabled wallets, Samourai Wallet and Sparrow Wallet.

By understanding the anonymity benefits achieved through Whirlpool, you can then better understand which post-mix spending tool is right for the job. Each post-mix spending tool was explained in detail with step-by-step instructions on how to use them and the additional anonymity preservation benefits they offer.

To learn more, join the communities on the Samourai Wallet Telegram channel or the Sparrow Wallet Telegram channel, where you will find several other users helping each other out on a variety of topics.

This is a guest post by Econoalchemist. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.

Similar to Notcoin - Blum - Airdrops In 2024

origin »

226 +