Understanding coinjoin transactions

How Whirlpool works

Privacy on Bitcoin

How Whirlpool works

How Whirlpool works
Coinjoin pools and fees
HD wallet accounts
The TX0
The doxxic changes
The initial mix
Remixes
How do you manage your postmixes?
How do you manage toxic changes?
How do I use Whirlpool?

What sets Whirlpool apart from other coinjoin methods is the use of "ZeroLink" transactions, which ensure that there is strictly no possible technical link between all inputs and outputs. This perfect mix is achieved through a structure in which each participant contributes an identical amount of input (with the exception of mining fees), generating outputs of perfectly equal amounts.

This restrictive approach to inputs gives Whirlpool's coinjoin transactions a unique feature: the total absence of deterministic links between inputs and outputs. In other words, each output has an equal probability of being attributed to any participant, relative to all other outputs in the transaction.

How Whirlpool works

Initially, the number of participants in each Whirlpool coinjoin was limited to 5, with 2 new entrants and 3 remixers (we'll explain these concepts later). However, the increase in on-chain transaction fees observed in 2023 prompted Samourai's team to rethink their model, aiming to improve confidentiality while reducing costs. Thus, taking into account the fee market situation and the number of participants, the coordinator can now organize coinjoins including 6, 7, or 8 participants. These enhanced sessions are known as "Surge Cycles". It's essential to note that, regardless of the configuration, there are always only two new entrants to Whirlpool coinjoins.

Thus, Whirlpool transactions are characterized by an identical number of inputs and outputs, which can be:

5 inputs and 5 outputs;

6 inputs and 6 outputs;

7 inputs and 7 outputs;

8 inputs and 8 outputs.

Whirlpool's model is based on small coinjoin transactions. Unlike Wabisabi and JoinMarket, where the robustness of anonsets is based on the volume of participants in a single cycle (or on a few cycles), Whirlpool relies on the sequence of several small cycles.

In this model, users pay fees only when they first join a pool, enabling them to participate in a multitude of remixes at no extra cost. New entrants pay the mining fees for remixers.

With each additional coinjoin in which a UTXO participates, as well as its peers encountered in the past, the anonsets will grow exponentially. The aim is to take advantage of these free remixes, which, each time they occur, contribute to reinforcing the density of the anonsets associated with each UTXO mixed.

Whirlpool has been designed with two important requirements in mind:

The accessibility of the implementation on mobile devices, given that Samourai Wallet is first and foremost a smartphone application;
Fast remixing cycles to promote a significant increase in anonsets.

These imperatives guided the choices made by Samourai Wallet's developers in designing Whirlpool, leading them to restrict participants to a limited number per cycle. Too few would have compromised coinjoin efficiency, drastically reducing the number of anonsets generated per cycle, while too many would have posed management problems for mobile applications and hindered cycle flow.

Finally, there's no need to have a high number of participants per coinjoin on Whirlpool, since anonsets are made on the accumulation of several coinjoin cycles. The most important principle here is the homogeneity of the UTXOs of all participants, as this ensures perfect mixing and, therefore, full benefit from the mixing and remixing cycles.

Coinjoin pools and fees

For these multiple cycles to increase the anonsets of the mixed UTXOs, a specific framework is needed to restrict the amounts of UTXOs used. Whirlpool defines different pools.

A pool represents a group of users who wish to combine their resources, agreeing on the amount of UTXOs to be used to optimize the coinjoin process while maintaining perfect UTXO homogeneity. Each pool specifies a fixed UTXO amount, which the user must adhere to in order to participate. So, to make a coinjoin with Whirlpool, you need to select a pool. The following pools are currently available:

0.5 bitcoins;
0.05 bitcoin;
0.01 bitcoin;
0.001 bitcoin (= 100,000 sats).

When you enter a pool with your bitcoins, they will be divided up to generate UTXOs that are perfectly homogenous with those of the other participants in the pool. Each pool has a maximum limit, so for amounts exceeding this limit, you will either have to make two separate entries into the same pool or move to another pool with a higher amount:

Pool (bitcoin)	Maximum amount per entry (bitcoin)
0.5	35
0.05	3.5
0.01	0.7
0.001	0.025

A UTXO is considered to belong to a pool when it is ready to be integrated into a coinjoin. However, this does not mean that the user loses possession of it. As we saw in the first chapters of this section, through the various mixing cycles, you retain full control of your keys and, consequently, of your bitcoins. This is what differentiates the coinjoin technique from other centralized mixing techniques.

To join a coinjoin pool, you need to pay a service fee and a mining fee. Service fees are fixed for each pool and are intended to remunerate the teams responsible for Whirlpool's development and maintenance.

The service fee for the use of the Whirlpool is payable only once when you join the pool. Once you've joined, you can participate in an unlimited number of remixes at no extra charge. Here are the current fixed fees for each pool:

Pool (bitcoin)	Entry fee (bitcoin)
0.5	0.0175
0.05	0.00175
0.01	0.0005 (50,000 sats)
0.001	0.00005 (5,000 sats)

These fees essentially function as an entry ticket to the chosen pool, regardless of the amount you put in coinjoin. So, whether you enter the 0.01 pool with exactly 0.01 BTC or 0.5 BTC, the fees will remain the same in absolute terms.

Before proceeding with Whirlpool coinjoins, the user can choose between 2 strategies:

Opt for a smaller pool to minimize service costs, knowing that he'll get several smaller UTXOs in return;
Or opt for a larger pool, willing to pay higher fees, only to end up with a smaller number of higher-value UTXOs.

It's generally not advisable to merge several mixed UTXOs after coinjoin cycles, as this could compromise acquired confidentiality, particularly due to the common input ownership heuristic (CIOH: Common-Input-Ownership-Heuristic). Consequently, it may be advisable to choose a larger pool, even if this means incurring additional costs, to minimize the number of small-value UTXOs in the output. The user must evaluate these trade-offs to choose the pool they prefer.

In addition to the service fee, the mining fee specific to any Bitcoin transaction must also be taken into account. As a Whirlpool user, you will be required to pay the mining fee for the preparation transaction (Tx0) as well as for the first coinjoin. All subsequent remixes will be free of charge, thanks to Whirlpool's model, which is based on paying new entrants.

In fact, in each Whirlpool coinjoin, 2 users among the inputs are new entrants. The other inputs come from remixers. As a result, the mining costs for all participants in the transaction are borne by these 2 new entrants, who can then also benefit from free remixes:

Thanks to this fee system, Whirlpool really stands out from other coinjoin implementations, since the UTXOs' anonsets are not proportional to the price paid by the user. As a result, it is possible to achieve considerably higher levels of anonymity by paying only the pool entry fee and the mining fee for 2 transactions (the Tx0 and the initial mix).

It's important to note that the user will also have to pay the mining fees to withdraw his UTXOs from the pool after completing his multiple coinjoins, unless he has selected the mix to option, which provides an external address that will receive the funds directly out of the coinjoin, without any additional transaction.

HD wallet accounts

To create a coinjoin via Whirlpool, the wallet must generate several separate accounts. This is the principle behind the ZeroLink protocol. An account, in the context of an HD (Hierarchical Deterministic) wallet, constitutes a section entirely isolated from the others, this separation occurring at the third level of the wallet hierarchy, i.e., at the xpub level.

An HD wallet can theoretically derive up to 2^(31) different accounts. The initial account, used by default on all Bitcoin wallets, corresponds to the 0' index.

For wallets adapted to Whirlpool, 4 accounts are used to meet the needs of the ZeroLink process:

The deposit account, identified by index 0';
The bad bank (or "doxxic change") account, identified by the index 2,147,483,644';
The premix account, identified by the index 2,147,483,645';
The postmix account, identified by the index 2,147,483,646'.

Each of these accounts fulfills a particular function in the coinjoin process, which we'll explore in the following sections.

All these accounts are linked to a single seed, enabling the user to recover access to all their bitcoins using their recovery phrase and, where applicable, their passphrase. During the recovery operation, however, the software must be informed of the various account indexes used.

Let's take a look at the different stages of a Whirlpool coinjoin within these accounts.

The TX0

The starting point of any Whirlpool coinjoin is the deposit account. This is the account you automatically use when you create a new Bitcoin wallet. This account will need to be credited with the bitcoins you wish to mix.

Tx0 is the first step in Whirlpool's mixing process. Its purpose is to prepare and equalize the UTXOs for the coinjoin, dividing them into units corresponding to the amount of the selected pool, to ensure homogeneous mixing. The UTXOs thus equalized are then sent to the premix account. As for the difference that cannot be entered into the pool, it is separated into a specific account: the bad bank (or "doxxic change").

This initial Tx0 transaction is also used to pay the service fee due to the coinjoin coordinator. Unlike the following steps, this transaction is not collaborative, so the user must bear the full cost of mining:

In this example of a Tx0 transaction, an input of 372,000 sats from our deposit account is split into several output UTXOs, which break down as follows:

An amount of 5,000 sats for the coordinator for service fees, corresponding to the pool entry of 100,000 sats;
3 UTXOs prepared for mixing, redirected to our premix account, and registered with the coordinator. These UTXOs are equalized at 108,000 sats each, to cover the mining costs for their future initial mix;
The surplus, which cannot enter the pool because it is too small, is considered a toxic change. It is sent to its specific account. Here, this change amounts to 40,000 sats;
Finally, there are 3,000 sats left, which do not constitute an output, but are the mining costs required to confirm Tx0.

For example, here's a real Whirlpool Tx0 (not mine): edef60744f539483d868caff49d4848e5cc6e805d6cdc8d0f9bdbbaedcb5fc46

The doxxic changes

The surplus that cannot be integrated into the pool, equivalent to 40,000 sats, is redirected to the bad bank account, also known as "doxxic change", to ensure strict separation from the other UTXOs in the wallet.

This UTXO poses a threat to the user's confidentiality, as it is still linked to its past and, therefore, potentially to the identity of its owner. Additionally, it is noted as belonging to a user who has made a coinjoin.

If this UTXO is merged with mixed outputs, the latter will lose all the confidentiality gained during coinjoin cycles, notably due to CIOH (Common-Input-Ownership-Heuristic). If it is merged with other doxxic changes, the user risks losing confidentiality, since it will link the various coinjoin cycle entries. It should therefore be treated with caution. We'll go into more detail on the management of these UTXOs doxxic in the last section of this chapter.

The initial mix

After Tx0, the equalized UTXOs are sent to our wallet's premix account, ready to be introduced into their first coinjoin cycle, also known as the "initial mix". If, as in our example, Tx0 generates several UTXOs for mixing, each will be integrated into a separate initial mix.

At the end of these first mixes, the premix account will be empty, while our coins, having paid the mining fees for this first coinjoin, will be adjusted exactly to the amount defined by the chosen pool. In our example, our initial UTXOs of 108,000 sats will have been reduced to exactly 100,000 sats.

Remixes

After performing the initial mix, the UTXOs are transferred to the postmix account. This account gathers UTXOs that have already been mixed as well as those awaiting remixing. When the Whirlpool client is active, the UTXOs located in the postmix account are automatically available for remixing and will be randomly selected to participate in these new cycles.

As a reminder, remixes are then 100% free: no additional service charges or mining fees are required. Keeping UTXOs in the postmix account, therefore, preserves their value while also enhancing their anonymity. That's why it's important to allow these coins to participate in several coinjoin cycles. It costs you absolutely nothing and increases their anonymity levels.

When you decide to spend mixed UTXOs, you can do so directly from this postmix account. We recommend keeping mixed UTXOs in this account to benefit from free remixes and to prevent them from leaving the Whirlpool circuit, which could compromise their confidentiality.

How do you manage your postmixes?

After running coinjoin cycles, the best strategy is to keep your UTXOs in the postmix account, awaiting future use. It's even advisable to let them remix indefinitely until you need to spend them.

Some users might consider transferring their mixed bitcoins to a wallet secured by a hardware wallet. This is possible, but it's essential to follow Samourai Wallet's recommendations strictly to avoid compromising the confidentiality that has been established.

Merging UTXOs is the most common mistake. To avoid CIOH (Common-Input-Ownership-Heuristic), you must avoid combining mixed UTXOs with unmixed UTXOs in the same transaction. This requires careful management of your UTXOs within your wallet, particularly in terms of labeling.

Care must also be taken when consolidating mixed UTXOs. Moderate consolidation is possible if your mixed UTXOs have significant anonsets, but this will inevitably reduce the confidentiality of your UTXOs. Ensure that consolidations are neither too extensive nor carried out after an insufficient number of remixes, as this may establish deducible links between your UTXOs before and after coinjoin cycles. When in doubt about these manipulations, the best practice is not to consolidate postmix UTXOs, but to transfer them one by one to your hardware wallet, generating a new blank address each time. Once again, remember to label each UTXO you receive.

It's also not advisable to transfer your postmix UTXOs to a wallet using scripts that are not widely used. For example, if you enter Whirlpool from a multisig wallet using P2WSH scripts, there's little chance that you'll be mixed with other users who originally had the same type of wallet. If you remix your postmixes to this same multisig wallet, the level of confidentiality of your mixed bitcoins will be greatly reduced. Beyond scripts, there are many other wallet fingerprints that can play tricks on you.

As with any Bitcoin transaction, it is also important not to reuse the receiving address. Each new transaction must be received on a new, blank address.

The simplest and safest solution is to leave your mixed UTXOs resting in their postmix account, allowing them to continue remixing and touching them only when spending. The Samourai wallets (and now Ashigaru) and Sparrow include additional protections against all these risks related to chain analysis. These protections help you avoid making mistakes.

How do you manage toxic changes?

Next, you'll need to be careful about managing doxxic change, the change that didn't make it into the coinjoin pool. These toxic UTXOs, resulting from the use of Whirlpool, pose a risk to your privacy, since they establish a link between you and the coinjoin user. It is therefore imperative to manage them with care and not to combine them with other UTXOs, especially mixed UTXOs.

Here are some strategies for using them:

Mix them into smaller pools: If your toxic UTXO is large enough to fit into a smaller pool on its own, consider mixing it. This is often the best option. However, it's not advisable to merge several toxic UTXOs to access a pool, as this could link your different entries.
Mark them as "non-spendable": Another approach is to stop using them, mark them as "non-spendable" in their dedicated account, and just hodl. This ensures that you don't accidentally spend them. If the value of bitcoin rises, new pools more suited to your toxic UTXOs may emerge.
Make donations: Consider making donations, however modest, to developers working on Bitcoin and related software. You can also donate to associations that accept BTC. If managing your toxic UTXOs seems too complicated, you can simply get rid of them and make a donation.
Buy gift cards: Platforms such as Bitrefill allow you to exchange bitcoins for gift cards that can be used at various merchants. This can be a way of parting with your toxic UTXOs without losing the associated value.
Consolidating them via Monero: Samourai Wallet once offered an atomic swap service between BTC and XMR, which has unfortunately been unavailable since their arrest. This approach made it possible to handle toxic UTXOs by consolidating them on Monero without compromising your privacy through CIOH, before sending them back to Bitcoin. If an equivalent service reappears, it may be a worthwhile option. However, keep in mind that this method can become costly, both in mining fees and in premiums linked to liquidity constraints during the reverse conversion back to bitcoins.
Send them to the Lightning Network: Transferring these UTXOs to the Lightning Network to benefit from reduced transaction fees can be an attractive option. However, this method may reveal certain information depending on how you use Lightning, and should therefore be used with caution.

How do I use Whirlpool?

Following the arrest of the founders of Samourai Wallet and the seizure of their servers on April 24, 2024, the Whirlpool tool is no longer available on Samourai Wallet and Sparrow Wallet.

From now on, Whirlpool is once again accessible on the Ashigaru mobile application, a fork of Samourai Wallet, thanks to the Ashigaru Terminal software.

Ashigaru TerminalUse Ashigaru on desktop to make coinjoins

The core functioning of Whirlpool remains unchanged, but there are still some differences compared to its use on Samourai: in 2025, on Ashigaru, only two pools are available, with amounts of 0.25 BTC and 0.025 BTC, and respective entry fees of 0.0125 BTC and 0.00125 BTC.

In the next chapter, we'll find out what "anonsets" are, how these indicators are calculated, and how they can help us estimate the efficiency of coinjoin cycles.

Quiz

btc2045.4

1/5

Why is it advised against merging several UTXOs after coinjoin cycles?