Is Bitcoin anonymous? No, it is pseudonymous, and the difference matters

The white paper never promised anonymity

Section 10 of the Bitcoin white paper is titled “Privacy,” and it is short. The traditional banking model, it says, gets privacy by limiting who can see a transaction to the parties and a trusted third party. Bitcoin cannot do that, because every transaction has to be announced publicly for the system to work. So it breaks the flow of information somewhere else, by keeping public keys anonymous. The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone.

The paper recommends a new key pair for each transaction and points to multi-input transactions as a linking risk. That observation describes an assumption about common control, not proof of ownership: collaborative transactions can combine inputs authorized by different parties.

That is the design, stated by the person who built it. Your identity is not in the system, but the record of what your keys did is, forever and for everyone. The right word for this is pseudonymous. Our white paper explainer walks through the rest of the document.

Fresh addresses reduce one kind of link

Reusing one receiving address makes its receipts easy to group. A deterministic wallet can issue fresh addresses, reducing that direct address-level link. Later spending can still combine receipts or reveal change relationships.

Someone given the relevant extended public key may derive many of those fresh addresses. Privacy therefore depends on what is shared and how outputs are spent, not just whether the wallet displays a new destination. Transaction-graph relationships are evidence about activity, not automatic proof of a named person.

How clustering turns pseudonyms into people

In 2013 Sarah Meiklejohn and colleagues published “A Fistful of Bitcoins,” studying how public transaction data could be grouped into larger entities. They combined a common-input heuristic with a change-address heuristic based on patterns of one-time address use and other filters. The paper evaluated false positives and warned that change-address assumptions could need revision as wallet behavior changed.

Then they attached names. The team bought things from real merchants, deposited coins at exchanges and gambling sites, and recorded which addresses they had dealt with. A known exchange address can inform cluster attribution, but the result depends on the clustering assumptions; it does not prove that every address belongs to the same party. By April 2013 their parse covered 231,207 blocks, about sixteen million transactions and twelve million public keys, and the paper concluded that an agency with subpoena power would be well placed to identify who is paying money to whom.

The paper demonstrates how transaction patterns and external records can reduce pseudonymity. These are inferences with limits. Collaborative transactions such as CoinJoin can invalidate the assumption that every input belongs to the same owner, so an address cluster should not be presented as automatic proof of personal identity.

Silk Road: a worked example, from a court filing

Silk Road was an online market for illegal drugs that ran from 2011 until it was seized by law enforcement in October 2013. The only payment it accepted was bitcoin, and it ran every payment through a “tumbler” designed, in the site’s own words, to make it nearly impossible to link a payment to coins leaving the site. On 4 February 2015 a federal jury in Manhattan convicted its creator, Ross Ulbricht, on all seven counts, and the Justice Department said he had earned commissions worth more than $13 million from the site. Our article on Silk Road covers the case itself.

The tumbler turned out not to be enough. A civil forfeiture complaint filed on 5 November 2020 in San Francisco describes what happened next. In 2020 investigators used a third-party bitcoin attribution company to analyze Silk Road’s transactions and found 54 transfers from addresses the site controlled to two outside addresses, totaling 70,411.46 BTC. The pattern was wrong for a customer: mostly round amounts, close together in time, including ten transfers of exactly 2,500 BTC at about 3:59 in the morning, none of them recorded in the site’s database as a vendor or staff withdrawal. The coins, the government concluded, had been stolen from Silk Road.

The trail then went quiet and stayed visible. On 9 April 2013 the two addresses sent about 69,471 BTC to a single address, where the coins sat for years; 101 BTC left for the exchange BTC-e in April 2015; the remaining 69,370 BTC never moved. The complaint says the person who moved them, named only as “Individual X,” was known to the government, had hacked Silk Road, and on 3 November 2020 signed a consent to forfeiture, at which point the United States took custody. Chainalysis has said its software was the analysis tool. Our dossier on the Individual X address has the on-chain record.

What this site’s own research shows, and what it refuses to claim

Degrees of Satoshi is itself an exercise in reading the public ledger. Our address graph research traces forward paths from 28,583 early mining outputs across 1.53 billion address records through block 960,000, and finds that 89.16 percent of addresses have a path back to that origin set, most commonly six hops away. The home page lets you look up any address and see its distance. That is only possible because everything is public.

The research page is equally clear about the limits, and they are the same limits that apply to any chain analysis. Graph proximity does not establish ownership, identity, literal coin ancestry, wallet membership, or contact with Satoshi Nakamoto. The method cannot tell change from payment, cannot see through deliberate mixing, and does not cluster addresses by owner. The chain tells you where coins went. It takes outside records, an exchange account, a court order, a purchase, to say who sent them.

What people do about it: fresh addresses, CoinJoin and Lightning

The oldest countermeasure is the one Satoshi gave: a fresh address for every payment, so the shared-input rule has less to work with. The next was proposed by developer Gregory Maxwell on the Bitcoin forum on 22 August 2013 under the name CoinJoin. His observation was that the signatures in a transaction are completely independent of each other, so several strangers can build one transaction together, each signing only their own input. The result looks like an ordinary multi-input transaction, but the assumption that one party owns all the inputs is now false. Nothing about the protocol changed; only the analyst’s assumption broke.

CoinJoin needs coordination among participants and, Maxwell noted, does not by itself hide those participants from each other without something like Tor. Payment channels such as the Lightning Network take a different approach, settling many payments between two parties off the main ledger so that far less is recorded publicly. Each of these tools has trade-offs, and none makes Bitcoin anonymous. They move it along the spectrum from pseudonymous toward private, which is where the white paper put the goal in the first place.