CoinJoin and equal-output shapes
How Forensia recognises transactions built by several people together, and what it refuses to conclude from them.
#Plain languageIn plain terms
Normally one person funds a transaction, so its inputs probably belong to one wallet. A CoinJoin breaks that assumption on purpose. Several people each put coins in and each take the same amount out, in one shared transaction. Afterwards nobody outside can tell whose output is whose.
These transactions have a recognisable shape: several outputs of exactly the same value. Forensia flags the shape, because the usual tracing assumptions stop working at that point. Using one is legal in many places and is not, by itself, suspicious.
#How it worksHow it works
- Group the transaction's outputs by value and find the largest group of equal amounts.
- Check it against two known protocol structures.
- If neither fits, check the general equal-output shape.
- Report whichever matched, with the rule that matched.
#Technical detailThe exact rules
| Structure | Rule |
|---|---|
| Samourai Whirlpool | Exactly 5 inputs and 5 outputs, all 5 outputs equal, at one of the pool amounts: 0.001, 0.01, 0.05 or 0.5 BTC. |
| Wasabi 1.x | At least 10 inputs and at least 10 equal outputs, with the amount between 0.09 and 0.11 BTC. |
| General equal-output shape | At least 3 inputs from at least 3 different addresses, and at least 3 outputs of equal value. |
| Match | Confidence | Finding class |
|---|---|---|
| Named structure | Medium | Lead |
| General shape only | Low | Lead |
The finding is finding:coinjoin-shape, followed by the transaction ID. For an address lookup, every transaction on the first page is tested and the first match is reported.
#LimitsWhat it does not tell you
- Only counts and amounts are tested. Fee structure, script types and coordinator outputs are not checked, so any transaction with the right counts and amounts is named.
- Wasabi 2.0, JoinMarket and PayJoin are not modelled.
- Exchange batching and ordinary collaborative payments can produce the general shape.
- No participant is identified, no service is attributed, and no common ownership is inferred.