Following the money

On Bitcoin, anyone can look up every transaction made since 2009. Every payment, every amount, every address: it’s all out in the open, in a public record that nobody can erase.

Does that mean anyone can find out what you do with your money? Not exactly. But if you’re not careful, they can learn far more than you’d imagine.

Public isn’t anonymous

Bitcoin is pseudonymous, not anonymous. Transactions don’t carry names, only addresses: strings of letters and numbers that say nothing on their own.

The trouble starts when one of those addresses gets linked to a person. All it takes is posting an address to receive donations, getting paid for an invoice or withdrawing funds from a platform that knows who you are. From that point on, anyone watching the network can pull the thread backwards and forwards: how much you hold, how much you earn, who you pay.

Imagine your bank published your statements online and your name was the only thing hidden. That’s roughly what happens if you don’t look after your trail.

The clues a transaction leaves

People who analyse the chain don’t guess: they apply simple rules that, combined, reveal a lot. Knowing them is the first step to protecting yourself.

Common input ownership. When a payment needs to combine several amounts, the software merges them into a single transaction. The reasonable assumption is that they all belong to the same person.

Address reuse. If you receive every payment at the same address, anyone who sends you money once can see everything else.

The software’s fingerprint. Each app builds transactions with its own small quirks, and that helps work out which part goes back to the sender.

Round numbers. Payments tend to be round figures, like 0.1 BTC. If one output is round and the other isn’t, the one that isn’t is probably the change going back to whoever paid.

Rising fees. Someone who replaces a pending transaction with one that pays a higher fee (RBF) usually cuts their own change to cover it, and that gives away which output is theirs.

Looking after your trail

The good news is that protecting your privacy doesn’t take anything extraordinary. A few habits are enough, and all of them are perfectly legal.

A new address for every payment you receive. Most modern apps already do this for you. Make the most of it and avoid sharing the same one over and over.

Don’t mix funds from different sources. Money you withdrew from a platform that knows your identity and money you received privately tell different stories. Combine them in one transaction and you tie them together for good. Clients like Sparrow let you choose which funds to spend on each payment (coin control) and label them, so you always know where each one came from.

Your own node. If your app asks someone else’s node for your balances, that third party can see which addresses you care about. With your own node, that information never leaves home.

Be careful what you publish. An address shared on social media stays linked to you forever. If you need to receive payments publicly, use an address dedicated to just that.

Privacy isn’t hiding

Privacy is sometimes painted as suspicious, as if wanting it meant having something to hide. It’s the other way round. Nobody publishes their payslip, their medical history or the list of people they buy presents for, and that doesn’t mean they’re doing anything wrong.

What’s more, the privacy of honest people and the fight against crime get along perfectly well. In 2016, an attack on the Bitfinex exchange made off with 119,754 bitcoins. In 2022, US authorities recovered more than 94,000 of them, then worth over 3.6 billion dollars. The law keeps working; protecting your trail doesn’t get in its way.

Metadata says more than data

This lesson goes far beyond Bitcoin. A single purchase says little about you. A thousand purchases, each with its time, amount and recipient, sketch out your routine, your relationships and your habits.

Any product that stores what its users do builds up this kind of trail. That’s why people who build software carry a responsibility: keep only what’s needed, aggregate when the detail isn’t necessary and delete what’s no longer used. These habits protect people and, as a bonus, make compliance simpler.

A right worth looking after

Privacy is a right, and in a world where almost everything leaves a trail, protecting it takes a little intent. Understanding how you can be followed is the best way to decide what you want to show.

If you use Bitcoin, a few habits make a big difference. If you build a product, designing it to reveal as little as possible is one of the clearest ways to respect the people who use it.