CoinJoin in 2026: How Bitcoin Mixing Works and What Still Operates After Whirlpool

What Is CoinJoin?

CoinJoin is a privacy technique that allows multiple Bitcoin users to combine their transactions into a single, large transaction — making it ambiguous which input paid which output. Invented by Bitcoin developer Gregory Maxwell in 2013, CoinJoin solves a fundamental problem: Bitcoin's public blockchain lets anyone trace the flow of funds from address to address. CoinJoin breaks that trail by mixing your coins with other users' coins in a way that chain analysts cannot untangle.

Think of it like this: ten people each walk into a room holding a $20 bill. They all put their bills in a pile, shuffle them, and each person takes out a $20 bill. Every person still has $20, but nobody can tell which specific bill belonged to which person. CoinJoin does the same thing with Bitcoin UTXOs — and it does it trustlessly, without any central mixer holding your funds.

CoinJoin matters because Bitcoin's default transparency is a liability for financial privacy. As we covered in the Bitcoin privacy lesson, chain analysis companies can trace funds across the blockchain and link addresses to real identities. CoinJoin is the most widely used on-chain tool to defend against this surveillance.

How CoinJoin Works

A standard Bitcoin transaction has a clear structure: one or a few inputs from one person, and one or two outputs (payment + change). A chain analyst can easily determine who paid whom. A CoinJoin transaction looks fundamentally different.

The Basic Mechanism

1. Coordination: Multiple participants signal that they want to perform a CoinJoin. A coordinator (server or protocol) matches them together. The coordinator cannot steal funds — it only facilitates the collaboration.
2. Input registration: Each participant provides one or more UTXOs as inputs. Every participant also provides a fresh, unused output address where they want to receive their coins.
3. Transaction construction: The coordinator constructs a single transaction with all participants' inputs and outputs. Outputs share common denominations (e.g., many outputs of exactly 0.01 BTC) — this is what creates ambiguity.
4. Signing: Each participant independently verifies the transaction (confirming their output is included for the correct amount) and signs their inputs. No participant needs to trust any other participant or the coordinator.
5. Broadcast: The fully signed transaction is broadcast to the Bitcoin network. It looks like one big transaction with many inputs and many equal-sized outputs.

The key property: because many outputs are the same size, an observer cannot determine which input corresponds to which output. If 100 participants each put in and take out 0.01 BTC, there are 100! (100 factorial) possible mappings — an astronomically large number. The larger the CoinJoin, the stronger the privacy.

Anonymity Sets

The privacy of a CoinJoin is measured by its anonymity set — the number of equal-value outputs your coin is indistinguishable from. If a CoinJoin has 50 outputs of 0.01 BTC each, your coins have an anonymity set of 50: an observer knows your coins are one of those 50 outputs, but can't determine which one. Higher anonymity sets provide stronger privacy. Multiple rounds of CoinJoin compound the effect exponentially.

CoinJoin Implementations: How the Major Designs Differ

Several designs of CoinJoin have existed, each with different architectures and tradeoffs. Two of them — Samourai's Whirlpool and zkSNACKs' Wasabi coordinator — were the most popular consumer options until 2024, when both were shut down. Understanding all three designs is still useful, because the surviving tools in 2026 are direct descendants of them.

JoinMarket (decentralized, still operating)

JoinMarket is a decentralized CoinJoin implementation that uses a maker-taker model. "Makers" offer their bitcoin for CoinJoin mixing and earn fees. "Takers" initiate CoinJoin transactions and pay those fees. This creates a market for liquidity — there are usually makers willing to participate because they earn yield on their bitcoin. JoinMarket has run on mainnet continuously since 2015 and is still actively maintained and operating in 2026.

JoinMarket's strengths:

• No central coordinator: The protocol is peer-to-peer, with no single server to seize or pressure — which is exactly why it survived 2024 untouched
• Earn while mixing: Makers earn fees for providing liquidity
• Flexible amounts: Supports a range of transaction sizes
• Mature codebase: Active development since 2015

JoinMarket's weaknesses:

• Complex setup: Requires running a full Bitcoin node, installing the software, and some command-line familiarity
• Slower mixing: Finding counterparties can take time, especially for large amounts
• Higher barrier to entry: Not aimed at non-technical beginners

JoinMarket is ideal for technically sophisticated users who want maximum decentralization and are willing to invest setup time. The Jam project (formerly "JoinMarket Automation & Management", a self-hosted web UI) makes it considerably more approachable by wrapping the command line in a browser interface; it ships on node distributions and as a standalone install.

Whirlpool / Samourai (DEFUNCT — seized April 2024)

The Whirlpool protocol was developed by Samourai Wallet and used a coordinator server to organise CoinJoin rounds across fixed-denomination pools (0.5, 0.05, 0.01, and 0.001 BTC). Its signature feature was free remixing after a one-time pool entry fee.

Whirlpool no longer operates. On April 24–25, 2024, US authorities seized Samourai Wallet's servers and domains, arrested its founders, and the Whirlpool coordinator went offline. Sparrow Wallet removed its Whirlpool client in v1.9.0 (April 2024), so the once-common "Sparrow + Whirlpool" path no longer exists. In November 2025, founders Keonne Rodriguez and William Hill were sentenced to five and four years respectively after pleading guilty to money-laundering and unlicensed money-transmission charges. Do not install old Samourai/Whirlpool binaries or trust legacy Samourai domains — seized or abandoned infrastructure is a malware risk.

The Whirlpool protocol design did not die with the company: an independent group revived it as Ashigaru Whirlpool with brand-new, independently operated coordinator infrastructure (covered below).

Wasabi / WabiSabi (client survives; original coordinator DEFUNCT — June 2024)

Wasabi Wallet uses the WabiSabi protocol — an evolution of the ZeroLink CoinJoin framework. Unlike Whirlpool's fixed denominations, WabiSabi allows variable output amounts while still providing strong privacy through cryptographic techniques (keyed-verification anonymous credentials), and the coordinator does not learn the input-to-output mapping.

The original coordinator is gone. zkSNACKs, the company behind Wasabi, discontinued its central coinjoin coordinator on June 1, 2024, citing regulatory uncertainty (it had also previously run a controversial transaction-filtering/blacklisting policy). The Wasabi client software remains open source and functional, but it ships with no default coordinator — you now connect it to an independent, community-run coordinator of your choosing. The same approach is used by Ginger Wallet, a Wasabi fork that comes preconfigured with a default coordinator, and anyone can self-host a coordinator using the BTCPay Server WabiSabi plugin. This is how WabiSabi CoinJoin still operates in 2026 — see the next section.

What Still Operates in 2026 (verified June 2026)

Here is the honest, current menu. Every option below was confirmed operating as of June 2026; verify the project is still alive and that you are on the official source before committing funds.

Tool	Architecture	Status (Jun 2026)	Best for
JoinMarket (+ Jam UI)	Decentralized, peer-to-peer maker-taker; needs your own full node	Active since 2015; maintained	Maximum decentralization, no coordinator to seize; technical users
Wasabi 2.x + third-party coordinator	WabiSabi; client picks an independent coordinator	Client maintained; original zkSNACKs coordinator shut June 2024, community coordinators in use	Variable amounts; users comfortable vetting a coordinator
Ginger Wallet	Wasabi fork shipping with a default coordinator	Active fork	WabiSabi CoinJoin with less configuration
Ashigaru Whirlpool	ZeroLink/Whirlpool design with new, independent coordinator; Tor-only	Revived fork of Samourai's protocol; coordinator run by Ashigaru contributors	Fixed-pool Whirlpool-style mixing without the seized Samourai infra
Joinstr	Coordinator-less CoinJoin coordinated over Nostr	Experimental — developers warn against mainnet use (known bugs)	Testnet/experimentation only, for now
Manual CoinJoin / coin control	Hand-built collaborative transactions; disciplined UTXO management	Always available in any good wallet	The everyday fallback — see below

1. JoinMarket + Jam (most robust today)

Because it has no central coordinator, JoinMarket was unaffected by the 2024 takedowns and is the most resilient option in 2026. Run it on your own node (Bitcoin Core), and use the Jam web UI if you prefer a browser interface to the command line. You can act as a taker (initiate joins, pay fees) or run a maker bot (earn fees while providing liquidity). Best for users willing to invest setup time for maximum decentralization.

2. Wasabi 2.x with a third-party coordinator (or Ginger Wallet)

The Wasabi client is alive; only zkSNACKs' coordinator died. In Wasabi 2.x you set the coordinator URL yourself (community coordinators are run by various operators; some publish "no blocklist" policies, others apply compliance filtering — read each coordinator's terms before trusting it). If you would rather not configure anything, Ginger Wallet is a Wasabi fork that ships with a default coordinator. For full self-sovereignty you can run your own coordinator via the BTCPay Server WabiSabi plugin and point your client at it. The tradeoff is unchanged from the original Wasabi: you still trust a coordinator with availability (never with custody — it cannot steal funds).

3. Ashigaru Whirlpool (revived Whirlpool design)

After Samourai's shutdown, independent contributors released Ashigaru, a fork of the Samourai code, and Ashigaru Whirlpool, a faithful reimplementation of the ZeroLink/Whirlpool protocol running on new, independently operated coordinator infrastructure. It is Tor-only (no clearnet), with identity isolation between the input-registration and output stages. A desktop client (Ashigaru-terminal, itself forked from Sparrow) is available on Windows, macOS and Linux. Note the fee model differs from the old Samourai pools — current pools carry a percentage-based entry fee with free remixes thereafter. This is not the seized Samourai service; only the protocol design is shared. Treat it as newer, smaller, and less battle-tested than JoinMarket, and obtain it only from Ashigaru's official source.

4. Joinstr (experimental — not for mainnet yet)

Joinstr coordinates CoinJoins over the Nostr protocol, removing the dedicated coordinator server entirely. It is a promising design, but its own developers warn against using it on mainnet due to known bugs as of 2026. Use it on testnet to learn, not for funds you cannot afford to lose.

5. Manual CoinJoin and coin control (the everyday fallback)

With the easiest "one-click" consumer coordinators gone or diminished, disciplined coin control — carefully choosing which UTXOs you spend together, labelling them, avoiding linking KYC and non-KYC coins, and constructing collaborative transactions by hand or with payjoin-style techniques — has become the practical day-to-day privacy hygiene for many users. A good wallet with coin control (such as Sparrow) plus your own node remains the foundation, even though Sparrow itself no longer ships a built-in mixer.

How Many CoinJoin Rounds Do You Need?

A single CoinJoin round provides a basic anonymity set — say, 50 if there were 50 equal-sized outputs. This means a chain analyst knows your coins are one of 50 possibilities. That's useful, but chain analysts can sometimes narrow it down using timing analysis, amount correlations, and clustering of post-mix spending.

Multiple rounds compound the ambiguity exponentially. After two rounds of CoinJoin with 50 participants each, the theoretical anonymity set is 50 × 50 = 2,500. After three rounds, it's 125,000. In practice, the effective anonymity set is lower due to various analytical techniques, but the principle holds: more rounds = dramatically stronger privacy.

For practical purposes:

• 1–2 rounds: Basic privacy. Breaks the obvious link between your input and output but vulnerable to sophisticated analysis.
• 3–5 rounds: Strong privacy. Sufficient for most personal use cases. Chain analysis becomes probabilistic and computationally expensive.
• 5+ rounds: Very strong privacy. Practical chain analysis hits diminishing returns — the cost of analysis likely exceeds the value of the information gained.

Tools differ in how they handle repeated rounds. Whirlpool-style designs (now Ashigaru) offer free remixing after the initial pool fee, so coins can keep mixing passively. With JoinMarket you can run a maker bot that continuously participates in CoinJoins while earning fees — privacy and income simultaneously. WabiSabi clients remix automatically against whichever coordinator you've selected.

CoinJoin vs. Centralized Mixers

Before CoinJoin became widespread, "Bitcoin mixers" or "tumblers" were the primary privacy tool. These were centralized custodial services: you'd send your bitcoin to the mixer, and it would send different bitcoin back to you (minus a fee). The problem was trust: the mixer operator had full knowledge of the input-output mapping and could steal your funds or be compelled to turn over records. Several mixing services were shut down by law enforcement, and users lost funds.

CoinJoin is fundamentally different because it's non-custodial. At no point does any coordinator, server, or other participant take custody of your funds. You sign the CoinJoin transaction yourself, and you can verify that your output is included before signing. If anything looks wrong, you simply refuse to sign and your bitcoin stays in your wallet.

One nuance worth stating plainly in light of 2024: a CoinJoin coordinator being non-custodial does not make it immune to legal pressure. The Samourai and zkSNACKs cases show that operating a coordination service can attract prosecution even when the operator never holds user funds. That is a major reason the surviving ecosystem favours coordinator-less or self-hosted designs (JoinMarket, BTCPay-hosted WabiSabi, Joinstr) — the architecture itself reduces the single point that can be seized or pressured.

Best Practices for Using CoinJoin

CoinJoin is powerful, but it's not magic. Careless behavior after mixing can undo the privacy gains. Follow these practices to maintain the benefits:

• Never combine mixed and unmixed UTXOs: If you have 0.01 BTC from a CoinJoin and 0.05 BTC from a KYC exchange, spending them together in one transaction links the CoinJoined coins back to your KYC identity. Keep them strictly separate.
• Use coin control: Use a wallet that supports coin control (like Sparrow) so you can manually select which UTXOs to spend. Label your UTXOs — mark them as "mixed," "KYC," "change," etc.
• Multiple rounds: One CoinJoin round provides a basic anonymity set. Multiple rounds compound the privacy. With Whirlpool-style tools (Ashigaru) leave coins in the post-mix pool to keep remixing; with JoinMarket schedule a tumbler run.
• Don't send CoinJoined coins to a KYC exchange: If you CoinJoin coins and then deposit them at an exchange that knows your identity, you've undone much of the privacy gain. The exchange now links those coins to you.
• Verify the software source: Only download from the project's official, current source, and verify signatures where provided. After 2024, abandoned or seized domains (Samourai, old Whirlpool clients) are a real malware vector — never run them.
• Broadcast transactions through Tor: CoinJoin protects on-chain privacy, but if you broadcast from your home IP address, your ISP can still see the transaction. Use Tor (Ashigaru is Tor-only by design) or a VPN for the network layer.
• Be patient: Rushing to spend immediately after a CoinJoin can create timing analysis opportunities. Let mixed coins sit before spending.

CoinJoin and the UTXO Model

To fully understand CoinJoin, you need to understand Bitcoin's UTXO model. Unlike a bank account with a single balance, your Bitcoin wallet holds a collection of UTXOs (Unspent Transaction Outputs) — discrete "coins" of various sizes. When you receive 0.5 BTC and then 0.3 BTC, you don't have a balance of 0.8 BTC — you have two separate UTXOs of 0.5 and 0.3.

CoinJoin operates on these individual UTXOs. When you enter a CoinJoin round, you're taking one or more UTXOs as inputs and receiving one or more equal-denomination UTXOs as outputs. The "change" — any leftover amount that doesn't fit into the CoinJoin denomination — comes back to you as a separate, unmixed UTXO. This change output is a privacy concern: it's clearly linked to your input because it's the odd-sized output in an otherwise uniform CoinJoin transaction.

This is why fixed-denomination designs (the Whirlpool model, now used by Ashigaru, with pools such as 0.025 and 0.25 BTC) can create a "toxic change" problem. If you input slightly more than a pool size, you get one mixed output and one unmixed change output. That change output is toxic because it's clearly linked to your original input. Best practice: keep toxic change separate and either mix it in an appropriate pool or spend it in a way that doesn't compromise your mixed UTXOs. Variable-amount designs (WabiSabi) reduce, but do not entirely eliminate, this concern.

The Legal Status of CoinJoin

CoinJoin exists in a legal gray area that varies by jurisdiction, and 2024–2025 sharply raised the stakes for anyone running coordination infrastructure. In April 2024, the US Department of Justice charged the developers of Samourai Wallet with money laundering and operating an unlicensed money-transmitting business over their Whirlpool service; both founders pleaded guilty and were sentenced in November 2025 (five and four years). Separately, zkSNACKs shut down the Wasabi coordinator in June 2024 citing regulatory uncertainty. These events reshaped the privacy-tooling landscape.

However, CoinJoin itself — multiple parties jointly constructing a Bitcoin transaction with no third-party custody — is a basic use of Bitcoin's protocol. The legal jeopardy in the Samourai case centred on operating and actively marketing a mixing service, not on the act of an individual using CoinJoin for their own privacy. Many legal scholars argue that writing and using such software is protected activity, and the boundaries are still being litigated. The practical lesson for users is to prefer decentralized or self-hosted designs and to understand the policies of any exchange or service you interact with.

As a user, be aware that some exchanges flag CoinJoin transactions and may freeze your account or require additional verification if they detect CoinJoin activity in your deposit history. Consider using non-KYC methods to acquire bitcoin that you plan to keep private.

Getting Started With CoinJoin in 2026: A Practical Path

If you're new to CoinJoin, here's a recommended progression that reflects what actually works today. (The old "Sparrow → Tools → Mix → Whirlpool" wizard no longer exists; Sparrow removed its mixer in 2024.)

1. Build the foundation first: your own node + a coin-control wallet. Run Bitcoin Core (or a node distribution like Umbrel/Start9) and use a wallet with strong coin control such as Sparrow (sparrowwallet.com). Learn the UTXO tab, labelling, and how to keep KYC and non-KYC coins separate. This step is valuable even before you mix anything.
2. Choose a method that matches your skill and threat model:
   • Maximum decentralization, willing to tinker: install JoinMarket against your node, and add the Jam web UI for an easier interface. No coordinator to be seized.
   • Variable amounts, comfortable vetting a coordinator: use the Wasabi 2.x client and point it at a reputable third-party coordinator (read its policy first), or use Ginger Wallet for a preconfigured default, or self-host a coordinator with the BTCPay Server WabiSabi plugin.
   • Whirlpool-style fixed pools: use Ashigaru Whirlpool with its desktop terminal client (Tor-only). Obtain it only from Ashigaru's official source.
3. Start small. Do a test round with a modest amount and confirm you understand the fees, the pool/denomination structure, and where your change lands before committing larger sums.
4. Understand your post-mix UTXO categories. Whatever the tool, you'll end up with mixed outputs and (often) toxic change. Keep them in separate, labelled categories and never merge them.
5. Let it remix where supported. Whirlpool-style pools (Ashigaru) remix for free after entry; JoinMarket can run a tumbler/maker schedule; WabiSabi clients remix against your chosen coordinator. More rounds = larger anonymity set.
6. Spend carefully. Use coin control to spend only mixed UTXOs, never combining them with pre-mix or KYC coins, and broadcast over Tor. Pair large holdings with a multisig wallet for security alongside privacy.

There is no longer a true 30-minute "set and forget" consumer mixer like the old Sparrow+Whirlpool flow. The 2026 reality is a little more hands-on, but the surviving tools are real, open source, and operating — and the more decentralized ones are far harder to take offline than what came before.

Frequently Asked Questions

Is CoinJoin the same as a Bitcoin mixer?

No. Traditional Bitcoin mixers are centralized custodial services that take your coins and return different ones. The operator knows the input-output mapping and can steal your funds. CoinJoin is a collaborative, non-custodial technique where multiple parties jointly construct a transaction without anyone taking custody. You sign the transaction yourself and can verify your output before signing. CoinJoin is more private and removes custody risk compared to centralized mixing.

Can I still use Sparrow Wallet and Whirlpool to mix?

No — that specific path is gone. Samourai's Whirlpool coordinator was seized in April 2024 and Sparrow removed its built-in Whirlpool/mixing client in v1.9.0 (April 2024). Sparrow is still an excellent wallet for running a node and doing coin control, but it no longer mixes coins itself. The Whirlpool protocol design lives on through the independent Ashigaru Whirlpool project, which runs its own new coordinator. Do not download old Samourai or Whirlpool binaries.

Can chain analysis detect CoinJoin transactions?

Chain analysts can identify that a CoinJoin occurred — the characteristic pattern of many equal-sized outputs is recognizable on-chain. However, they cannot determine which specific input corresponds to which output. That's the whole point. What they can detect is that you used CoinJoin, which some exchanges treat as suspicious. The privacy benefit is in the anonymity set: the larger the CoinJoin, the less information a chain analyst can extract about any individual participant.

Which CoinJoin implementation should I use in 2026?

It depends on your skill and threat model. For maximum decentralization and resilience, JoinMarket (with the Jam UI) is the strongest choice — it has no central coordinator and was unaffected by the 2024 takedowns. For variable amounts, the Wasabi 2.x client pointed at a vetted third-party coordinator (or Ginger Wallet, or a self-hosted BTCPay coordinator) works. For a Whirlpool-style fixed-pool experience, Ashigaru Whirlpool revives that design on new, Tor-only infrastructure. Joinstr (Nostr-based) is promising but its developers warn against mainnet use for now.

How much does CoinJoin cost?

Costs vary by tool and always include Bitcoin network miner fees on top. JoinMarket's maker fees are market-driven and typically small (often on the order of 0.01–0.03% per round) — and as a maker you can earn rather than pay. WabiSabi coordinators set their own coordinator fee (the old zkSNACKs default was around 0.3%; independent coordinators vary, and some advertise lower or zero fees). Whirlpool-style pools (Ashigaru) charge a percentage-based pool entry fee with free remixes thereafter. Always check the current fee schedule of the specific tool and coordinator before mixing.

Will my exchange freeze my account if I use CoinJoin?

Some exchanges do flag CoinJoin activity. Several regulated platforms have been reported to close or freeze accounts that deposit bitcoin with CoinJoin history, because compliance departments treat CoinJoin as a potential money-laundering red flag. If you plan to use CoinJoin, keep your KYC exchange funds entirely separate from your private funds. Better yet, acquire bitcoin through non-KYC peer-to-peer methods for funds you want to keep private, and use KYC exchanges only for amounts you're comfortable having linked to your identity.