UTXO privacy

Bitcoin and other unspent-transaction-output (UTXO) chains feel anonymous because you never type your real name. But the ledger is a permanent, fully public spreadsheet of who paid which address how much, and every coin you spend points back at the exact coins you received. UTXO privacy is the study of how much that public graph leaks about you, and the techniques that blur it. The honest summary is that base-layer Bitcoin is pseudonymous, not private: an address is a stable nickname, and once anyone links one of your addresses to your identity, they can often unravel a large slice of your financial history.

The leaks come from a handful of powerful heuristics. The common-input-ownership heuristic assumes that if several UTXOs are spent together as inputs to one transaction, they all belong to the same wallet, because spending them required all their private keys. The change-output heuristic spots which output is your change returning to you (it is often the non-round amount, a freshly generated address, or matches your wallet's script type) versus the payment to the merchant. Address reuse instantly merges separate transactions into one identity. Stitch these together and a clustering algorithm collapses thousands of addresses into a single wallet entity, then exchange know-your-customer records or an IP captured during transaction relay attach a real name.

The defences attack each heuristic. Never reuse an address; let your wallet generate a fresh one per receipt. Use CoinJoin so the common-input heuristic becomes false (the inputs belong to many strangers). Use PayJoin so the merchant also contributes an input, breaking the assumption that all inputs are the sender's. Hide amounts with confidential transactions so the value graph carries no fingerprints. Stronger still, move to protocols that redesign the model entirely — ring signatures and stealth addresses in Monero, or shielded notes in Zcash — so there is no clear-text transaction graph to analyse in the first place.

It is worth contrasting the UTXO model with the account model used by Ethereum. The account model is actually worse for privacy by default, because one persistent account address accrues your entire history like a bank statement, and nonces strictly order your actions. The UTXO model at least encourages a fresh address per payment and makes coin-mixing natural, which is one reason the most private cryptocurrencies are UTXO-based.