Reclaim your privacy now

A mechanism by which multiple participants combine their coins (or UTXOs, to be more precise) into one large transaction with multiple inputs and multiple outputs. An observer cannot determine which output belongs to which input, and neither can the participants themselves. This makes it difficult for outside parties to trace where a particular coin originated from and where it was sent to (as opposed to regular bitcoin transactions, where there is usually one sender and one receiver).

This can be done with non-custodial software like Mustard Wallet for Litecoin or Wasabi for Bitcoin that eliminates the risk of funds disappearing or being stolen. Each of the signatures are created on the participants’ computers, so anyone trying to connect the signatures is unable to alter the transaction or redirect the funds. The funds will always be in an address that you control.

It’s possible to do this in a decentralized way so that the service does not rely on external parties or centralized servers. It just needs the participants of the transaction.

CoinJoin can be applied multiple times, and as many transactions are grouped together, participants may save on transaction fees. CoinJoin is the preferred method of gaining privacy in the network.

CoinJoin means: “when you want to make a transaction, find someone else who also wants to make a transaction and make a joint transaction together”.

Further reading: en.bitcoin.it/wiki/CoinJoin

No, Mustard Wallet's coinjoin implementation is trustless by design. The participants do not need to trust each other or any third party. Both the sending address (the coinjoin input) and the receiving address (the coinjoin output) are controlled by your own private keys. Mustard Wallet merely coordinates the process of combining the inputs of the participants into one single transaction, but the wallet can neither steal your coins, nor figure out which outputs belong to which inputs.

Further reading: Chaumian Coinjoin

No. The worst thing that can happen (through user’s negligence post-mix) is that the level of your privacy stays the same as before coinjoin. It is crucial to understand that Mustard Wallet is not a fool-proof solution if you neglect to practice coin control after the mixing process.

Mustard Wallet for Litecoin is a port of Wasabi Wallet for Bitcoin to the Litecoin Network .

This porting effort was self-assigned by Gabriel Krieger in early 2020 to improve his knowledge of Bitcoin and Wasabi , force himself to dig into the codebases , review , contribute and improve .

The initial goal was to do a Proof of Concept and get to know a lot of technologies up close quickly , like Bitcoin , Litecoin , Tor , C# .NET and how the Wasabi Wallet works under the Hood .

When members of the Litecoin community signaled that there was real Demand for a Litecoin Wallet that protects the users' privacy , the code was polished up and released as a real open source Project .

The Wasabi Wallet has superb Documentation so we refer to it for anything that applies to Mustard as well , rather than duplicating everything .

All Mustard Wallet network traffic goes via Tor by default - no need to set up Tor yourself. If you do already have Tor, and it is running, then Mustard Wallet will try to use that first.

You can turn off Tor in the Settings. Note that in this case you are still private, except when you coinjoin and when you broadcast a transaction. In the first case, the coordinator would know the links between your inputs and outputs based on your IP address. In the second case, if you happen to broadcast a transaction of yours to a full node that is spying on you, it will know the link between your transaction and your IP address.

Mustard Wallet generates Bech32 addresses only, also known as native SegWit addresses or bc1 addresses, because these addresses start with the characters bc1... Some wallets/exchanges do not yet support this type of address and may give an error message (e.g. "unknown bitcoin address"). The hack is to manage your funds with a wallet which does support Bech32. To check Bech32 adoption and exchange/wallet support you can follow Bitcoin.it Wiki and When Segwit? website.

Be careful, if you send all your coins from an old wallet to a new wallet (from the table above) in one transaction then you will merge all your coins which is bad for privacy - instead, send the coins individually or if possible import the seed in the new wallet.

You currently pay a fee of 0.003% * anonymity set. If the anonymity set of a coin is 50 then you pay 0.003% * 50 (=0.15%). If you set the target anonymity set to 53 then Mustard Wallet will continue mixing until this is reached, so you may end up with an anonymity set of say 60, and you will pay 0.003% * 60 (=0.18%).

There are also edge cases where you do not pay the full fee or where you pay more. For example if you're the smallest registrant to a round, you will never pay a fee. Also when you are remixing and you cannot pay the full fee with your input, then you only pay as much as you have, but if the change amount leftover would be too small, then that is also added to the fee. Currently the minimum change amount to be paid out is 0.7% of the base denomination (~0.1BTC.)

It is also possible that you get more back from mixing than you put in. This happens when network fees go down between the start of the round and its end. In this case, the difference is split between the active outputs of the mix.

The anonymity set is effectively the size of the group you are hiding in.

If 3 people take part in a CoinJoin (with equal size inputs) and there are 3 outputs then each of those output coins has an anonymity set of 3.

0.1 BTC (Alice)        0.1 BTC (Anon set 3)
0.3 BTC (Bob)      ->  0.1 BTC (Anon set 3)
0.4 BTC (Charlie)      0.1 BTC (Anon set 3)
                       0.2 BTC (Change Coin Bob)
                       0.3 BTC (Change Coin Charlie)


There is no way to know which of the anon set output coins are owned by which of the input owners. All an observer knows is that a specific anon set output coin is owned by one of the owners of one of the input Coins i.e. 3 people - hence an anonymity set of 3.

Your Mustard Wallet software has limited information on what the anonymity set should be, so the anonymity set that the software presents you is just an estimation, not an accurate value. With Mustard Wallet we are trying to do lower estimations, rather than higher ones.

It is advisable to limit the recombining of mixed coins because it can only decrease the privacy of said coins. This links all the consolidated UTXOs in one transaction, creating only one output, which then clearly controls all these funds. That said, if you combine less than 1 BTC it is less likely to reveal your pre-coinjoin transaction history. The potential issue comes when you spend that coin. Depending on what you do with the coin you might reduce the privacy of the resulting change (if you send half your coin to an exchange for example, as they will know that you own the coin change). As a result it is best not to recombine ALL your mixed change, though you may wish to recombine some coins if you are planning on hodling for many years as this will reduce the fees required to spend the coins later.

Further reading: [Reddit] Combining Mixed Coins

Most hardware wallets communicate with servers to provide you with your balance. This reveals your public key to the server, which damages your privacy - the hardware company can now theoretically link together all your addresses. As a result it is not recommended that you send your mixed coins to an address associated with your hardware wallet unless you are confident that you have set up your hardware wallet in a way that it does not communicate with a 3rd party server (see below).

You can however manage your hardware wallet with the Mustard Wallet interface. Alternatively you can use your hardware wallet with Electrum, which connects to your Litecoin Core full node through Electrum Personal Server.

You can use popular hardware wallets with Mustard Wallet directly including Coldcard, Trezor and Ledger devices. Plug in the device, and select Hardware Wallet in the starting page of Mustard Wallet. You will be able to send and receive bitcoin, but you will not be able to coinjoin the funds directly. For this, the private key needs to be hot in Mustard Wallet. You can also import and export PSBT over SD card to communicate with your ColdCard Wallet.

There are no hard and fast rules for what to do with the change. Generally try to avoid the change and use the Max button extensively at sending. The most problematic type of change is what has anonymity set 1 (red shield.) You should treat it as a kind of toxic waste (handled with great care).

Warning You want to avoid merging anonymity set 1 coins with anonymity set > 1 coins wherever possible, because this will link your anonymity set > 1 coin to the coin you merge it with. Note that, this is also true if you merge them in a mix, however that is slightly less problematic, because some blockchain analysis techniques become computationally infeasible.

It is also important that you do not send different coins to the same receiving address (even if performed as separate transactions) as this will also link the coins together, damaging your privacy.

Your Options:
- If you do not care about linking the history of the coins because they are all from the same source then you could combine them in a mix (queue all the change from the same source until you reach the minimum input required to mix, currently ~ 0.1 BTC).
- Mix with Joinmarket.
- Donate them (e.g. to the EFF)
- Spend them on something that is not a particular privacy risk (eg. gift cards).
- Open a lightning channel.
The ultimate solution is to 'close the loop' i.e. spend a change coin without merging it with other coins, do not generate it in the first place by sending whole coins.

Further reading: Chaumian Coinjoin

Other than Mustard Wallet, as of 2020, JoinMarket is the only sound privacy enhancing concept that has a production ready implementation.