Anonymity Set

What Is an Anonymity Set?

An anonymity set is the collection of individuals among whom a specific user's activity is indistinguishable. In cryptocurrency, it refers to the group of possible senders (or receivers) that a particular transaction could plausibly belong to. If you make a payment that could have come from any of 100 people, your anonymity set is 100. An observer trying to identify you has, at best, a 1-in-100 chance of guessing correctly.

The concept originates from academic privacy research. Pfitzmann and Hansen formally defined it in their canonical terminology paper (2000): "Anonymity of a subject means that the subject is not identifiable within a set of subjects, the anonymity set." This definition has become the standard framework for evaluating privacy in anonymous communication systems, data protection, and blockchain protocols alike.

Anonymity sets matter because privacy is not binary. A system does not simply provide "privacy" or "no privacy." The size and quality of the anonymity set determine how much privacy a user actually receives. A fungible currency requires that individual units cannot be traced back to specific users, and anonymity sets are the mechanism that makes this possible.

How It Works

Every privacy protocol creates anonymity sets through a different mechanism, but the core idea is the same: make one user's transaction look identical to transactions from other users. The more users whose transactions are indistinguishable, the larger the anonymity set.

Sender vs. Recipient Anonymity Sets

Privacy researchers distinguish between two types of anonymity sets:

• Sender anonymity set: the group of people who could have sent a given transaction. An observer sees a payment arrive but cannot determine which member of the set originated it.
• Recipient anonymity set: the group of people who could have received a given transaction. An observer sees a payment leave but cannot determine its destination.

A protocol may provide strong sender anonymity but weak recipient anonymity, or vice versa. For example, onion routing on the Lightning Network provides sender anonymity (intermediary nodes cannot identify the payment origin) while blinded paths add recipient anonymity (the sender does not learn the receiver's node identity).

Measuring Anonymity: Beyond Set Size

Raw anonymity set size can be misleading. If 100 people are in the set but one person is 90% likely to be the sender, the effective anonymity is much lower than 100. Researchers Serjantov and Danezis (2002) proposed using information entropy to capture this:

// Entropy-based effective anonymity
// H = -Σ p(u) × log₂(p(u))
// where p(u) is the probability that user u is the real sender

// Perfect anonymity (uniform distribution):
// 100 users, each 1% likely → H = log₂(100) ≈ 6.64 bits

// Degraded anonymity (skewed distribution):
// 1 user at 90%, 99 users at 0.1% each → H ≈ 1.38 bits
// Effective anonymity set ≈ 2^1.38 ≈ 2.6 users

This entropy-based measure reveals whether the anonymity set provides uniform protection or merely the illusion of a large crowd. A normalized degree of anonymity (ranging from 0 to 1) divides the actual entropy by the maximum possible entropy, providing a comparable metric across protocols with different set sizes.

CoinJoin: Building Anonymity Sets on Bitcoin

CoinJoin is the primary technique for creating anonymity sets on Bitcoin. Multiple users combine their inputs into a single transaction with equal-denomination outputs. An observer sees one transaction with many inputs and outputs but cannot determine which input funded which output.

The anonymity set equals the number of equal-value outputs. In a CoinJoin with 50 participants each producing one equal output, each output has an anonymity set of 50. Wasabi Wallet's WabiSabi protocol targets 50+ participants per round, while the now-defunct Whirlpool protocol used fixed pools of 5 participants but compounded anonymity through repeated remixing.

Related techniques like PayJoin take a different approach: instead of creating a large anonymity set, they disguise CoinJoin transactions as ordinary payments, making privacy-enhancing transactions indistinguishable from regular ones. Similarly, silent payments allow receivers to generate unique one-time addresses from a static identifier, preventing observers from linking payments to a known address.

Lightning Network: Routing-Based Anonymity

The Lightning Network provides anonymity through onion routing of multi-hop payments. Each forwarding node decrypts only its layer of the onion, learning only the identity of its immediate predecessor and successor. No intermediary knows the full payment path, its own position in the route, or the total number of hops.

The sender's anonymity set is theoretically all nodes capable of originating the payment. In practice, this is constrained by network topology: a forwarding node with few connections can narrow the set of possible senders to just those few neighbors. Research by Romiti et al. (2021) found that near-deterministic path selection in Lightning significantly reduces the effective anonymity set compared to the theoretical maximum.

Full-Chain Membership Proofs

Some protocols achieve the theoretical maximum anonymity set by proving that a transaction input belongs to the entire set of valid outputs without revealing which one. Monero's FCMP++ upgrade (January 2026) replaced ring signatures (anonymity set of 16) with full-chain membership proofs, expanding the anonymity set to the entire UTXO set of approximately 150 million outputs.

Zero-knowledge proofs enable a similar approach in Zcash, where transactions in the shielded pool are indistinguishable from all other shielded transactions. The anonymity set equals the total number of notes in the shielded pool, which held approximately 4.9 million ZEC as of mid-2026.

Anonymity Set Sizes Across Protocols

Different privacy protocols produce dramatically different anonymity set sizes:

Note that confidential transactions complement rather than replace anonymity sets: they hide transaction amounts (preventing amount-based correlation) but do not themselves create a crowd to hide in. The strongest privacy protocols combine both: hiding who transacted (large anonymity set) and how much (amount hiding).

Use Cases

Financial Privacy

Businesses and individuals use anonymity sets to prevent competitors, advertisers, and surveillance actors from tracking their financial activity. Without privacy measures, Bitcoin's transparent ledger allows anyone to trace the full transaction history of every coin, enabling taint analysis and graph analysis that can link pseudonymous addresses to real-world identities.

Fungibility

A currency is fungible when every unit is interchangeable. Without anonymity sets, individual coins carry traceable histories: a coin previously associated with sanctioned activity might be rejected by exchanges, making it worth less than a "clean" coin. Larger anonymity sets make history-based discrimination impractical, preserving fungibility.

Censorship Resistance

In jurisdictions where financial surveillance enables political censorship, anonymity sets protect users from having transactions blocked or accounts frozen based on spending patterns. The larger the anonymity set, the more difficult it becomes for censors to identify and target specific users.

Protocol-Level Privacy

Layer 2 solutions like Spark and the Lightning Network rely on anonymity sets to provide privacy beyond what the base Bitcoin layer offers. By routing payments through multiple hops with onion encryption, these protocols create anonymity sets among all possible payment originators, offering practical privacy for everyday transactions. For a deeper analysis, see the research on Lightning Network privacy and Bitcoin's privacy landscape in 2026.

Risks and Considerations

Intersection Attacks

If an attacker observes a user participating in multiple anonymity sets (across different CoinJoin rounds, for instance), the intersection of those sets may narrow the candidates to a single user. Goldfeder et al. (2017) demonstrated that web tracker data from e-commerce sites could be cross-referenced with CoinJoin outputs to break privacy. This means that anonymity sets from isolated transactions are stronger than those from repeated participation in the same protocol.

Timing and Amount Analysis

Even within a large anonymity set, timing correlations can leak information. If a user deposits into a mixing protocol and withdraws shortly after, the time gap itself becomes a fingerprint. Similarly, non-uniform output amounts in a CoinJoin reveal the common-input heuristic linkages between inputs and change outputs, reducing the effective set. Cross-chain analysis research on Tornado Cash (2025) de-anonymized up to 34.7% of sampled transactions using timing and denomination patterns.

Network-Level Deanonymization

Transaction-level anonymity can be undermined at the network layer. An attacker monitoring Bitcoin's peer-to-peer network can observe which node first broadcasts a transaction, linking it to an IP address. The Dandelion protocol mitigates this by randomly routing transactions through the network before broadcasting, but adoption remains limited. Dust attacks and address reuse further erode anonymity by creating linkable on-chain artifacts.

Regulatory Pressure

Privacy-enhancing tools face increasing regulatory scrutiny. In 2024, the founders of Samourai Wallet were arrested for operating an unlicensed money transmitting business related to their CoinJoin coordinator, and several CoinJoin coordinators voluntarily shut down. While personal use of privacy tools has not been prosecuted, many exchanges now flag or reject deposits with CoinJoin history, creating practical barriers to using anonymity sets on Bitcoin. For more on the evolving landscape, see the research on transaction graph privacy defenses.

Diminishing Returns vs. Cost

Larger anonymity sets provide diminishing marginal privacy gains. Going from an anonymity set of 2 to 10 is a dramatic improvement; going from 10,000 to 100,000 provides little additional practical protection against most threat models. Meanwhile, the computational and coordination costs of larger sets grow: CoinJoin rounds with more participants take longer to coordinate, and full-chain membership proofs require more complex cryptographic operations. Each protocol makes tradeoffs between anonymity set size, transaction speed, and computational overhead.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.