Bitcoin change addresses explained: where your privacy actually leaks
Change outputs quietly link your Bitcoin addresses into a single cluster. How the common-input heuristic works, and the de-anonymizations it made possible.
home / news
news & notes
202 postsshort notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
latest notes
newest firstChain Analysis for Beginners: How Your Transactions Get Clustered
Bitcoin looks anonymous but rarely is. We explain how analysts cluster addresses, why KYC exchanges are the choke point, and what mixing really buys you.
Sanctioning the Code: The Mixer Crackdown and Its Unraveling
From Blender.io to Tornado Cash to Sinbad, OFAC's war on crypto mixers tested a novel idea: that code itself can be sanctioned. Here is how it unfolded.
The End of Easy Bitcoin Privacy: How the Samourai Arrests Killed Off CoinJoin
Arrests, server seizures and regulatory fear ended one-click CoinJoin in under six weeks. Here is how investigators took down Samourai, why Wasabi folded, and what fills the gap.
Wallet hygiene checklist: why separating spending, savings and burn wallets beats any security tool
Most crypto losses trace back to one mistake: keeping every satoshi in a single wallet. A practical checklist for splitting spending, savings and burn wallets.
Fake Admins, Fake Police: How Impersonation and Extortion Scams Prey on Dark Web Users
Fake admins, spoofed police letters and forged seizure banners now drain more wallets than most hacks. Here are the documented campaigns and how to verify any official contact.
The Fake Support Ticket: How Scammers Wear the Staff Badge
Scammers posing as market staff and tool support run a polished ticket-based con. Here is the playbook they follow and the verification steps that actually stop them.
Fake tracking links: the parcel scam built for impatient buyers
A text says your parcel is stuck. The link looks like the postal service. Here is how fake tracking pages harvest cards and addresses, and how to verify safely.
Dead drops and paranoia: what the Hydra-era kladman model teaches about security trade-offs
Hydra's courier dead-drop system moved secrecy into city parks and stairwells. Its story is a case study in why too much operational security can be as dangerous as too little.
Buyer Opsec Foundations: The Minimum That Actually Matters
Most buyers are not caught by elite hacking. They are caught by reused usernames, linked wallets, and unencrypted phones. Here is the boring baseline that decides real outcomes.
Device security before Tor: your browser is not the weakest link
Tor cannot protect a compromised device. Why OS updates, disk encryption and malware hygiene matter more than any browser setting before you connect to the network.
Tails, Whonix or just a VM: honest answers about isolation on Tor
Tails forgets everything, Whonix refuses to leak, and a plain VM only contains. What each Tor setup really protects, where each fails, and who should run which.