A Decline in User Demand for Privacy?

How do you measure the adoption of technology whose purpose is to become harder to measure?

A recent paper from a group at the University of York, No Country for Old Privacy, painstakingly researched the use of privacy techniques on a rapidly changing Bitcoin landscape and found some interesting connections and some glaring limitations. One of the most notable things they discovered was there was actually a rather limited scope of the use of privacy techniques. They were looking at four general categories: CoinJoin, CoinSwap, CoinShuffle, and Stealth Addresses. Briefly, the first three use a combination of arranging transactions in such a way that it is hard to determine the final destination of on-chain transactions, either through making it difficult to connect or combining many participants' inputs and outputs, making the final relationships similarly hard to find after the transaction. Stealth Addresses use one-time payment addresses to shield repeated transactions from looking like they end up at the same place. Despite so many advanced tools to conduct such transactions, the researchers found that they represented less than 1% of all Bitcoin transactions across the period of the study.

“Our analysis reveals consistently low adoption rates, with these protocols constituting less than 1% of network transactions”

Now, to say this kind of analysis is a heavy lift is a severe understatement. The team decided not to use readily available commercial blockchain surveillance tools, which use off-chain data, because it would strongly limit their reproducibility over the 9-year study period. They chose a heuristic approach that wasn't trying to identify who was seeking privacy through the above-mentioned methods. They were looking for the fingerprints that those known methods leave on Bitcoin's public ledger. Enter 2017's SegWit change in Bitcoin's transaction structure: some information was moved to a previously unused witness field and — boom — their parser didn't examine that field. This is where we see our first drop in detections. Does that mean that CoinSwaps didn't take place? No. It means the footprints were harder to find.

Things didn't get any better for the researchers when they worked on Stealth Addresses. Like the Three Little Bears, the premise was straightforward. They tried three different heuristics. One was too restrictive, leaving less than 5k candidates. They broadened it, and now they captured arbitrary data and Bitcoin Ordinals that merely looked similar but had nothing to do with the types of addresses they were looking for. Finally, tightening the structure around the BIP47 structure, they found nothing. Zero, zilch, nada. The authors acknowledge that ultimately they could not rule out nonstandard stealth implementations their heuristic didn't capture.

So what does declining privacy mean in the context of the changes to the Bitcoin protocol over this period? The article mentions several major events: SegWit being the first, but Taproot, Terra/Luna, Ordinals, ETFs, and finally, event G — a letter from the FBI in April of 2024 warning about unregistered money-transmitting services. This is where the paper gets really interesting, and harder to distinguish from a speculative assertion versus a forensic blockchain analysis. The paper mentions several drops in recognition of certain privacy techniques after each event. Sometimes dramatically.

The authors openly acknowledge the obvious correlation-is-not-causation argument, but they also do a remarkably good job at showing just how hard it is to determine user intent by simply looking at on-chain behavior. They cannot tell whether the decline represents less demand for privacy, migration to less detectable Bitcoin privacy methods, or migration to privacy chains like Monero or Zcash.