Bitcoin’s blockchain is public.
That sentence has created an entire industry.
Every transaction can be observed. Every input can be inspected. Every output can be followed. And over the years, blockchain-analysis companies have built increasingly sophisticated systems designed to transform that public graph into something much more valuable:
identities, clusters, balances, relationships and financial histories.
But there is a detail people often miss.
Bitcoin does not actually publish most of those conclusions. The blockchain publishes transactions. The rest is inference. And inference depends on assumptions.
One of the most important of those assumptions has survived for almost as long as Bitcoin itself:
If several inputs appear in the same transaction, they probably belong to the same person.
That assumption is so useful that enormous parts of blockchain surveillance have been built on top of it.
Now Bitcoin developers are quietly attacking it.
Payjoin Dev Kit — better known as rust-payjoin
— has reached ** version 1.0.0**, its first stable release.
The release supports both traditional synchronous Payjoin through BIP78 and the newer asynchronous Payjoin architecture defined in BIP77, including persistent sessions that can disconnect and resume later.
That sounds like developer plumbing. It isn’t.
Because Payjoin does something conceptually simple but potentially devastating to naïve blockchain surveillance.
It takes one of the most common assumptions used to interpret Bitcoin transactions…
…and deliberately makes it false.
Look at a conventional Bitcoin transaction.
Alice wants to pay Bob.
Alice selects two UTXOs from her wallet.
She spends both as transaction inputs.
One output goes to Bob.
Another output comes back to Alice as change.
An observer sees something like:
Input A.
Input B.
Output C.
Output D.
No labels are saying:
**Alice’s first coin.****Alice’s second coin.****Bob’s payment.**Alice’s change.
Those labels don’t exist on-chain. The analyst has to reconstruct them. So blockchain surveillance uses heuristics.
One of the strongest is known as the common input ownership heuristic.
If Input A and Input B are being spent together, the analyst assumes whoever created the transaction must control both private keys.
Therefore, Input A and Input B probably belong to the same wallet or entity.
Cluster them together.
Do that repeatedly across thousands of transactions and the surveillance system begins building enormous webs of supposedly related addresses.
Combine those clusters with exchange KYC data, merchant information, subpoenas, network metadata, and known addresses…
…and Bitcoin’s pseudonymous graph starts looking much less pseudonymous.
This assumption has been extraordinarily useful.
It is also not a consensus rule. Bitcoin never said all transaction inputs must have the same owner. Users simply tended to construct transactions that way.
Payjoin exploits that difference.
In a Payjoin transaction, Alice still wants to pay Bob.
But Bob contributes one of his own UTXOs to the transaction.
Now the transaction contains inputs controlled by different people.
Alice contributes an input. Bob contributes another. They collaboratively construct the transaction. The final transaction goes onto Bitcoin exactly like any other valid transaction.
**To a passive observer, there is no magical **PAYJOIN=true
** flag.**
There is just a Bitcoin transaction.
And now the common input ownership assumption breaks.
If an analyst automatically clusters every input together, the analyst may conclude: Alice’s input belongs to Bob. Or Bob’s input belongs to Alice.
The cluster has been poisoned.
The assumption that helped reconstruct ownership becomes the source of the error.
That is the fundamental Payjoin trick.
Nothing changed in Bitcoin consensus.
No soft fork. No privacy sidechain. No new token. No trusted mixer.
Just two people building a perfectly valid Bitcoin transaction differently.
Most Bitcoin privacy conversations revolve around hiding something.
Hide an address.
Hide an amount.
Hide your IP.
Hide the transaction path.
Payjoin attacks surveillance from another direction. It makes the public data ambiguous.
That distinction matters.
Imagine a surveillance camera recording two people walking into a building.
Traditional privacy tries to prevent the camera from seeing them.
Payjoin lets the camera record everything … but destroys the assumption that lets the observer confidently explain what happened.
The blockchain remains public.
The transaction remains public.
The inputs remain public.
The outputs remain public.
Yet the interpretation becomes less certain.
This is a deeply Bitcoin-native form of privacy. No secrecy layer is added to consensus.
Instead, users stop behaving in the predictable way surveillance systems expect them to behave.
There is a fascinating historical detail here.
Bitcoin’s white paper explicitly acknowledges the privacy leakage created when multiple inputs are spent together.
Satoshi noted that multi-input transactions can reveal that those inputs share an owner.
At the time, that was effectively true because wallets constructed transactions that way. Payjoin breaks that assumption by making collaborative input ownership practical.
