Privacy with Bitcoin: what others can see about you

The Bitcoin blockchain is like a bank statement posted publicly for ever: no names, but every entry. Anyone who knows which addresses are yours can learn a lot about you. Here you’ll see who can see what and which legal habits protect you from strangers – not how to hide anything from the tax office.

Pseudonymous is not anonymous

The whitepaper describes the principle: all transactions are public. You can see that someone is sending an amount to someone else, but not who they are.^[1]

So the blockchainGlossaryBlockchainBitcoin’s public ledger: a chain of blocks in which each block refers to its predecessor. Anyone wanting to change an old entry would have to recreate all the blocks that follow it.On the learning path: Stage 1 · Step 3 – How does Bitcoin work? →In the glossary →× contains no names, but every Bitcoin addressGlossaryBitcoin addressA string of characters like ‘bc1q…’ that someone can send bitcoin to. It is usually derived from a public key, can be shared without risk to your funds and should be generated afresh for every payment.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×, every amount and every timestamp – permanently. If a single address can be linked to a person, it’s often possible to work out who owns other addresses too.^[2]

The hack of the Bitfinex exchange shows how well such traces can be followed: in 2016, 119,756 BTC were stolen. The loot remained visible on the blockchain; in 2022, US authorities seized around 94,000 BTC of it.^[3]

How chain analysis works

Chain analysis groups addresses that probably belong to the same person or company. Sarah Meiklejohn and colleagues showed back in 2013 how well this works: using simple rules of thumb and 344 transactions of their own with exchangesTermExchange (crypto exchange)A trading platform where buyers and sellers trade bitcoin with each other via an order book.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →AdLicensed providers with a paid linkProviders from our comparisonKrakenExchange · MiCA (Central Bank of Ireland)Visit Kraken* (paid link, opens in a new window)BitvavoExchange · MiCA (AFM, Netherlands)Visit Bitvavo* (paid link, opens in a new window)CoinbaseExchange · MiCA (CSSF, Luxembourg)Visit Coinbase* (paid link, opens in a new window)All 7 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.×, merchants and other services, they attributed entire groups of addresses to specific providers.^[4]

The main rules of thumb:

• Common inputs: if a transaction uses several inputs, they probably belong to the same owner. The whitepaper calls this linking unavoidable.^[1],[2]
• Change: a payment often has two outputs – the amount for the recipient and the change back to you. Round amounts, address types and typical wallet patterns often reveal which is which.^[2]
• Reused addresses: an address used more than once links all payments to and from it.^[2]
• Known anchors: addresses of exchanges, merchants or donation appeals are often known. The Bitcoin Wiki counts identity verification at exchanges among the biggest intrusions on privacy.^[2]

This is how an analysis reads an ordinary payment:

Example with made-up values; own illustration based on the Bitcoin Wiki.

Heuristics deliver probabilities, not proof. The 2013 study itself rated its change rule as considerably less reliable than the common-inputs rule.^[4] Still, assume that an analysis sees a lot.

The most common mistake: reusing addresses

The whitepaper recommends a new key pair for every transaction.^[1] Reusing an address lets others track your receiving and spending – down to how many satoshis you hold at known addresses. There are security reasons too.^[5]

Modern wallets show a new address automatically every time you receive. Old addresses stay valid, but don’t hand them out again. How addresses are created is explained in Keys, addresses & seed phrases.

Typical traps:

• A fixed donation address on your website or profile: it collects every payment visibly in one place.
• The same withdrawal address for your savings planTermSavings plan (Bitcoin savings plan)Automatically buying bitcoin at fixed intervals with a fixed amount, for example $50 a month.On the learning path: Stage 4 · Step 4 – Setting up a savings plan →In the glossary →AdLicensed providers with a paid linkProviders from our comparison21bitcoinBitcoin app · MiCA (FMA, Austria)No paid link for your country · Profile →RelaiBitcoin app · MiCA (AMF, France)No paid link for your country · Profile →BISONExchange · MiCA (BaFin, Germany)No paid link for your country · Profile →All 11 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.×: anyone who knows it can see your entire savings history.
• Addresses in chats: the link between address and person stays in the chat history.

What your exchange and the tax office know

With an authorised provider, you go through identity verification (KYCGlossaryKYC (Know Your Customer)The obligation of regulated providers to identify you before the business relationship starts and to ask, for example, about its purpose and, where necessary, the source of your money. In Germany, the legal basis is the Money Laundering Act (GwG).On the learning path: Stage 4 · Step 3 – Buying Bitcoin →In the glossary →×). It’s a legal requirement, not mistrust of you. In Germany, for example, the Money Laundering Act (GwG) requires the provider to record the details and generally keep them for five years.^[7] So it knows who you are, what you bought and which addresses you withdraw to.

Under the EU Travel RuleGlossaryTravel Rule (Transfer of Funds Regulation)An EU rule requiring crypto providers to send details of the sender and recipient with transfers. Since 30 December 2024, for more than €1,000 from or to your own wallet, the provider also checks that the address is yours.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×, the provider stores details of the sender and recipient for every withdrawal to a self-hosted address. Above €1,000, it must also check whether the address is owned or controlled by you.^[8] Your wallet address is therefore linked to your name at the provider. How this works in practice: Your first withdrawal to your own wallet.

Such data is valuable to criminals even without passwords: it reveals that you own crypto assets, plus your name and often your home address. In May 2025, Coinbase disclosed that criminals had bribed overseas support staff and stolen customer data for scam calls; according to the company, passwords, private keys and funds were not affected.^[9] So:

• Only provide mandatory details, and use a separate email address for financial accounts.
• Have hardware wallets delivered to a pick-up point rather than to your front door.
• After every data leak, expect fake calls and emails – see Spotting & avoiding scams.

DAC8: withdrawals end up in the report to the tax office

Since 1 January 2026, crypto providers in the EU have been recording their customers’ transactions for the tax authorities (DAC8GlossaryDAC8 (EU reporting rules for crypto-assets)EU directive that has required crypto providers to report customer data and transactions to the tax authorities since 1 January 2026. In Germany, the KStTG implements it; the first report, for 2026, is due by 31 July 2027.On the learning path: Stage 6 · Step 3 – Bitcoin & tax →In the glossary →×).^[10] Each member state implements DAC8 in its own law. The details below are Germany’s, where the Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenz-Gesetz, KStTG) applies;^[11] for other countries, see Bitcoin tax around Europe.

Providers report every year by 31 July for the previous year to the Federal Central Tax Office (Bundeszentralamt für Steuern), for the first time in 2027; from there, the data goes to your local tax office. They report your identity including your tax ID, your purchases and sales as annual totals – and transfers to addresses they can’t attribute to another provider, such as your own wallet, with market value and quantity.^[11]

Who sees what (as of September 2026)?

Coin control: choose deliberately what you spend

Your wallet doesn’t hold a balance as one sum, but individual ‘coins’: every amount you have ever received (technically, UTXOsGlossaryUTXO (Unspent Transaction Output)An output of an earlier transaction that hasn’t been spent yet – like a single banknote in your wallet. Bitcoin has no account balances: your balance is the sum of all the UTXOs you can spend with your keys.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×). When you pay, the wallet picks suitable coins – and visibly links them in the process.

With coin control, you choose which coins go into a payment; labels record where they came from. That way you spend only coins of one origin, and the recipient can’t link them to your other coins.^[2] Desktop wallets such as SparrowProvider · Software walletSparrow WalletBitcoin desktop wallet with no purchase price and full transparency: coin control, PSBT, multisig and support for most hardware wallets.Non-custodial software – no financial licence required · reviewed Sept 2026Price: no purchase price (donations welcome); network fee when sending (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗× offer both.^[13]

To start with, it’s enough to label incoming payments and, before larger payments, check which coins the wallet wants to use.

Node, Tor and Lightning

Your own node. A wallet that queries other people’s servers reveals your addresses to them. Block explorers learn which addresses you look up, often along with your IP address. With your own full nodeGlossaryFull nodeA node that checks every block and every transaction itself against all the consensus rules. If you run a full node, you don’t have to trust anyone to know whether a payment is valid.In the glossary →×, your wallet downloads all the data itself and doesn’t query anyone else’s server.^[2] How it works: Nodes & decentralisation.

Tor. Your IP address can also reveal where a transaction comes from. The Bitcoin Wiki recommends broadcasting transactions via Tor.^[2] Some wallets have Tor built in, Sparrow for example.^[13]

Lightning. Payments on the Lightning Network don’t appear individually on the blockchain. Opening and closing payment channels does.^[2]

Your basic rules

Discreet towards strangers, honest towards the tax office – the two go together. These habits are legal and take little effort:

What’s next?