💻 computer science

A Tattered Cloak of Invisibility: Measuring Anonymity Loss in Railgun on Ethereum

This paper demonstrates that despite Railgun's strong cryptographic foundations on Ethereum, user behavioral patterns such as timing, address reuse, and transaction amounts can significantly compromise anonymity, allowing heuristics to uniquely link 17.65% of withdrawals to deposits and causing a median anonymity loss of 3.42 bits.

Original authors: Kanan Huseynov, Ali Shahzaib, István András Seres, János Tapolcai

Published 2026-06-25

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Kanan Huseynov, Ali Shahzaib, István András Seres, János Tapolcai

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you walk into a giant, transparent bank where everyone can see your name, your balance, and every single transaction you've ever made. That's how most public blockchains (like Ethereum) work. To fix this, people built "mixers" like Railgun. Think of Railgun as a high-tech, magical cloak of invisibility. You walk in, hand over your money, and the cloak scrambles it with thousands of other people's money. When you walk out, you get your money back, but theoretically, no one knows which pile of cash you originally put in.

The paper you provided, titled "A Tattered Cloak of Invisibility," asks a simple but scary question: Is the cloak actually torn?

The authors (a team of researchers from Hungary) argue that while the math behind the cloak is perfect, the people wearing it are clumsy. Even if the magic is flawless, users leave behind behavioral footprints that let observers stitch the cloak back together and figure out who you are.

Here is how they found the holes in the cloak, explained through everyday analogies:

The Five Ways the Cloak Gets Tattered

The researchers identified five specific ways users accidentally reveal their identity:

1. The "Same Door" Mistake (Address Reuse)

The Analogy: Imagine you enter a magic room through a front door labeled "John." You get your invisibility cloak, mix your money, and then decide to leave through the exact same front door labeled "John."
The Reality: In the digital world, this is called Address Reuse. If you use the same digital address to put money in and take money out, the cloak is useless. The researchers found that about 6% of users made this mistake, instantly linking their deposit to their withdrawal.

2. The "Friendly Wave" (Direct Transactions)

The Analogy: You enter the magic room, get your cloak, and then immediately walk out and wave at your friend (who is standing right outside the room). Even if you are invisible inside, that wave connects you to your friend.
The Reality: Users often send money from their "deposit" address to their "withdrawal" address (or vice versa) to pay for gas fees or top up balances. This creates a direct digital handshake. The researchers found this happened in about 9% of cases.

3. The "Taxi Driver" Leak (Gas Payer Reuse)

The Analogy: To leave the magic room, you need to pay a taxi driver (a "relayer") because you have no cash on you. Usually, a stranger drives you. But sometimes, you drive yourself. If you drive yourself, your license plate (your deposit address) is visible on the car, revealing who you are.
The Reality: When withdrawing, you need to pay a transaction fee. If you don't use a third-party "relayer" to pay this fee, you might pay it from your own deposit address. The researchers found that many users did this, linking about 2% of withdrawals directly to their deposits.

4. The "Puzzle" (Knapsack Matching)

The Analogy: Imagine you put three specific bills into a machine: a $5, a$ 10, and a $20. Later, you take out exactly $35. Even if the machine mixed the money, the fact that $5 +$ 10 + $20 =$ 35 is a huge clue.
The Reality: Railgun allows you to deposit any amount. If you deposit specific amounts (like 1.5 ETH and 2.3 ETH) and later withdraw exactly 3.8 ETH, a computer can solve this "math puzzle" (called a knapsack problem) and guess that your withdrawal came from those specific deposits. This doesn't always give a 100% match, but it drastically narrows down the list of suspects.

5. The "Fingerprint" (Amount Fingerprints)

The Analogy: You put a very specific, weird amount of money in, like $12.3456789. When you take it out, you take out $12.3456789 (minus a tiny fee). That specific sequence of numbers is like a unique fingerprint.
The Reality: Unlike older mixers that only accepted round numbers (like exactly $100), Railgun accepts any number. If you deposit a "psychologically salient" number (like 1.234567), you tend to keep those specific digits when you withdraw. The researchers found that while this wasn't a perfect link on its own, it added to the other clues.

The Big Result

By combining these five clues, the researchers were able to uniquely link 17.65% of all withdrawals to a specific deposit.

Think of it this way: If 100 people walk into the invisible room, the math says they should all be equally anonymous. But because of these behavioral mistakes, the researchers could confidently say, "We know for sure that Person #17 is the same person who walked out as Person #42."

Furthermore, they used a computer program to solve the "math puzzles" (the knapsack problem). This didn't always give a single answer, but it reduced the "anonymity" (the number of possible suspects) by about 3.4 bits for every transaction. In plain English, this means the pool of potential suspects shrank significantly, making it much easier to guess who is who.

The "Fast-Forward" Problem (Timing)

The paper also highlights a timing issue. Many users treat the mixer like a quick tunnel: they put money in and take it out almost immediately (often within a day).

The Analogy: If you walk into a crowded room and walk out 10 seconds later, there are only a few people you could have been. If you stay for a month, you could be anyone.
The Reality: The researchers found that the "median" user waited less than one day. This tiny window makes it incredibly easy to guess who deposited what, regardless of how many people are in the pool.

What Should You Do? (The Advice)

The paper concludes with a list of "don'ts" for anyone trying to stay anonymous:

Never use the same door: Always use a fresh address to take your money out.
Don't wave at friends: Don't send money between your deposit and withdrawal addresses.
Take the taxi: Always use a third-party "relayer" to pay your fees so your own address isn't seen paying for the exit.
Don't be predictable: Don't deposit and withdraw the exact same amounts. Mix it up, or do some internal transactions (like swapping tokens) inside the pool to scramble the numbers.
Wait it out: Don't rush. Stay in the pool for weeks or months so your withdrawal gets lost in a larger crowd.

The Bottom Line

The paper's main message is that privacy isn't just about the math; it's about behavior. Even if the "cloak" is made of the strongest magical fabric, if you wear it while waving at your friends, running in a straight line, or leaving your footprints in the mud, the cloak won't save you. The researchers didn't break the magic; they just showed how users are accidentally tearing the fabric themselves.

Technical Summary: A Tattered Cloak of Invisibility: Measuring Anonymity Loss in Railgun on Ethereum

1. Problem Statement

While cryptographic privacy protocols like Railgun on Ethereum utilize zero-knowledge proofs to hide the link between deposit and withdrawal transactions, the practical anonymity provided to users is often compromised by behavioral leakage. Unlike traditional banking, where transaction histories are private, public blockchains expose transaction amounts, timing, and graph relationships. The authors argue that even if the underlying cryptographic protocol is secure, user behaviors—such as timing patterns, address reuse, and distinctive transaction amounts—can significantly shrink the effective anonymity set. The paper investigates the extent to which these behavioral traces allow an adversary to heuristically link a specific withdrawal to its corresponding deposit in the Railgun shielded pool.

2. Methodology

The study employs a passive adversary model, utilizing only publicly available data from the Ethereum Layer-1 blockchain. The authors collected a comprehensive dataset of Railgun transactions (deposits, withdrawals, internal transfers, and swaps) up to May 2026. They formulated five distinct heuristics to identify plausible links between deposit transactions ( $d_i$ ) and withdrawal transactions ( $w_j$ ):

Address Reuse (H1): Identifies links where the withdrawal address is identical to a previous deposit address. This heuristic is deterministic and produces zero false positives by definition.
Direct Transactional Linkage (H2): Detects links where a transaction exists on-chain between a deposit address and a withdrawal address (in either direction), often occurring when users top up a withdrawal address with funds from their deposit address to cover gas fees.
Gas Payer Address Reuse (H3): Analyzes the sender of the withdrawal transaction. If a user broadcasts their own withdrawal (self-broadcast) rather than using a third-party relayer, and the gas payer address matches a known depositor, a link is established.
Knapsack Matching (H4): Treats the problem as a subset sum (knapsack) problem. It attempts to find a subset of prior deposits whose amounts sum to a specific withdrawal amount (within a tolerance $\epsilon$ for fees). The authors adapted Pisinger's dynamic programming algorithm to solve these instances efficiently.
Amount Fingerprints (H5): Examines the decimal expansion of transaction amounts. It looks for unique "fingerprints" (specifically the first three non-zero fractional digits) that are preserved across deposits and withdrawals, assuming users do not fully randomize their transaction values.

The study also utilized Little's Law to estimate the average residence time of funds in the pool and analyzed the distribution of timing intervals between deposits and withdrawals.

3. Key Contributions

Behavioral Leakage Perspective: The paper shifts the focus from cryptographic vulnerabilities to the interaction between protocol design and user behavior, demonstrating how side-channel information reduces anonymity.
Heuristic Framework: The authors introduce and formalize five specific heuristics (H1–H5) tailored to the flexible nature of Railgun, which supports arbitrary amounts and internal transactions, unlike fixed-denomination mixers like Tornado Cash.
Empirical Measurement: The study provides the first large-scale measurement of anonymity loss in Railgun, quantifying the reduction in the effective anonymity set based on observable on-chain data.
Open-Source Release: The authors released the collected dataset and the analysis code to facilitate further research into privacy measurement.

4. Results

The application of these heuristics to the Railgun dataset yielded the following findings:

Linkage Rate: The first four heuristics (H1–H4) successfully uniquely linked 17.65% of all withdrawal transactions to a single deposit transaction. Specifically:
- H1 (Address Reuse) linked 6.10% of withdrawals.
- H2 (Direct Tx Link) linked 8.98% of withdrawals.
- H3 (Gas Payer Reuse) linked 2.20% of withdrawals.
- H4 (Knapsack Matching) linked 4.41% of withdrawals.
Timing Sensitivity: The median time between deposit and withdrawal for linked pairs was 0.84 days, indicating that a significant portion of users treat the pool as a simple mixer rather than a long-term privacy tool. This rapid cycling drastically reduces the effective anonymity set.
Knapsack Analysis: The knapsack solver produced a median anonymity loss of 3.42 bits for withdrawal transactions, meaning the uncertainty regarding the source of funds was reduced by this amount for the median case.
Fingerprinting: While the Kolmogorov–Smirnov test showed statistical differences in amount fingerprints, the authors found that fractional amount fingerprints (H5) were not sufficiently reliable for standalone deanonymization due to noise from transaction fees and global rounding effects.
Pool Usage: Only 15.00% of deposited ETH remained in the shielded pool at the time of measurement, suggesting most users withdraw quickly. The estimated average residence time was approximately 183 days, but the median behavior was much faster.

5. Significance and Claims

The paper claims that while Railgun provides a strong cryptographic guarantee of unlinkability, the practical privacy is substantially weaker due to user behavior. The authors emphasize that:

Anonymity is not absolute: Even in systems with large nominal anonymity sets, behavioral patterns can narrow the set of plausible origins to a single user or a very small group.
Protocol vs. Behavior: The anonymity loss documented arises from the interaction between the protocol and user behavior, not from a failure of the zero-knowledge proof system itself.
Actionable Insights: The study provides specific recommendations for users to improve their privacy, such as always using third-party relayers, avoiding address reuse, waiting longer before withdrawing, and avoiding psychologically salient or round transaction amounts.
Design Implications: The authors suggest that future privacy protocols could enforce minimum residence times or offer fixed-denomination tiers to mitigate the specific leakage channels identified (H4 and H5).

The authors conclude that their work highlights the "fragile position" of privacy-enhancing infrastructure, where the utility of the system (flexibility, speed) often conflicts with the ideal of total anonymity. They explicitly state that their findings do not identify real-world identities but rather demonstrate the probabilistic links available to any passive blockchain analyst.