Topic: Accepting Bitcoin donation anonymously (Read 667 times)

What I meant was simply that the public key hash and its verification using OP_EQUALVERIFY will be the same, however the signature verification using OP_CHECKSIG differs.

I wouldn't say it is OP_CHECKSIG which makes them different. The OP_CHECKSIG opcode is identical in every signature it appears in - simply an 0xac byte. What is different is the actual signatures themselves. Your client should obviously be using a different R value for each input, and since you are signing different messages you will always have a different S value. Even if you reused the R value (which would put all the coins on that address at risk of theft!), you will still have different S values and therefore require a separate signature for each input.

Yeah, I think I got a bit confused myself while I was typing the question!
If I understood, the OP is asking about the receivers of the donations, opposing to what I understood in the first place, from the thread title.
My question, without introducing any of my thoughts to keep it simple, is how receiving for instance, 10 different donations in 10 different addresses, keeps you in anonymity or how it protects your privacy... If I totally agree with the answer, then great, I got it, if not, I'll keep asking further questions until I get it.

It is only partly true, because you can use some tricks to make it the same, for example: "300602010102010103 OP_SWAP OP_CHECKSIG". In that case, you can create two UTXO's with the same signature. You can also replace SIGHASH_SINGLE with SIGHASH_ALL, in this case it will still be spendable. If (r;s) pair is equal for two different UTXO's, then you can still switch to a different (Q;z) pair and get a valid signature.

Oh bloody hell, right, I'm sorry! My Bitcoin basics got a little rusty, I guess. I was under the assumption that you can spend multiple UTXOs which are spendable with the same private key, using a single spending script.

In the example you gave, both UTXOs have the same output script:

However, the OP_CHECKSIG is what makes the difference.
I think that's due to Script being stack-based and popping the value after using it. Therefore you need to add it 1 more time for every extra OP_CHECKSIG that you want to perform.

The question that comes to mind is: Why do you have to include your public key to scriptSig 10 times if it's from the same address? Isn't 1 enough?

I might be completely misunderstanding your point, but the single input transactions you have linked to are smaller because they only spend a single UTXO, not because the input address has been reused multiple times.

Here is a transaction which spends two UTXOs from the same address. Each input requires it's own signature, since UTXOs are identified by the TXID which created them and the number of outputs in that transaction, and not by whichever address they end up at.

In the first transaction you link - https://mempool.space/tx/dcc7b78d453f122cba89cc0168a5a079f9b0b391b474e76e7d12646abebf8e06 - only one signature is needed because only one UTXO is spent, specifically the 2nd output (0 based numbering) from this transaction: https://mempool.space/tx/add0611d0b7b1d1bcada5c4d4bdb4df425ffbcffbb06a3ae6181496a730e97ff:2

The second example you give - https://mempool.space/tx/7b63b2d05c665c5ae560e57b087947f106d4996ddba0e9511254f48f807a1439 - has again only spent a single UTXO, specifically the 1st one from this transaction: https://mempool.space/tx/55f932c9334e088f1998a6bb3f232013b12753ca3a67280f0a5988a54717cb44:1

In either of the examples you gave, if the owner of those addresses had chosen to spend multiple UTXOs from those addresses, they would still have had to provide a separate signature for each input, despite them all being present on the same address.

If I spend 10 inputs on the same address or 10 inputs spread across 10 different addresses, then all else being equal the transactions will be of identical size.

Really ? You could've asked for help without naming countries. You've felt important typing them. You're doing a website for new clients who need anonymity because their lives are important. They've contacted you for the website you don't know how to make anonymous bitcoin donations ?

What's really this thread about ?

This is indeed correct, I hadn't thought of it. Thanks!

I think we're nearby the obvious here. If you're going to donate to an organization regarding Ukraine you should either way be cautious. I'll give a better example: If you're going to buy drugs, is it the address reuse that will make you give special importance to your privacy protection?

With option A, those who are donating know in advance there is a privacy risk prior to sending their coin. With option B, those who are donating think they will have privacy, and may not take steps to improve their privacy prior to sending the donation.

Option B will also likely result it in taking longer for privacy to be reduced. I would describe this as a negative because it may result in someone letting their guard down.

Of course, I'm aware of that, but funding it twice means both UTXOs are spendable by the same private key. Think of how the spending script / witness of a transaction looks like when spending funds of 2 addresses versus a single address (no matter how many UTXOs).

For instance, in the latest block we can find a single-input transaction:
https://mempool.space/tx/dcc7b78d453f122cba89cc0168a5a079f9b0b391b474e76e7d12646abebf8e06
It has a size of 286 Bytes and a single spending script.

The input address has been funded multiple times, yet only one script is needed.
https://mempool.space/address/17A16QmavnUfCW11DAApiJxp7ARnxN5pGX

Another transaction that has multiple inputs, needs multiple spending scripts:
https://mempool.space/tx/15d3611435cc6125758790d13bd2f636559cfc5cac6f58dd9524b7b75b07d733
Hence its size is ‎591 Bytes and it has three scripts:

These input addresses are SegWit though, so it's not much larger than the other transaction indeed. I pasted the witnesses as well, but only the OP_PUSHBYTES_22 lines are ScriptSigs here, whereas in the other transaction the single ScriptSig is quite a bit larger.

---

Maybe a better single-input transaction is this one, since it is also SegWit:
https://mempool.space/tx/7b63b2d05c665c5ae560e57b087947f106d4996ddba0e9511254f48f807a1439
It's just 250 Bytes compared to the 591 Byte transaction with 3 inputs, which costs over twice as much in fees.

The spending script is just:

With the following witness.

If we inspect the address, we can see that a single small script like this spends the funds of 1 address that has seen over 13,000 transactions.
https://mempool.space/address/3J5ZgXpkCffMoDi1snLMw9bY5GCUxyN8nw
After scrolling a bit, they all look like deposits, so tons of UTXOs. All spent with a single private key, a single signature actually.

If you fund an address twice, you have two UTXOs, not one. As said by ETFbitcoin, Bitcoin isn't balance-based.

Right, that was my impression as well. (you may need to correlate inputs from time to time when doing larger payments, but that won't always be required)

How's that? If you use more inputs, your transaction size increases. In option A, there will always only be a single input, which is the smallest payment transaction that you can build. Well, second, after the script for a payment that has a single output.

There's no downside.

If you use option A, you can spend all the inputs at once, which will reduce the fee by a lot, especially if you used a different transaction for each input. If you use option B, you can choose to either sacrifice your privacy and spend all the inputs at once, or retain it with a higher cost.

Anyhow, option B is better, because it leaves you choose to either do it a la option A or even better privacy-wise.

His dilemma is:

• Option A: always hand out the same address - all payments are correlated by having the same output address, but he can spend the whole amount at once without issue.
• Option B: always give a fresh address - all payments are non-correlatable, but if he needs to spend more than what the largest UTXO allows to spend, he has to use multiple inputs which links them.

I believe Option B will still be better, because you may need to correlate inputs from time to time when doing larger payments, but that won't always be required; when taking Option A, you'll always correlate all incoming payments. Biggest downside of Option B is the associated higher cost of multi-input transactions.

On the other hand, as a business / organization, you don't really have to care, because you're at most breaking the senders' anonymity by breaking the unlinkability of their transactions. Basically, if someone wants privacy, that's going to be 'sender privacy' and they'll have to mix their UTXOs before paying, not after receiving.

Can't you do the same with a non-custodial wallet that supports coin selection? (Such as Electrum)

There's no need to trust a third party app. You only need an HD wallet that derives new addresses each time it's queried.

---

Your text is a little bit confusing. In case I haven't understood it correctly, could you elaborate?

I didn't read all the replies but I have a question about using many different addresses for the purpose of anonymity. So, for instance, if I am an organization that needs funds to work and those funds are coming from Bitcoin and I want to keep the organization anonymity, how one will handle the total amount if I need to spend it all at once, or at least, I need to gather the amount of, let's say, 15 different addresses? Like, can one keep the anonymity using a 3rd party wallet that can handle the amounts in all addresses and create transactions for my needs and still keep the anonymity?

I ask this because when we use web blockchain explorers to check addresses balances, most of them show us an anonymity rate and many times the problem is re-using addresses and another is emptying an address of its total amount. So, my dilema here is if I want to keep anonymity, I have to use a new address for every amount received/sent but to do this I need to trust a 3rd party app or code or service (in case of web sites).

Actually, it is non-custodial indeed. Here's from the FAQ.

Disclaimer for clarity: I have used it only twice a long time ago and I have no affiliation, I just remembered something about it not being custodial / trustless when this topic came up.

I have never used Boltz exchange to be honest, but I have heard of it being mentioned on the forums a few times. I have never seen it mentioned in a negative context while there are many accusations and issues with instant swap platforms like the ones listed previously. That leads to the conclusion they aren't operating in the same way and their claims of being non-custodial aren't true (not talking about Boltz here). If those swap platforms were non-custodial, I should have a chance to withdraw my money if I am not happy with certain terms, but I don't think that's what's happening, and if it was possible, they wouldn't have such a bad reputation and instances of the occasional scam here and there.

Actually, they can be non-custodial, if they use some sort of atomic swap (like a submarine swap for Lightning). In that case, nobody can lock up your funds since you don't 'go first'. Not sure if this exists, though. I believe https://boltz.exchange/ is like this (onion), but it only has Bitcoin, Lightning and Ethereum, no Monero.

Yes, something like changelly, changenow, sideshift, simpleswap etc. people call this instant exchanges and even some hardware wallets are using their services.
They usually charge higher fees than normal centralized exchanges, but you don't have to withdrawal fees because you are getting converted coins directly in your wallet address.
Some of this exchanges can be risky and I even saw people complaining being scammed using some of them.
I guess one of the safest way for swapping coins would be using atomic swaps, one exists for BTC-XMR called unstoppableswap.net but only for smaller amount of coins, and bugs are still possible.

Yeah, platforms that perform crypto swaps or instant exchanges between two coins. Honestly, I don't know how instant those are. Some of them like ChangeNow claim to be non-custodial. Their exact wording is "Free of Custody." How can something be "free of custody" if you are depositing YOUR coins in one of THEIR addresses? I guess you can claim anything you want in crypto. Another thing I remember about services like the one I mentioned is that they claim to be anonymous. You don't need to do KYC. However, their partner exchanges and whatnot can still ask you to undergo KYC. If that happens, the non-custodial exchange will LOCK YOUR COINS until you go through KYC.

So non-custodial, much great... woof. 

Cold and hot wallets are made-up terms that have to do with the internet connectivity of the devices that contain private keys in their drive. OP will probably generate a master key pair and derive the donation addresses. I believe they know what's more secure and what's not. Either way, they haven't mentioned if the private keys will be stored online.

What's an instant exchange? You mean centralized swap services?

I guess he could do that and then convert received coins back to Bitcoin, but there is a risk in doing that on exchanges that are centralized or instant.
One of the better way would be to use decentralized exchange Bisq for that or some p2p trading website.
Alternative option for him is using Lightning Network donations with his own channel, that is much harder to track than Bitcoin and he will pay much less fees.

If the goal is to get the donations anonymously then you should consider another coin like Monero where transactions can't be traced.

I don't get clear why they want to store the bitcoin donation online, that's not the secure way to handle this. All the donations should go to a cold wallet and then send them to a hot wallet when you will spend those donations. That's would be the secure way.

I would never suggest anyone to use any telegram service or groups if they want to use something non-custodial and non-kyc.
Telegram account is directly connected with your phone number and IP address location, and they don't have any encryption in chats or in groups, so everything is public and stored on their servers.
Some say that secret chat has some encryption, but this is questionable, can't be verified and it's only available on mobile devices.

Other than Localcryptos and other similar p2p trading website, there is also decentralized exchange called Bisq, but I am not sure if there is liquidity for specific region.
You can always start your own trade and call people to join with adding more liquidity, and this is one of the best ways for trading.
Your keys, your coins and fiat currency method of your choice.

They asked for the best solution.

If OP customer really have serious privacy concern, they would use method to reduce the link/connection. For example, they could use P2P or multiple exchange for each/few addresses.


This is horrible for donator privacy. The moment they send Bitcoin to that address, blockchain analysis immediately know the group receive donation and know the donator donate to that group (if the donator doesn't have strong privacy practice).

There is not "a bit of privacy". the efforts using various addresses is neglible in his case. Thats all there is. Its not worth spending brain over it. Absolute not important as 99% of his problems are getting money into his account frm abroad that is from crypto sale. And for that, it doesn't matter.


I mean it doesn't hurt and yes, maybe it helps a bit but given the overall challenge he has, thats the last he should care.

This doesn't sound right.

If you have 200 UTXOs from 200 different addresses, you don't have to cluster them all in one transaction. That's why there's coin selection. OP may not want to cash them out all at the same time. Therefore, they can gain a little privacy. On the other hand, if they have 200 UTXOs in 1 address, it won't matter if they coin-select or not as they'll have revealed that all these outputs are owned by the same person from the beginning.

Plus, they may not want from their people to know how much money there are donated. If they use 1 address, they're doomed to reveal it.

A fourth option is to use a decentralized exchange such as Bisq.

You can't sum up all the countries in that region like this, the difference between them is HUGE. For examples in Iran you can have any religion or no religion at all and all major religions are publicly practiced and each have a seat in the Parliament, whereas you can't practice anything other than the Saudi regime's religion in Saudi Arabia.
Additionally bitcoin is legal in Iran and is being openly traded even though regulations are still incomplete.

I have read a lot of the posts so far and I don't see why so many write here so much without knowing the real problem behind your request. Also they might not understand that being atheist is a problem in the region and that is why being anonymous is important.

I have had 3 years experience with Saudi and other governments in the region (in regards to BTC) and therefore can tell you, that I know what I am talking about.

The first thing to mention is that you do not really increase your privacy with individual addresses. In my opinion, you can ingore this requirement right away.
If you collect donations on 200 addresses and want to cash them out, you eventually will send out a transaction clustering them. if you use coinjoin or other mixing services, you risk your coins being frozen by exchanges.
So lets ignore this right away and you can easily use 1 address only for all donations.
Here you can see an example of glasschain how they group addresses into wallets: https://glasschain.org/btc/address/bc1qx65xcxz6dfsge2g4eaerercslh83y66wrpm79r
The same would be done for your wallet.

Second is that your MAIN problem is to get the money in Saudi Riyals onto a saudi Bank account. As long as you just HODL Bitcoin you are good and nobody knows who is behind that 1 bitcoin address.
If you use middle eastern platforms like rain.bh you are screwed. They UPFRONT deliver data to regulators from where they are accessible to all gov. entities as they please. So this is a big nogo.
You must restrain yourself from using any service that needs KYC on any entity that is connected to you in the middle east but better even globally.

So you have 3 options

a) using a non kyc custodial service on telegram (I know there are a few reputable ones in operation since years. They really work and never heard of a scam there!).
There you might run into liquidity issues if you want to cash out more than 50k usd in 1 day.

b) using a non kyc p2p exchange such as Localcryptos or Vertex. If you sell Bitcoin, the buyer doesn't want to kyc you as he has no risk. However, you must make 100% sure you KYC and verify the person who will send you FIAT as they can very, very easily claim the money back in your region. Also, think of a reason to tell your bank why you got thismoney form YYZ as "selling bitcoin" is not an option.

c) using a foreign entity (anywhere far away from the MENA region) and cash out those coins there and then invoice this company out of saudi and get funds
However, you won't be finding it very easy to just get a bank account to cash out funds.

Therefore for me your best shot is option a).

gradually cash out and make sure to use various banks and various bank accounts to receive transactions from the escrow service. Keep funds you don't need cash as USDT and try to pay as much as you can with crypto.

Tried to PM you but as I am apparently a newby I can't ;-)

It's not that hard to use BTCPay server to generate new addresses for each donation, but problem could happen when you decide to consolidate all those transaction at some point.
Only way to keep some privacy would be to have good address management or to use some services like Chipmixer that would break connection with previous transactions.
Coinjoin could also be an option but it's less effective than mixers and they are easier to track with Chainalasys and similar tracking services.

In summary: Setup a BTCPay server and mix each UTXO individually when you'll have to spend from the donations. This way you'll have accomplished maximized anonymity with Bitcoin. If each user is not meant to donate much, consider using Lightning for better privacy and efficiency.

I assume the reason why your clients want to "accept bitcoin anonymously" is because their donors wish to donate in a way such that their identity is not linked to the donations.

If your clients receive donations from donors, there is the potential that your client will spent the coin in a way that will link all of the donations together, which is the equivalent of using a single donation address.

There are various ways of accepting bitcoin in a way such that a new address is generated for each potential transaction. Others in this thread have mentioned some implementations, and I will not suggest one above what has already been discussed.

However the above is not going to solve your underlying problem. The ideal solution to what I believe is your client's problem is that your client's donors need to be able to send bitcoin in a way such that the transaction cannot be traced back to their identities. A good first step to doing this is to not reuse addresses, not publish any addresses that belong to them, and to use coin control.

The problem isn't how to accept bitcoin donations anonymously. The problem is how to spend  bitcoin donations anonymously.

Once you have received your donation, you are 100% private (if you are using a fresh new address). But when you send those coins to an exchange, your privacy is gone.

My suggestion is to transfer all donated coins to a bitcoin mixer. Once those coins are mixed, you can send them an exchange and spend them. Nobody will be able to track that thsoe funds came from the original donation address.

What happens after the donations are collected?
Let's say 60 people donate to their cause and the coins can now be found in 60 different addresses. What do they plan to do after that? Distribute it equally among themselves or do they have more "advanced" ideas?   

Sounds like a good idea honestly.. Just make sure to find a good one. If you're searching for 'crypto experts', you're going to find a lot of self-proclaimed experts that discovered the whole topic a year ago and are going to recommend you investing all of your money into their new hot ICO or something like that.
Better look for 'Bitcoin experts' and make sure they really do know what they're doing.

Thank you guys for the input!
I think it is better to outsource and do this task with help of crypto experts. Their life is important.

Thank you again 

If it wasn't still so new and experimental, I'd recommend BOLT12 offers.
Everyone wanting to receive donations could create such an offer code that can be put on a website (static) and receive anonymous Lightning payments. These follow different paths every time by default, so there is no such thing as address reuse and blockchain analysis at all at play here. As far as the blockchain is concerned, funds never moved.

Not sure if that aligns with your product-market-fit, since it would require some technical know-how from the people receiving donations (setting up a node etc.)...

I would probably just set up a Bitcoin node for every user and either make (or find) a tip jar plugin that shows a webpage which generates a new address for each request, or one that generates Lightning invoices with the push of a button.
Something like this: https://github.com/lightningd/plugins/tree/master/donations

I was referring to third-party payment processors, CoinPayments, etc. Perhaps could've said with better clarity.

I think it will work, with a fancier UI as well. Though I'd probably be more inclined to just code something like that myself, don't think OP wants a complicated plugin anyways.

Obligatory comments:

1) So long as you know what you are doing. If you don't have experience running a secure anonymous server then having different address for each donation is pointless.

2) If you can't host your own wallet then find a trustworthy individual to do it for you.

3) After getting the donations not having good OpSec for the coins will remove any anonymization in about 1/2 a second. If you don't understand why or how this is: STOP NOW and read up on how coins can be tracked.


-Dave

But BTCPay (which is payment prcoessor) should be viable option assuming it's not misconfigured. Even Tor Project use BTCPay to accept cryptocurrency donation.

Set up a HD wallet, make a donation script on your website.

For every query of the donation, ask your server to increase the index by 1 then display the address on the page. This way, every of your address is unique and there it is more convenient to store your keys offsite. I won't endorse any plugins for this, though I know wordpress has a few handy plugins but I've never tested them. Any payment gateway is out of the question, especially when anonymity is concerned.

Hi,
I am doing a website project to my new clients. Basically they are a group of atheist individuals from Saudi, Iran and other few Middle East countries.

They want to accept bitcoin donation on website. They demand a system that generates new wallets address every time they accept donation.

Overall, they wanna accept and store bitcoin donations securely and anonymously** online. What is the best solution.

Thanks