Crypto OPSEC cheatsheet

Chainalysis, Elliptic, and CipherTrace are used by law enforcement, exchanges, and regulators worldwide. Understanding their capabilities is essential for threat modeling.

Chainalysis has claimed limited Monero tracing via spy nodes (their own nodes logging connecting IPs). This is mitigated by running your own node, using Tor, or connecting to trusted remote nodes over Tor.

Most alternatives have optional privacy features that are weaker or less adopted than Monero's always-on approach. Regulatory pressure in 2025-2026 has further reduced their exchange availability.

Local node gives maximum privacy since you verify everything yourself, but requires 180GB+ storage and initial sync time. Remote nodes are convenient but the operator can see your IP and transaction timing. Always use Tor when connecting to remote nodes.

# Run your own node (maximum privacy)
monerod --detach --data-dir /path/to/blockchain

# Prune blockchain to save space (~65GB instead of 180GB+)
monerod --prune-blockchain --data-dir /path/to/blockchain

# Connect wallet to local node
monero-wallet-cli --daemon-address 127.0.0.1:18081

# Connect to remote node over Tor (SOCKS5 proxy)
monero-wallet-cli \
  --daemon-address xmr-node.onion:18089 \
  --proxy 127.0.0.1:9050

# Feather Wallet handles Tor routing automatically
# No extra configuration needed

Monero transactions are private by default. Use subaddresses to avoid linking receives, and accounts to compartmentalize funds for different purposes.

# CLI: send XMR
transfer <address> <amount>

# Ring size is fixed at 16 in current Monero versions
# No configuration needed - privacy is automatic

# Subaddresses: generate new receiving address per transaction
address new
# Each subaddress is unlinkable to others

# List all subaddresses
address all

# Accounts: separate balances within one wallet
account new "OPSEC purchases"
account new "Personal"
account switch 1

# Check balance
balance

# Show transaction history
show_transfers

The hardest part of crypto OPSEC is the on-ramp: converting fiat to XMR without leaving an identity trail. Options ranked by privacy level.

# P2Pool mining (anonymous, decentralized)
# Requires running your own monerod
./p2pool --host 127.0.0.1 --wallet <your_xmr_address>

# P2Pool mini sidechain (lower hashrate threshold)
./p2pool --host 127.0.0.1 --wallet <your_xmr_address> --mini

# XMRig miner connecting to local P2Pool
./xmrig -o 127.0.0.1:3333

# Expected yield: depends on hardware
# A modern CPU can earn small amounts over time
# Not profitable, but the XMR is completely clean

Running Monero over Tor prevents your ISP and node operators from correlating your IP with transactions. Feather Wallet does this automatically, but CLI users need manual configuration.

# monerod over Tor (torrc addition)
# Add to /etc/tor/torrc:
HiddenServiceDir /var/lib/tor/monerod/
HiddenServicePort 18081 127.0.0.1:18081

# Start monerod with Tor
monerod --anonymous-inbound \
  YOUR_ONION.onion:18081,127.0.0.1:18081,16 \
  --tx-proxy tor,127.0.0.1:9050,16

# Wallet via torsocks
torsocks monero-wallet-cli \
  --daemon-address node.monero.org:18089

CoinJoin combines multiple users' transactions to obscure input-output mapping. The landscape has changed significantly since 2024 due to law enforcement action.

# JoinMarket (decentralized, most resilient option)
# Configure joinmarket.cfg for Tor
# Set network = tor in [MESSAGING] section

# Run as taker for mixing
python sendpayment.py -N 5 wallet.jmdat \
  <amount> <destination>
# -N 5 = five mixing rounds

# Wasabi Wallet (third-party coordinators)
# Download from wasabiwallet.io via Tor
# Add community coordinator URL in Settings
# WabiSabi protocol for coordination

Warning: Samourai Wallet domain was hijacked in 2026 and serves phishing/malware. Do NOT download anything from samouraiwallet.com.

Lightning moves transactions off-chain, which hides them from blockchain analysis. However, Lightning is NOT anonymous. It has significant privacy limitations, especially against state-level adversaries.

For OPSEC: Lightning provides better privacy than raw on-chain Bitcoin, but far less than Monero. Useful for small anonymous purchases (Robosats, Silent.link eSIMs) when combined with Tor.

Atomic swaps allow trustless, peer-to-peer exchange of BTC for XMR with no intermediary and no KYC. The swap either completes fully or refunds both parties.

# COMIT network atomic swap tool
# https://github.com/comit-network/xmr-btc-swap

# Run as buyer (you have BTC, want XMR):
swap --seller-addr \
  /dns4/seller.onion/tcp/9939 \
  buy-xmr \
  --receive-address <your_xmr_address> \
  --change-address <your_btc_change_address> \
  --electrum-rpc tcp://electrum.onion:50001

# The swap completes atomically:
# either both sides execute or neither does
# Typical completion time: 20-30 minutes

# List available sellers
swap list-sellers --tor-socks5-port 9050

# Resume incomplete swap
swap resume --swap-id <id>

Always route Bitcoin traffic through Tor to prevent IP correlation. Bitcoin Core supports native Tor. Never run a Bitcoin node or wallet without Tor in an OPSEC context.

# Bitcoin Core via Tor (bitcoin.conf)
proxy=127.0.0.1:9050
listen=1
bind=127.0.0.1
onlynet=onion
dnsseed=0
dns=0

# Add seed nodes manually
addnode=bitcoinnode.onion:8333

# Electrum via Tor (single server mode)
electrum --proxy socks5:127.0.0.1:9050 \
  --oneserver \
  --server electrum.onion:50001:t

# Sparrow Wallet (GUI, good coin control)
# Settings > Server > Private Electrum
# Proxy: SOCKS5 127.0.0.1:9050

Strict discipline when interacting with any exchange prevents chain analysis from linking your anonymous funds back to your identity. One mistake can unravel the entire chain.

• Always access exchanges via Tor Browser
• Never reuse wallet addresses across exchanges
• Use a dedicated browser profile per exchange
• Small amounts to avoid triggering KYC thresholds
• For Bisq/Haveno: dedicated machine or VM for the application
• Never exchange from a KYC wallet directly to your anonymous wallet
• Wait variable time intervals between operations (avoid timing patterns)
• Use different exchanges for different operations (compartmentalize)
• Clear browser state between sessions
• Generate a new receiving address for every transaction

# Using Trocador.app (exchange aggregator)
# 1. Access via Tor: trocador.onion
# 2. Select: BTC -> XMR
# 3. Enter your XMR receiving address (fresh subaddress)
# 4. Send BTC to the provided address
# 5. Receive XMR (typically 10-30 minutes)

# Using ChangeNow via CLI (with Tor)
torsocks curl -X POST \
  "https://api.changenow.io/v2/exchange" \
  -H "Content-Type: application/json" \
  -d '{
    "fromCurrency": "btc",
    "toCurrency": "xmr",
    "fromNetwork": "btc",
    "toNetwork": "xmr",
    "address": "<your_xmr_address>",
    "flow": "standard"
  }'
# Returns a deposit address - send BTC there

Haveno is the recommended decentralized exchange for acquiring XMR. It runs over Tor by default, requires no KYC, and uses a security deposit system to prevent scams.

# Download Haveno from haveno.exchange
# Verify signatures before running
# Haveno runs its own Tor instance

# First run:
# 1. Create a new account
# 2. Fund your Haveno wallet (small BTC deposit for security)
# 3. Set up a payment method (cash by mail, face-to-face, etc.)
# 4. Browse offers or create your own
# 5. Complete trade through the arbitration system

# The application handles Tor, escrow, and
# dispute resolution automatically

Domain registration can reveal your identity through WHOIS records, payment trails, and account information. Use privacy-focused registrars and anonymous payment methods.

1. Create XMR wallet via Tor (Feather)
2. Fund with anonymously acquired XMR
3. Register domain on:
   - Njalla (privacy by default, accepts XMR,
     owns the domain on your behalf)
   - Namesilo (accepts BTC, Whois privacy free)
   - Porkbun (accepts BTC)
4. Use Whois privacy (Njalla does this natively)
5. Configure DNS via Tor
6. Use anonymous email for the registrar account
   (ProtonMail/Tuta via Tor, paid with XMR)

The complete chain from fiat to anonymous service payment. Each step must be performed over Tor with no overlap between identities.

KYC Exchange (your identity known)
    |
    v
BTC sent to personal wallet
    |
    v
BTC -> Instant Swap (ChangeNow/Trocador via Tor)
    |                          |
    v                          v
XMR received in             Time delay
OPSEC wallet                (hours/days)
(Feather via Tor)
    |
    v
Pay for: VPS, domains, SIM cards, VPN, services
(No link back to original BTC/identity)

Some services require phone verification. Anonymous SIM or eSIM cards can be purchased with crypto to avoid identity linkage.

eSIM providers accepting crypto:
- Silent.link (accepts BTC/Lightning, no KYC)
- ESIM.me (accepts crypto)
- Bitrefill eSIMs (accepts BTC/XMR)

Physical SIM:
- Cash purchase at retail store (no ID in some countries)
- Activate on a burner device
- Never use on your personal device
- Never use on home WiFi

Workflow:
XMR -> swap to BTC Lightning -> Silent.link eSIM
Activate on dedicated device over public WiFi or Tor hotspot

Hardware wallets provide cold storage but introduce physical security concerns for OPSEC scenarios. Consider the tradeoff between cryptographic security and physical seizure risk.

Ledger OPSEC risk: Ledger has suffered multiple data breaches (2020, 2023, January 2026 via Global-e) exposing customer names, shipping addresses, phone numbers, and order details. Buying a Ledger with your real address creates a permanent record linking you to crypto hardware ownership. If you must use Ledger, buy with cash from a reseller or use a dead drop address.

For OPSEC: Feather Wallet on Tails/Whonix is often more practical than hardware wallets, since hardware wallets require physical possession (seizure risk), shipping address exposure, and firmware trust.

Tails OS is an amnesic live operating system that routes all traffic through Tor. Combined with Feather Wallet, it provides a strong platform for anonymous crypto operations.

# 1. Boot Tails from USB
# 2. Enable persistent storage (encrypted)
# 3. Download Feather Wallet AppImage to persistent

# In Tails persistent directory:
chmod +x feather-linux-x86_64.AppImage
./feather-linux-x86_64.AppImage

# Feather auto-detects Tails and routes through Tor
# Wallet files saved in persistent storage
# On shutdown, only persistent partition survives
# RAM is wiped - no forensic traces

Whonix provides a two-VM architecture: Gateway (Tor) and Workstation (isolated). Running your wallet in the Workstation ensures all traffic is forced through Tor with no possible leaks.

# In Whonix-Workstation:

# Install Feather Wallet
chmod +x feather-linux-x86_64.AppImage
./feather-linux-x86_64.AppImage
# All traffic automatically routed through
# Whonix-Gateway Tor instance

# Or run monero-wallet-cli
# No proxy config needed - Whonix handles routing
monero-wallet-cli \
  --daemon-address node.monero.org:18089

# For extra isolation: run separate Workstation VMs
# for different wallet identities

Timing analysis is a powerful deanonymization technique. Correlating the time of an on-chain transaction with login times, IP activity, or real-world events can break anonymity.

• Do NOT transact immediately after receiving funds
• Wait random intervals (hours to days) between receive and send
• Avoid transacting at consistent times (breaks pattern analysis)
• Use Monero's built-in 10-block (20-minute) lock time to your advantage
• Consider scheduling transactions during high-network-activity periods
• Never discuss transaction timing on any communication channel

• Never reuse addresses - generate a new subaddress for every receive
• Separate wallets for separate identities/operations
• Label everything internally so you know what funds are for what
• Do not merge UTXOs from different sources in Bitcoin (links them)
• Monero churning - send XMR to yourself a few times to increase ring signature decoy set

# Monero: generate new subaddress per transaction
address new

# Monero: churn (send to self)
transfer <your_own_subaddress> <full_balance_minus_fee>
# Repeat 2-3 times with time delays

# Bitcoin: avoid UTXO consolidation
# Never combine inputs from different sources
# Use coin control in Wasabi/Sparrow to select specific UTXOs

The FATF Travel Rule requires exchanges to share sender/receiver identity data for transactions above thresholds (varies: $1,000-$3,000). This does not apply to self-custodied wallets or P2P transactions, but affects any interaction with regulated exchanges.

• Tax reporting requirements vary by jurisdiction
• Most countries treat crypto as property (capital gains tax on disposal)
• Monero transactions are private on-chain but tax obligations still apply
• Using privacy coins does not exempt you from tax law
• Keep your own records if needed for compliance in your jurisdiction

• Monero
• Feather Wallet
• Haveno
• Bisq
• Monero Documentation
• Monero CLI Guide
• Monero Research Lab
• COMIT XMR-BTC Swap

• Mullvad VPN (Privacy-focused VPN, accepts XMR/BTC/cash, no account needed)
• Anonymization (Identity separation and OPSEC methodology)
• OPSEC Checklist (Operational security verification steps)
• Red Team Infra (Offensive infrastructure setup and management)
• Cellular OPSEC (Mobile threat model, IMSI catchers, baseband)
• Tails (Amnesic live OS for temporary anonymous sessions)