CashFusion Privacy: What the Combination Counts Do—and Do Not—Show

Public UTXO ledgers reveal transaction amounts and spending relationships. Addresses are pseudonyms, not privacy guarantees: combining coins, reusing addresses, or interacting with an identified service can connect activity over time.

CashFusion is a collaborative transaction protocol implemented by BCH wallets such as Electron Cash. Several participants contribute inputs and choose outputs for one large transaction, making simple input-to-output ownership assumptions less reliable.

It improves privacy; it does not create a mathematically guaranteed anonymity set.

What the protocol hides

In the final transaction, every input and output is public. The uncertainty concerns which participant controlled which components.

CashFusion allows participants to contribute multiple inputs and outputs with non-uniform amounts. According to the protocol specification, a coordinator organizes rounds, distributes information, and broadcasts the completed transaction. Blind signatures, commitments, covert submissions over Tor, and participant verification are designed to keep the coordinator and other participants from learning ordinary input-output linkages while retaining a way to exclude disruptive clients.

The coordinator is still operational infrastructure. It can deny service, observe timing, or collude with other observers. The protocol narrows what a correctly functioning coordinator learns; it does not make the server nonexistent or eliminate network metadata.

A useful counting exercise

One way to build intuition is to count how many ways a set of transaction components could be partitioned among groups. The Stirling number of the second kind, S(n, k), counts partitions of n labeled objects into k non-empty, unlabeled groups.

For example, S(20, 3) equals 580,606,446. The number grows quickly as components are added.

That is a combinatorial upper-bound exercise, not a CashFusion privacy score. Real partitions must satisfy amount conservation, fee rules, component limits, known wallet behavior, and whatever side information an analyst already has. Many mathematically possible groupings can be impossible or implausible in the actual transaction.

Inputs times outputs is not enough

Multiplying an input count by an output count only counts possible individual pairs. It does not count valid assignments of several inputs and outputs to participants, and it ignores amounts.

Likewise, multiplying several large partition counts can illustrate how a naive search space explodes, but the result should not be described as the number of equally likely transaction histories.

The time required to enumerate that synthetic space can be enormous:

An analyst does not need to enumerate it. Practical chain analysis uses constraints and probabilities: exact or near amount matches, wallet fingerprints, timing, exchange records, address reuse, later consolidation, and repeated behavior. A strong privacy analysis asks how much those signals reduce uncertainty, not how long brute force would take.

What improves the result

CashFusion's design can still make tracing materially harder:

• several participants contribute components to one transaction;
• input and output amounts are varied rather than forced into one equal denomination;
• range-based pools group contributions that can form workable transactions;
• multiple rounds can reduce the usefulness of earlier ownership heuristics;
• Tor and covert submission paths reduce direct network linkage;
• each participant verifies the transaction before signing their own inputs.

More participants or rounds can help, but only when the surrounding behavior does not immediately relink the outputs.

Remaining failure modes

• Spending fused outputs together later can recreate a common-ownership signal.
• A payment to an identified counterparty can connect the output to a person.
• Timing and network observation can narrow likely participants.
• Malicious peers or a coordinator can attempt denial of service or collect side information.
• Wallet bugs, unsafe backups, and compromised devices remain outside the transaction protocol.
• A distinctive amount or rare transaction pattern can be easier to follow than a common one.

The 2020 CashFusion security assessment reviewed the protocol and implementation available at that time. An audit is valuable evidence, not a permanent guarantee; later code and operating environments still require review.

Read the number honestly

Combination counts explain why ownership assignment becomes more complex than drawing one line from every input to one output. They do not prove that every assignment is valid, equally likely, or hidden from a well-informed observer.

CashFusion is best understood as one privacy layer in a broader practice: avoid address reuse, separate identities, protect network metadata, use wallet coin controls carefully, and consider what later transactions reveal.