Maya didn’t go to the hackspace that night. She couldn’t. Her legs wouldn’t carry her past the apartment door. Every time she reached for the handle, she saw the Analyst’s message glowing on her phone screen: I see you, Maya. I see your change address. You just made a mistake.
She spent the night curled on the mattress, laptop closed, phone buried under a pillow. The walls of the studio felt thinner than ever. Every creak of the building, every footstep in the hallway, every distant siren was him—closer, always closer.
At 6:00 AM, she finally slept. At 7:30, Dex’s messages woke her.
You didn’t come.
I’m not mad. I’m worried.
Please answer.
She typed back with shaking fingers: He messaged me. He knows I spent from a stealth address. He said he sees my change address.
A pause. Then: He doesn’t know it’s you. He knows someone made a mistake. There’s a difference. But we need to move faster. Can you come now?
Maya looked at the gray light filtering through the curtains. The laundromat below was already humming with early customers. The world was moving, and she was still here, still alive, still hidden—for now.
I’ll be there in an hour.
Scene 1: The View Key Explained Deeply
Dex was alone in the hackspace when she arrived. The purple-haired girl was gone. The 3D printer had stopped. Even the server rack was quiet. It felt like a tomb.
“I cleared everyone out,” Dex said without preamble. “What we’re about to do—what we’re about to talk about—needs privacy.”
Maya slumped into the folding chair. “I’m sorry. I shouldn’t have spent without you.”
“You’re right. You shouldn’t have.” Dex’s voice was flat, but not cruel. “But what’s done is done. Now we have to fix it—and make sure you understand why it was dangerous.”
He turned to the whiteboard. Overnight, he’d filled it with new diagrams: key hierarchies, encryption flows, and a large heading that read VIEW KEY = DANGER.
“You already know about the scanning key,” Dex began. “That’s what lets you detect stealth addresses on the blockchain. But the scanning key is only half the story. The view key is the other half—and it’s much more dangerous to lose.”
He drew three boxes in a vertical line.
PRIVATE KEY (Full Control)
- Spend funds
- Detect stealth addresses
- Generate new addresses
- Never stored online. Never shared.
SCANNING KEY (Detection Only)
- Detect stealth addresses
- Cannot spend
- Can be shared with auditors, but cautiously.
VIEW KEY (Read-Only)
- View balances of detected addresses
- Cannot detect new addresses on its own
- If stolen, adversary sees all your past and future incoming funds.
Maya stared at the diagram. “I thought the scanning key and the view key were the same thing.”
“Common mistake.” Dex picked up a marker and drew arrows connecting the boxes. “Here’s how they work together. The scanning key lets you find stealth addresses. The view key lets you see what’s inside them. Without the scanning key, the view key is useless—you have nothing to look at. Without the view key, the scanning key just gives you a list of addresses with no balances.”
He tapped the view key box. “But here’s the problem. Most people—including most wallet software—bundle them together. They give you a single ‘view key’ that actually does both jobs. That’s what I gave you on the USB drive. It’s a combined key. With it, someone can scan and view.”
Maya’s hand went to her backpack, where the USB drive sat in the front pocket. “So if he gets this…”
“He can see every donation you’ve ever received. Every single one. Not just the amounts—the timestamps, the donor addresses, the memos. He’ll know exactly when you get money, how much, and who from. He’ll be able to watch your balance grow in real time.”
“He can’t spend it, though.”
“No. But he doesn’t need to spend it. He needs to find you. And knowing your financial patterns—knowing when you pay rent, when you buy groceries, when you move funds—gives him a map straight to your location.”
Maya felt the familiar cold spread through her chest. “So what do I do? Destroy the view key?”
“No. You need it to manage the DAO’s funds. But you need to store it securely. Offline. Encrypted. Never on a device connected to the internet.” Dex pulled a small metal box from his backpack—the kind meant for storing USB drives in a fireproof safe. “This is yours. Keep the view key in here. Only take it out when you absolutely need to scan.”
Maya took the box. It weighed almost nothing. “You think of everything.”
“I try.” Dex’s expression softened. “Now let me show you what the view key should be used for—so you understand why it exists at all.”
Scene 2: Good Uses of the View Key
Dex pulled up a new screen on his laptop—a demo version of a nonprofit accounting dashboard. “The view key was invented for transparency, not surveillance. Watch.”
He entered a view key into the software. The dashboard populated with a list of all incoming donations to a fictional charity: amounts, dates, donor notes, and a running total.
“This is how a treasurer can prove to donors that the money is arriving,” Dex explained. “They share the view key with an auditor or a board member. That person can see every donation, verify that nothing’s been stolen, and confirm the balance—all without being able to spend a single coin.”
He switched to another tab. “It’s also used for tax reporting. If you need to prove your income to a government agency, you can share your view key instead of your private key. They see what came in, but they can’t touch it.”
Maya nodded slowly. “So the view key is for accountability.”
“Exactly. It’s a tool for limited transparency. You decide who gets to see your incoming funds, and for how long. And when you’re done, you can revoke access by generating a new view key from your private key.”
“You can revoke it?”
“Yes. The old view key stops working. That’s the beauty of the system.” Dex smiled for the first time all morning. “You’re always in control. As long as you control your private key, you control who sees what.”
Maya thought about the Analyst. About how he’d always wanted to control her—her phone, her money, her friends. The view key was the opposite of that. It was control, but her control.
“Okay,” she said. “I understand. Keep the view key safe. Don’t share it. Use it for transparency when I choose, not when someone demands it.”
“Good.” Dex closed the laptop. “Now let me show you what the Analyst is doing to try to get around that.”
Scene 3: The Analyst Tries to Get the View Key
Dex pulled up his simulation of the Analyst’s surveillance dashboard. This time, it showed a different view—a log of outgoing messages, the kind a chain surveillance firm might send to targets.
“He can’t break your stealth addresses directly,” Dex said. “And he can’t steal your view key without physical access to your devices. So he’s going to try to trick you into giving it to him.”
He clicked on a template message.
Subject: Urgent: Blockchain Privacy Update
From: security@wallet-verification.com
Body: Dear user, our records indicate that your wallet’s view key has been compromised in a recent data breach. To secure your funds, please click the link below and enter your view key to verify your identity. Failure to do so within 48 hours will result in permanent loss of access.
Maya’s stomach turned. “That’s so obvious. The domain name is wrong. The grammar is weird.”
“It’s obvious to you. But what if the message came from an address that looked almost right? What if it mentioned the Safe House DAO by name? What if it referenced a real transaction you made?” Dex pulled up another template.
Subject: Donation #7f3a8b2c9d – Verification Required
From: noreply@safehouse-dao.org (fake)
Body: Dear recipient, a donor has reported that their payment of 2.3000 coins to address sv1qqpz7h4l8k3n2m9x6w5v4u3t2s1r0q9p8o7i6u5y4t3r2e1w may have been sent in error. Please provide your view key to verify receipt and initiate a refund if necessary.
Maya went pale. “That’s my transaction. That’s my stealth address from the donation two nights ago.”
“He found it on the public ledger,” Dex said quietly. “Anyone can see that transaction. Anyone can see the amount, the timestamp, the addresses. He just copied the data and put it into a fake email. He’s hoping you’ll panic and respond.”
“Did he send it?”
“Not yet. But he will. Probably within the next few days. He’ll try variations—different domains, different stories, different emotional hooks. He might pretend to be a donor who lost a loved one and needs to verify that the money arrived. He might pretend to be a journalist investigating the DAO. He might even pretend to be me.”
Maya gripped the edge of the table. “What do I do when it comes?”
“Three rules.” Dex held up three fingers. “One: Never click a link in an unsolicited message. Type addresses manually. Two: Never share your view key with anyone you haven’t met in person and verified through multiple channels. Three: If you’re unsure, assume it’s a trap.”
“That’s… a lot of paranoia.”
“That’s survival.” Dex’s voice was hard. “The Analyst has one job: to get your keys. He doesn’t care how. He doesn’t care who gets hurt. He will lie, cheat, steal, and manipulate. Your only defense is to assume everyone is lying until proven otherwise.”
Maya took a deep breath. “Okay. No clicking. No sharing. Assume trap.”
“Good.” Dex stood up. “Now let me show you his backup plan. Because if he can’t trick you into giving him the view key, he’ll try something else.”
Scene 4: The Dust Attack Setup
Dex navigated to a different part of his simulation—a wallet clustering tool that showed how addresses could be linked through small, seemingly insignificant transactions.
“This is called a dust attack,” he said. “It’s simple, cheap, and often effective.”
He pulled up an old address—one that Maya recognized with a jolt. It was her first privacy wallet, the one she’d used before she fled the Analyst. She’d abandoned it months ago, assuming it was dead and buried.
“This is your old address,” Dex said. “The one you used when you were still with him. He knows it. He probably has it bookmarked.”
“How do you know about it?”
“Because I scanned for links between your new wallet and your old one. There aren’t any—yet. But he’s about to create one.” Dex pointed at the screen. “Watch.”
He simulated a transaction from an unknown wallet to Maya’s old address: 0.0001 coins. A tiny amount. Literally dust.
“He’s sending a microscopic payment to your old wallet,” Dex explained. “The amount is so small it’s worthless—you can’t buy anything with it. But if you ever spend that dust—if you accidentally include that old address in a transaction with your new wallet—the blockchain will link them forever.”
Maya’s blood ran cold. “You mean if I try to clean up my old wallet, or if I send the dust somewhere else…”
“Then anyone watching can see that the same person controls both addresses. Your old identity and your new identity become one. And the Analyst wins.”
“But I’m not using that old wallet. I abandoned it.”
“Doesn’t matter. He’s betting that one day—maybe months from now, maybe years—you’ll make a mistake. You’ll import the old wallet into your new software. You’ll sweep the dust into a different address without thinking. You’ll accidentally use it as a decoy in a ring signature. Any of those things would expose you.”
Maya stared at the screen. The simulated dust transaction sat there, tiny and venomous, like a spider waiting in a dark corner.
“Can I just ignore it?”
“Yes. That’s your only safe option. Never touch that old wallet again. Never spend any of its coins. Never even look at it. Pretend it doesn’t exist.”
“What if he sends dust to my new addresses?”
“He will. He already has.” Dex pulled up another screen—Maya’s current wallet dashboard. “See that?”
He pointed at a tiny transaction from two days ago, before Maya had even arrived at the hackspace for the first time. 0.00005 coins from an unknown sender to one of her stealth addresses.
“He sent dust to three of your stealth addresses,” Dex said. “He doesn’t know they’re yours—not yet. He’s just spraying dust at thousands of addresses, hoping someone will eventually spend it. It’s a numbers game.”
“So every transaction could be a trap?”
“Every incoming transaction from an unknown sender should be treated as suspicious. Don’t spend dust. Don’t interact with dust. Just let it sit there forever.”
Maya felt like the walls were closing in. “This is exhausting. How am I supposed to keep track of all this?”
Dex reached over and closed the laptop. “You’re not supposed to do it alone. That’s why the DAO exists. That’s why I’m here. But you also need to understand the core problem—the thing that makes all of this possible.”
He picked up the marker and wrote one word on the whiteboard:
LINKABILITY
Scene 5: Maya Learns About Linkability
“Linkability,” Dex said, “is the fundamental weakness of every blockchain. Not just privacy coins—all blockchains. The entire system is built on the idea that you can trace coins from address to address. That’s how the network prevents double-spending. But it’s also how surveillance works.”
He drew a chain of circles, each connected by an arrow.
“When you spend from a stealth address, the blockchain shows the input—your stealth address—and the outputs—the recipient and the change address. Anyone watching can see that the input and the change address are controlled by the same person. That’s linkability. That’s how clusters grow.”
Maya nodded slowly. “So every transaction creates links.”
“Yes. And the more links you create, the bigger your cluster becomes. A big cluster is easier to identify. If your cluster includes a known address—like an exchange where you used your real name—then suddenly every address in the cluster is tied to your identity.”
“So the goal is to create as few links as possible.”
“Partly. But you also need to create misleading links—links that point in the wrong direction, or that are impossible to follow.” Dex drew a tangled web over the chain of circles. “That’s what ring signatures do. They add noise. They make every transaction look like it could have come from ten different people.”
He turned to face her. “But linkability isn’t just about transactions. It’s about behavior. Even if you break every cryptographic link, the Analyst can still look at what you buy, when you buy it, and how much you spend. If you always buy groceries at 6 PM on Tuesdays, and the safe house always gets groceries at 6 PM on Tuesdays, then the Analyst can guess—with high probability—that you’re connected.”
Maya thought of her routine. The same coffee shop every morning. The same laundromat every Sunday. The same bus route, the same grocery store, the same everything.
“I’ve been making it easy for him,” she whispered.
“We all do. It’s human nature. But you’re not human to him—you’re a pattern. A set of coordinates on a graph. And patterns can be changed.”
Dex pulled a small notebook from his pocket and handed it to her. “Write down every recurring habit you have. Every place you visit more than once a week. Every person you talk to at the same time. Then start changing them. One by one. Randomly. Unpredictably.”
Maya took the notebook. It felt like a lifeline.
“And the view key?” she asked.
“Guard it like your life depends on it. Because it does.” Dex stood up and stretched. “Come back tomorrow. We’ll start ring signatures. But tonight—go home. Change your routine. Take a different bus. Eat at a different time. Be unpredictable.”
Maya stood up, slung her backpack over her shoulder, and walked to the door. She paused with her hand on the frame.
“Dex? Thank you. For not giving up on me.”
Dex smiled—a small, tired smile. “My mom didn’t give up. Why would I?”
That night, Maya took a different bus home. She bought dinner from a grocery store she’d never visited before, at 9 PM instead of 7. She walked the last three blocks instead of taking the usual shortcut through the alley.
When she got back to her apartment, she checked her phone.
No new messages from the Analyst.
But pinned to the top of her inbox was a new email, sent forty minutes ago.
From: support@privacy-wallet.net
Subject: View Key Verification Required
Body: Dear user, as part of our ongoing security upgrades, please confirm your view key by replying to this message. Failure to respond within 24 hours will result in suspended access to your funds.
Maya deleted the email without opening it. Then she blocked the sender.
In the metal box, the USB drive sat silent and safe.
The Analyst could send a thousand emails. He could send a million dust transactions. He could watch the blockchain until his eyes bled.
But he didn’t have her view key. And he never would.
Table of contents:
Introduction
Chapter 1: The Public Ledger
Chapter 2: A Glass House
Chapter 3: The Stealth Protocol
Chapter 4: The View Key
Chapter 5: The Linkability Flaw <<<<<< NEXT
Chapter 6: The Stalker’s Trace
Chapter 7: The Ring Signature
Chapter 8: A Decoy Mix
Chapter 9: The Tracing Resistance
Chapter 10: Anonymous, Not Invisible
