The hackspace felt different now. The chaotic energy of soldering irons and arguing teenagers had been replaced by a focused silence. Dex had cleared the main workbench and covered it with printed graphs, transaction logs, and a large diagram of something he called a “decoy selection matrix.”
Maya arrived at 9:00 AM sharp, carrying a travel mug of tea and a notebook she’d started using to track every privacy lesson. The notebook was already half full.
“You look terrible,” she said, because Dex looked terrible. Dark circles under his eyes. A hoodie she’d seen him wear three days in a row. Empty energy drink cans lined up like soldiers on the windowsill.
“I’ve been running simulations,” he said, not looking up. “Remember the ring signature you made yesterday? The one with the good decoys?”
“The bookstore transaction. Yes.”
“I ran it through an advanced analyzer last night.” He finally looked at her, and his expression was grim. “Three of your decoys were fake.”
Maya’s stomach dropped. “I checked them. They all had balances. They all had activity.”
“They had balances. They had activity. But two of them were from a known wallet generator—a service that creates fake wallets for testing. Anyone with access to that service’s public key list could identify them instantly. And one of them was an old exchange wallet that’s been flagged as ‘compromised’ for two years.”
He turned his laptop so she could see the screen. The decoy quality analyzer showed the three addresses highlighted in red.
“A smart analyst would eliminate these three immediately,” Dex said. “That leaves seven possibilities. Then they’d look at the remaining seven for other patterns—like the fact that four of them have never made a purchase at a bookstore. Eliminate those, and you’re down to three. Your real input, plus two others.”
Maya felt the familiar cold spread through her chest. “So he could narrow it down to three.”
“With high confidence, yes. And if he had other data—like the timing of your transaction relative to your known habits—he might be able to pick the real one.” Dex closed the laptop. “This is the problem with bad decoys. They don’t just fail to hide you. They actively help the analyst narrow the search.”
“Then how do we fix it?” Maya asked. “How do we find decoys that are actually good?”
Dex turned to the whiteboard. He’d already written a heading: THE DECOY MIX.
Scene 2: The Decoy Mix Construction
“Good decoys,” Dex began, “are indistinguishable from real wallets. That means they need to match three key properties: age, amount, and activity pattern.”
He drew three columns on the whiteboard.
Age: The decoy wallet should be roughly the same age as your real wallet. Not brand new. Not ancient. Within a few months, ideally.
Amount: The decoy’s balance should be in the same range as your real input. If you’re spending 0.5 coins, a decoy with 0.0001 coins is obvious. A decoy with 10,000 coins is also obvious.
Activity pattern: The decoy should have a similar history of transactions—number of outgoing spends, frequency, typical amounts. A wallet that’s been dormant for a year is a bad decoy. A wallet that spends every week is good.
Maya copied the columns into her notebook. “So the perfect decoy is a wallet that looks just like mine.”
“Yes. And the best way to find wallets that look like yours is to look at… yours.” Dex pulled up a graph showing the distribution of wallet ages, balances, and activity levels across the entire blockchain. “Your wallet is in the middle of the curve. Average age, average balance, average activity. That’s good—it means there are thousands of wallets like yours.”
He drew a circle around the center of the graph. “The decoy mix is a pool of wallets that all cluster in this region. Instead of selecting random decoys, you select from this pool. Every wallet in the pool looks like every other wallet in the pool. Indistinguishable.”
Maya studied the graph. “So how do we build this pool?”
“That’s the hard part. You can’t just grab any wallet that looks like yours—because those wallets belong to real people. You can’t use their keys without their permission. But you don’t need their keys. You just need their public addresses to use as decoys.”
She frowned. “So I’m using strangers’ wallets as camouflage. That’s legal?”
“It’s built into the protocol. When you create a ring signature, you’re not touching their funds. You’re just referencing their public keys. It’s like standing next to someone in a crowd—you don’t need their permission to be near them.” Dex paused. “But there’s a catch. If you always use the same set of decoys, an analyst can track that pattern. So the decoy pool needs to be large, diverse, and constantly updated.”
He pulled up a new diagram—a flowchart showing how decoys were selected, used, and then retired.
“This is what I’ve been building,” Dex said. “A dynamic decoy mix. It pulls from a pool of thousands of wallets that match your profile. Each time you make a transaction, it randomly selects decoys from the pool, uses them once, and then flags them as ‘used’ so they won’t be selected again for at least a month.”
Maya’s eyes widened. “That’s… a lot of data.”
“It’s a lot of math. But the software can handle it.” Dex turned to face her. “The problem is that one person can’t build a pool like this alone. You need hundreds of wallets—thousands—to make the pool diverse enough. That’s where the community comes in.”
Scene 3: The Community Mixing Service
Dex pulled up a new screen—a proposal document he’d been working on. The title read: Safe House DAO Community Decoy Pool Proposal.
“The Safe House DAO isn’t the only nonprofit using privacy coins,” he said. “There are shelters, legal aid funds, medical assistance programs—dozens of them. All of them have the same problem: they need good decoys, but none of them can build a pool alone.”
He scrolled through the document. The proposal outlined a shared decoy pool: every participating organization would contribute a list of their own wallet addresses (the public ones, not the private keys). These addresses would be anonymized, mixed together, and made available to all members as decoys.
“So my wallet becomes a decoy for someone else,” Maya said slowly. “And their wallets become decoys for me.”
“Exactly. The more organizations that join, the larger and more diverse the pool becomes. A thousand wallets from a hundred different causes—all of them looking roughly the same. An analyst can’t tell which one is really spending.”
She thought about it. “But doesn’t that put other organizations at risk? If I use their wallets as decoys, could the Analyst trace something back to them?”
“No. Remember, a decoy is just a public key. The Analyst sees that the decoy could have signed the transaction, but they have no way of knowing if it actually did. If anything, being in the pool gives those organizations more privacy, because their wallets are now part of a crowd.”
Dex pulled up a simulation. “Watch. This is a transaction using only your own wallet as the real input and random decoys from the public blockchain. The analyst eliminates half the decoys and narrows it down to five possibilities.”
He ran a second simulation. “Now this is the same transaction, but using decoys from the community pool—all of them matched to your profile. Age, balance, activity—all identical. The analyst eliminates zero decoys. Ten possibilities remain.”
Maya watched the simulation run. The difference was dramatic. With random decoys, the analyst’s confidence climbed to 30-40%. With the community pool, it stayed below 15%.
“Privacy through solidarity,” she whispered.
“Exactly.” Dex smiled. “No one is safe alone. But together, we’re invisible.”
Scene 4: The Analyst Encounters the Decoy Pool
The Analyst sat in his glass-walled office, staring at a transaction that made no sense.
Target C had just spent again—a payment of 1.2 coins to a plumbing supply company. The transaction used a ring signature with ten inputs. He ran his decoy elimination script.
Results:
- Eliminated: 0 decoys.
- Remaining: 10 possibilities.
He ran a second script—the one that checked for exchange wallets, zero balances, and recent creations. Nothing. All ten wallets were between 90 and 180 days old. All had balances between 0.8 and 1.5 coins. All had made between 5 and 15 previous transactions.
This isn’t random, he thought. Someone curated these decoys.
He ran a correlation analysis, comparing the decoys in this transaction to decoys in previous Target C transactions. The overlap was minimal—only one address appeared in both. That meant the decoy pool was large. Hundreds, maybe thousands of wallets.
He leaned back in his chair. For the first time in weeks, he felt genuine frustration.
She’s not doing this alone, he thought. Someone is building a decoy pool. Someone with resources.
He pulled up a map of the city and overlaid the locations of known nonprofits that accepted privacy coins. There were at least twenty. Any one of them could be part of a shared decoy network.
His confidence level on Target C had dropped to 12%.
I need more data, he thought. More transactions. More patterns. More time.
But time was not on his side. The longer Target C remained untraced, the more likely the case would be closed. His boss had already told him to drop it twice.
He saved the transaction to the Target C file and opened a new window. He had another idea—one that didn’t rely on blockchain analysis at all.
He pulled up a list of plumbing supply companies in the city. The transaction had been to one called Apex Plumbing Supply, located at 477 Industrial Way. That was inside the triangle he’d identified earlier—close to the safe house.
If I can figure out which shelter recently had plumbing work done, he thought, I can narrow it down.
He started making phone calls.
Scene 5: The Safe House’s New Boiler
The safe house was an old Victorian that had been converted into apartments. It sat on a quiet street lined with sycamore trees, invisible to anyone who didn’t know what to look for. No sign on the door. No logo on the mailbox. Just a number and a buzzer.
Maya stood in the basement, staring at the boiler. It was older than she was—a rusted hulk of pipes and valves that wheezed and clanked like a dying animal. The heat had gone out twice in the past week. The families were huddled in blankets, and the youngest kids had started getting sick.
“We need a new one,” said Maria, the safe house manager. Maria was forty-two, with gray-streaked hair and the kind of exhaustion that came from twenty years of this work. “The estimate is 1.2 coins. Can we cover it?”
Maya checked her wallet. The donation from two nights ago had been 2.3 coins. After the rent payment and the bookstore purchase, she had about 1.8 coins left in that stealth address—more than enough.
“Yes,” she said. “But I need to do it carefully.”
She pulled out her laptop and connected to the safe house’s private WiFi. The basement was cold, but her fingers were steady. She’d practiced this fifty times on the test network. She could do it for real.
She opened her wallet and selected the stealth address with the 1.8 coins. Then she opened the decoy pool interface that Dex had built—a custom tool that connected to the community pool.
Decoy pool status: 1,247 wallets available.
Age filter: 90–180 days.
Balance filter: 0.8–1.5 coins.
Activity filter: 5–15 transactions.
Matching decoys: 342.
She clicked Select Decoys. The tool randomly picked nine wallets from the pool—all of them matching her profile perfectly. She reviewed them quickly: ages, balances, activity patterns. All indistinguishable.
She entered the plumbing company’s address. 1.2 coins. She clicked Sign.
The ring signature computed in three seconds. She clicked Send.
The transaction broadcast.
Maya stared at the screen. The blockchain explorer showed ten inputs, one output. No way to tell which input was real. No way to eliminate decoys.
She ran the decoy quality analyzer herself. The result:
Decoys eliminated: 0
Remaining possibilities: 10
Analyst confidence: ~10%
She let out a breath she didn’t know she’d been holding. “It’s done.”
Maria looked over her shoulder at the screen. She didn’t understand the cryptography, but she understood the relief on Maya’s face. “He can’t trace it?”
“He can’t trace it.” Maya closed the laptop. “The boiler will be installed tomorrow.”
Maria squeezed her shoulder. “You’re good at this, Maya. Really good.”
Maya shook her head. “I’m just learning. Dex is the one who built the tools.”
“You’re the one using them,” Maria said. “That matters.”
They climbed out of the basement and into the kitchen, where the smell of soup and bread filled the air. A young woman sat at the table with her two children, both under five. The woman looked up as Maya entered—a quick, nervous glance, the kind that came from months of watching doorways.
“The heat will be fixed tomorrow,” Maya said softly. “I promise.”
The woman nodded. She didn’t smile. But her shoulders relaxed, just a little.
Maya sat down across from her. “How are you holding up?”
“I don’t know,” the woman whispered. “He found out I was here. He sent a message to the main office. Said he knew where I was.”
Maya’s blood went cold. “When?”
“Yesterday. Maria said not to worry, that the address isn’t public, that he can’t get in. But he knows. He knows.”
Maya reached across the table and took the woman’s hand. “Listen to me. He knows someone is here. He doesn’t know it’s you specifically. And he can’t get in. The doors are locked. The windows are reinforced. The police have been notified.”
“But what if he finds the address?”
“He won’t.” Maya’s voice was steady, even though her heart was racing. “Because we’re careful. Because we use tools that hide us. Because we have each other.”
The woman’s eyes filled with tears. “You sound so sure.”
“I’m not sure,” Maya admitted. “But I’m not afraid anymore. And that’s almost the same thing.”
That night, Maya sat alone in her studio apartment, the metal box containing her view key on the desk in front of her. She didn’t open it. She didn’t need to.
Her phone buzzed. A message from Dex.
The decoy pool is working. The Analyst just ran a scan on your plumbing transaction. He eliminated zero decoys.
She typed back: How do you know?
I have a friend who works at his firm. They talk. He’s frustrated.
Maya smiled in the darkness. Good.
Good, Dex replied. But don’t get comfortable. He’s not going to give up. He’ll try other methods—physical surveillance, social engineering, maybe even breaking into the safe house’s network.
What do I do?
Stay unpredictable. Keep using the decoy pool. And tomorrow, we talk about tracing resistance—because ring signatures aren’t the only tool you need.
Maya set down the phone and looked out the window. The city glittered below, thousands of lights, thousands of people hiding in plain sight.
Somewhere out there, the Analyst was watching. But tonight, he was watching nothing.
The decoy mix had done its job.
Table of contents:
Introduction
Chapter 1: The Public Ledger
Chapter 2: A Glass House
Chapter 3: The Stealth Protocol
Chapter 4: The View Key
Chapter 5: The Linkability Flaw
Chapter 6: The Stalker’s Trace
Chapter 7: The Ring Signature
Chapter 8: A Decoy Mix
Chapter 9: The Tracing Resistance <<<<<< NEXT
Chapter 10: Anonymous, Not Invisible
