"Can cross-currency operations reveal associations?" The direct answer is: Yes, but what leaks is not your identity; it is that "these operations are likely from the same person."
When you deposit ETH and USDT in the same privacy pool protocol, they belong to different asset pools, but behind the scenes they use the same state tree and Notes mechanism. External analysis tools cannot tell exactly which deposit matches which withdrawal, but they can detect the operation pattern of "the same person."
How Cross-Currency Operations Reveal Associations: Same Amount and Time Window
This linking risk comes from "same amount + time window" heuristic analysis. External observers do not need to see your address; they only need to look at on-chain data:
- Same pool: operations happen in the same privacy pool system. For example, the ETH pool and USDT pool on Ethereum hold different assets, but they share the same underlying state tree.
- Same amount: one deposit and one withdrawal have the same amount
- Same time window: the withdrawal happens within 60 seconds to 2 hours after the deposit
If all these conditions are true at the same time, analysis tools will mark the two operations as "possibly associated."
But this only gives a "possibility," not definite proof, because there are three situations that cannot be told apart:
- The person who deposits is also the person who withdraws (true association)
- Two unrelated people happened to operate the same amount at the same time (false positive)
- An experienced user deliberately creates matches to confuse analysis (decoy withdrawals)
Cross-Currency Operations Amplify the Association Signal
The special risk of cross-currency operations is: you leave operation patterns across multiple asset pools, and external observers can use the "same amount + same time window" heuristic to piece together your activity trail across pools.
For example, you deposit 10 ETH, and around the same period you deposit 10,000 USDT. The two operations are close in time and the amounts correspond at the exchange rate at that time. External observers do not know which address the 10 ETH was withdrawn to, but if the operation patterns in the two pools are consistent, they may infer that these operations belong to the same user.
Real Data Shows How Big the Risk Is
Envio's analysis of public privacy pool data shows:
- Ethereum ETH pool: about 10.9% of ETH withdrawals match the "same amount + short time window" associable pattern
- Arbitrum USDC pool: the share rises to 16.0%
- BSC USDT pool: the share reaches 37.5%
Smaller pools have higher shares because there are fewer transactions to hide among.
But the decoy withdrawal mechanism can effectively create noise. Data shows that there are 393 "decoy candidate pairs" across the network, involving 163 different deposit addresses and 160 withdrawal addresses. These "decoys" make it impossible for external observers to tell real associations from false ones. This is the protocol's core design for keeping "probability" at the level of "cannot be proven."
Practical Suggestions
- Space out your operation times: if you need to operate in multiple asset pools, increase the time interval. Do not let several operations happen within a few minutes.
- Watch the cost of Ragequit: if your deposit is not approved after the association set updates, you can use the Ragequit function to force an exit. But the cost is that it directly exposes exactly which deposit is yours, and privacy disappears instantly. The Ragequit ratio on Ethereum mainnet is about 6%, and the BSC BNB pool reaches 78.3%.
How to Check
After completing cross-currency withdrawals, you can go to a blockchain explorer and see where several transactions sit on the timeline. If two withdrawals of different assets are less than one hour apart, external analysis tools may already have marked them as associated. This means your cross-pool operation pattern has left a trace.
