If you deposit into a privacy pool and withdraw right away, you leave a clear timing trail on-chain. This weakens the privacy protection you wanted.
What timing correlation can reveal
A privacy pool's withdrawal proof can hide which deposit your money belongs to, but it cannot hide when the deposit and withdrawal happen. Outside observers can see public data such as: when funds entered the pool, when they left the pool, and the amounts on both sides.
According to Envio's analysis of public privacy pool data, when a deposit and a withdrawal of the same amount happen in the same pool between 60 seconds and 2 hours apart, outside observers may label the two actions as "possibly linked." This simple tracking rule can flag about 10.9% of withdrawals on Ethereum mainnet. The share is even higher in smaller pools, because there are fewer transactions to hide among.
What gets exposed has two layers:
- Transaction behavior patterns: Outside observers know you deposited at one time and withdrew at another, and the gap between those times is public. If you withdraw just minutes after depositing, that pattern alone is enough to pair your deposit and withdrawal.
- Cross-checking with off-chain identity: If your deposit or withdrawal address has already completed KYC somewhere, or has been labeled by on-chain analysis tools, timing correlation can connect that address to your identity.
The protocol's "decoy withdrawal" mechanism is helpful, but don't rely on it completely
Privacy pool designs do include a countermeasure: decoy withdrawals. When other users see your deposit enter the pool, they can immediately withdraw the same amount to a new address, which confuses outside pairing analysis.
According to Envio's data, there are 393 such "decoy candidate pairs" across the network, involving 163 different deposit addresses and 160 withdrawal addresses. The problem is that with public data alone, outside observers cannot tell the difference between these three cases:
- The depositor and the withdrawer really are the same person
- Two unrelated people happened to use the same amount at the same time
- Another user deliberately created a match to confuse analysis
This mechanism keeps timing correlation at the level of probability, not certain proof. But if you deposit and immediately withdraw, the pattern itself makes the analyst's guess much easier.
Practical advice: Don't let timing become your fingerprint
- Leave enough time: Wait at least several hours between deposit and withdrawal, ideally overnight or longer. A longer wait makes the group of possible deposits larger, so it is harder to link your two actions.
- Use relayed withdrawals: Privacy pools support relayers who can submit the withdrawal for you. The withdrawal address and the address paying fees can be different, which reduces how often you expose your main address.
- Watch the combination of amount and timing: Even a "standard amount" can be flagged if one deposit and one withdrawal happen too close together. Try to separate the two actions naturally in time.
How to check
After withdrawing, go to a block explorer such as Etherscan and look at where your deposit and withdrawal sit on the timeline. If the block timestamp gap between the two transactions is less than one hour, external analysis tools have likely marked them as linked—meaning your behavior pattern did leave a trace.
