Privacy on Tornado Cash depends on a mechanism, not a switch: a zero-knowledge proof lets a withdrawal show that a valid, unspent deposit exists without revealing which deposit it was. A person searching “Tornadocash” is often really asking whether that break in the on-chain trail survives contact with a wallet, exchange, or block explorer. It can—but only if surrounding transaction behavior does not reconnect the two addresses.
Does Tornadocash make the withdrawal wallet anonymous?
Condition: the withdrawal wallet must not bring an obvious connection with it. Tornado Cash can obscure the direct deposit-to-withdrawal relationship inside its pool, but it cannot make every action by the recipient private.
The protocol uses a private note, a shared pool, and a zero-knowledge proof. The deposit address places a commitment into the pool. Later, a different address proves that it controls the secret behind one valid commitment without identifying which commitment it is. The blockchain still records the deposit, the withdrawal, the amount, the recipient, and surrounding transactions; it simply does not receive the original deposit-to-recipient link as a normal transfer.
That distinction matters. Tornado Cash can provide transaction privacy at one boundary. It does not create a private wallet, erase blockchain history, or conceal everything that happens before and after the withdrawal.
Which actions reconnect the two addresses?
The most useful test is to inspect the surrounding flow rather than the withdrawal alone. Ethereum’s privacy-app guidance makes the broader point: public blockchains expose addresses, balances, transactions, contract calls, and events, while privacy proofs hide only the information placed inside the proof.
| Action | What it can reveal | Why it weakens privacy |
|---|---|---|
| Funding the recipient from the deposit wallet | A direct wallet relationship | The funding transaction appears immediately before the withdrawal. |
| Reusing an address | Previous balances and activity | Anyone can follow the recipient’s earlier history. |
| Withdrawing and spending immediately | A timing and amount relationship | A small set of matching transactions is easier to correlate. |
| Using the same RPC, browser session, or account context | Network or application metadata | The cryptographic proof does not hide every off-chain signal. |
| Sending the funds to a known exchange account | The recipient’s identity to that service | The exchange may associate the deposit with its customer records. |
This is why waiting alone is not the answer. A larger set of equal-value deposits can make timing less informative, but a careless funding transaction, reused address, or shared session can still undo much of that benefit. Ethereum’s guidance puts it plainly: “A zero-knowledge proof is the bridge between the registration wallet and the acting wallet, and the bridge does not reveal who crossed it.” The bridge hides the crossing; it does not hide every road leading to it.
What does the nullifier actually prove?
A nullifier is a one-time identifier derived from the private note. The contract publishes and records its hash when the note is spent. It can then reject a second withdrawal without learning which original commitment produced that nullifier.
“A public nullifier hash marks the note as spent without revealing which commitment generated it.” — Tornado Cash’s protocol explanation
The related commitment is a public hash added to the pool’s Merkle tree. A Merkle tree is a compact cryptographic summary of many entries; the proof shows that a valid commitment belongs to that tree. The note remains private, while the commitment, Merkle root, nullifier hash, recipient, and transaction details can be visible on-chain.
So the nullifier proves “this private note has been used once,” not “this wallet has no connection to the depositor.” That is a narrower and more accurate description of what the protocol guarantees technically.
What should a person check before trusting the privacy result?
- Separate the roles. Do not assume the deposit wallet and recipient wallet are independent merely because they have different addresses.
- Review the funding path. A fresh address funded by a known wallet can create the link the protocol was meant to avoid.
- Inspect timing and amounts. Matching values and close timing can make a withdrawal easier to associate with a deposit.
- Protect the note. Whoever obtains the secret note may be able to construct the withdrawal proof.
- Separate technical privacy from acceptance. A protocol-level unlinking result does not require an exchange, payment provider, or other service to accept the funds.
For readers checking the protocol’s current interface and documentation, the Tornadocash page is the place to inspect those details; the privacy result still depends on the complete wallet and transaction flow.
FAQ: what remains unclear after a withdrawal?
Can Tornado Cash erase a deposit from the blockchain?
No. The deposit remains public. The protocol is designed to make the later recipient harder to connect to it.
Does a relayer make the recipient completely anonymous?
No. A relayer can pay withdrawal gas, but it does not erase timing, address, exchange, browser, or network clues.
What happens if the private note is lost?
The funds may become inaccessible because the note contains information needed to create the withdrawal proof.
Is a private withdrawal the same as a private blockchain?
No. Tornado Cash operates through privacy-preserving smart-contract logic on a public blockchain.