OPSEC question for exchanging XMR
-
Is there something in Monero transactions that can tie them together in this scenario:
- send some non-private crypto to an instant exchange
- exchange it for monero
- withdraw the monero
- after some time send some monero to that same instant exchange to exchange it for some non-private crypto
Would the instant exchange have a way to determine if the two transactions are connected to the same wallet (amounts being different)? What time difference between the 2 transactions would be sufficient?
-
Is there something in Monero transactions that can tie them together in this scenario:
- send some non-private crypto to an instant exchange
- exchange it for monero
- withdraw the monero
- after some time send some monero to that same instant exchange to exchange it for some non-private crypto
Would the instant exchange have a way to determine if the two transactions are connected to the same wallet (amounts being different)? What time difference between the 2 transactions would be sufficient?
You need to be clear about your threat model. Right now everything you do on monero is opaque for now. In 5 years or 10 years, it might be visible. Is that okay?
Using the same exchange for both sides of your transaction adds a lot of operational risk, they might see your IP address, they might see the transaction size, they might measure your typing speed, browser fingerprinting etc etc etc
The wallet you use may have some peculiar indication and its transactions, that can make it more easily stand out.
I recommend reading the monero white papers, they go into a lot of detail about rings and so forth.
So, if you're just trying to obscure your VPN purchase, your protocol is fine because the risk is low.
If your life is in danger if this gets connected to you, then you really need to come up with a very clear threat model, and figure out every step.
At a minimum, use two different exchanges for both sides of your protocol, transfer from one wallet to a different wallet on the monaro side so that you get different transactional fingerprinting.