To spend crypto privately, you have to deal with up to five different parties, not one: the public blockchain, the node your wallet talks to, the exchange you bought from, the card network, and the merchant or hotel at the end. Each one sees a different slice of your data, and no single tool hides all five. This guide maps what each party can see, with the law or policy that says so, and what you can realistically change.

Current as of October 5, 2026.

The Short Answer: Five Parties, Five Slices of Your Data

The public blockchain

  • Sees: addresses, amounts and timing of public transfers
  • Who can look: anyone, permanently
  • What helps: fresh addresses, confidential tokens that encrypt amounts

Your wallet's node provider

  • Sees: your IP address and wallet address when you send a transaction
  • What helps: choosing your RPC endpoint, a VPN (which moves that trust rather than removing it)

The exchange or on-ramp

  • Sees: your verified identity, plus sender and recipient details on crypto transfers
  • What helps: nothing removes this. It is a legal requirement, so plan around it

The card issuer and card network

  • Sees: card number, merchant name and location, date and amount. The issuer also keeps your account records under its own terms
  • What helps: reading the issuer's terms before you sign up

The hotel or merchant

  • Sees: your name, contact and booking details, and in many cases your ID document
  • What helps: never paying a merchant from your main wallet
Chart listing five parties and what each sees in a crypto payment: the public blockchain, the wallet's node provider, the exchange, the card issuer and network, and the hotel or merchant
What each party can see when you pay with crypto. Sources: Bitcoin whitepaper, Consensys, EU Regulation 2023/1113, Mastercard, Booking.com, Schengen Convention Art. 45. As of October 5, 2026.

1. The Public Blockchain Shows Every Transfer

Bitcoin was designed this way from the start. The 2008 Bitcoin whitepaper puts the trade-off plainly: "The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone." Privacy, in that design, depends entirely on nobody knowing which address is yours.

Ethereum works the same way. Its own privacy page calls the network a public and transparent ledger by design. On a block explorer like Etherscan, anyone can paste an address and see its current balance, every token it holds, and every incoming and outgoing transaction in chronological order. Known addresses, such as exchange wallets, carry public labels.

The weak point is the link between an address and a person. The whitepaper itself warns that once the owner of a key is revealed, linking can expose that owner's other transactions. That is why it suggests a new key pair for each transaction.

What you can do about it

  • Keep the address you receive exchange withdrawals on separate from the address you spend from.
  • Use a fresh address when you want a payment kept apart from your history.
  • Use confidential tokens when the amount is the sensitive part (more on COTI's approach below).

One honest limit: moving funds between your own addresses is a public transfer too. Separation keeps your main balance out of a merchant's first glance, but anyone who looks can follow the hop. Confidential tokens hide the amount of that hop, not the addresses.

2. Your Wallet's Node Provider Sees Your IP Address

Your wallet doesn't talk to the blockchain directly. It sends requests to an RPC node, a server that reads balances and broadcasts your transactions. That server sees where the request came from.

When Consensys updated its privacy policy in November 2022, it explained that an RPC provider such as Infura, MetaMask's default, receives both your IP address and your wallet address when you send a transaction. Consensys added that this is how web architecture generally works, not something unique to Infura. MetaMask's current privacy notice, revised September 30, 2026, says it may temporarily process your IP address where required, depending on your settings, and suggests a VPN to limit device and usage data further.

What you can do about it

  • Change your RPC endpoint. MetaMask lets you add a custom RPC URL per network. Its help page notes that doing so on Ethereum, Linea, Base, Arbitrum or BNB Smart Chain switches off Smart Transactions features such as MEV protection.
  • Use a VPN, with clear expectations. A VPN makes your traffic appear to come from the VPN's servers. The US Federal Trade Commission describes it as shifting trust from your network provider to the VPN provider. Someone still sees your IP, just a different someone.
  • Running your own node isn't automatically better. Consensys pointed out in a December 2022 follow-up that a self-hosted node may make it even easier to connect your accounts to your IP address.

3. The Exchange Knows Exactly Who You Are

If you bought your crypto on a regulated exchange, that exchange verified your identity. That record follows every transfer it handles.

In the EU, the Transfer of Funds Regulation (EU) 2023/1113 has applied since December 30, 2024. Under Article 14, a crypto transfer sent by a crypto-asset service provider must carry the sender's name, the sender's wallet address, and either their home address with an ID document number or their date and place of birth, plus the recipient's name and wallet address. If you withdraw to your own wallet, the exchange still has to collect and hold that information. Above EUR 1,000, it must also assess whether you own or control the receiving address.

This isn't only European. In its July 16, 2026 update, the Financial Action Task Force reported that 83% of the jurisdictions it surveyed have passed laws implementing this "Travel Rule", up from 73% in 2025.

What this means in practice

The address your exchange withdrawal lands on is tied to your name in that exchange's records for years after you close the account, as anti-money-laundering rules require, and the on-chain transfer itself is permanent. Anything you do privately afterwards doesn't erase that link. At best, it limits how much of what follows other people can read. Plan your wallets with that in mind, and treat this layer as a legal requirement to work with, not around.

4. The Card Network Sees Where and When You Pay

A crypto card turns your crypto into an ordinary card payment at the till, and ordinary card payments carry data. Mastercard's Global Privacy Notice, effective January 19, 2026, lists the transaction information it may collect: your card number, the merchant's name and location, the date and the total amount. It may share that information with other participants in the payment ecosystem, including financial institutions and merchants.

Behind every card is also an issuer, the bank or e-money company that actually holds your card account. The issuer, not the card brand, sets the identity checks and keeps your account records under its own terms.

What you can do about it

  • Read the issuer's privacy terms and identity requirements before you sign up for any crypto card, not just the marketing page.
  • Keep the wallet that funds the card separate from wallets you use for other things.

5. The Hotel or Merchant Sees Your Name, and Often Your ID

Paying in crypto changes how you pay, not who checks in. When you book through a platform, your details travel to the property. Booking.com's privacy notice, updated August 2026, says the details it shares with the provider you booked can include your name, contact and payment details, the names of people travelling with you, and your check-in and check-out dates.

At the front desk, the law often asks for more. Article 45 of the Convention implementing the Schengen Agreement commits Schengen states to make hotels have most foreign guests personally fill in and sign a registration form and prove their identity with a valid ID document. Flights work the same way: under the EU PNR Directive (EU) 2016/681, airlines transfer passenger name record data for flights into and out of the EU to national authorities, and the data listed in the directive includes all forms of payment information, including billing address.

What you can do about it

  • Share only the details a booking actually requires, and expect an ID check anyway.
  • Never pay a merchant straight from your main wallet. The moment they have your address, they can look up its balance and history on a block explorer.

Where COTI Fits, and Where It Doesn't

COTI is a privacy network that computes on encrypted data using a cryptographic technique called Garbled Circuits. In practice, that targets the first layer: what the public blockchain reveals.

What is live today

COTI's Privacy Portal lets you convert tokens into private versions and send confidential transfers. Balances and transfer amounts stay encrypted on-chain and are decrypted locally on your device. COTI announced on September 16, 2026 that its cross-chain Privacy Portal is live on Avalanche C-Chain with private AVAX and USDC, at privacyportal.app.

What it doesn't hide

COTI is direct about the limits. In its Privacy-on-Demand explainer published September 1, 2026, COTI wrote: "COTI encrypts the values and the math over them, not the fact that a transaction happened. The transaction is visible. The number is not." The Privacy-on-Demand documentation adds that metadata such as timing, gas and which contract was called can still leak information. Converting into private tokens is itself an ordinary wallet transaction, per COTI's conversion guide, so the public amount you convert is visible on-chain.

So COTI hides how much, not whether, and not between which addresses. On its own, it does nothing about layers two to five.

What is planned

COTI is building one app for private payments, travel booking, a card and a VPN. According to the roadmap published on coti.io as of October 5, 2026:

  • COTI app: beta planned for Q4 2026, iOS and Android listing in Q1 2027
  • Travel booking: beta planned for Q4 2026
  • COTI card: virtual card with Apple Pay and Google Pay planned for Q4 2026, physical card in Q1 2027
  • COTI VPN: beta planned for Q4 2026, full launch in Q1 2027

None of these is live yet. The details that decide how private they are in practice, such as who issues the card and what the booking partner receives, haven't been published. We'll update this guide when they are.

A Practical Checklist

  1. Use separate wallets for receiving from exchanges and for spending.
  2. Never pay a merchant from your main wallet.
  3. Check which RPC endpoint your wallet uses, and decide who you'd rather trust with your IP address.
  4. Use confidential tokens when the amount is the sensitive part.
  5. Read a crypto card issuer's terms, not just its landing page.
  6. Expect ID checks at hotels and airports, however you pay.
  7. Never share your seed phrase or private key with anyone, including anyone claiming to be support.

Frequently Asked Questions

Can you spend crypto without leaving any trace?

No. Every payment touches at least one party that records something: the blockchain, a node, an exchange, a card network or the merchant. Privacy tools reduce what each party sees and who can see it. The realistic goal is to keep each slice of your data with the party that genuinely needs it.

Privacy tools and anti-money-laundering rules exist side by side. Regulated exchanges still identify their customers, and crypto transfers between providers carry sender and recipient details. In the EU, the Anti-Money Laundering Regulation (EU) 2024/1624 applies from July 10, 2027. Its Article 79 bars banks, payment firms and crypto-asset service providers from keeping anonymous accounts, or accounts that allow transactions to be anonymised or obscured, including through anonymity-enhancing coins. Rules differ by country, and this guide isn't legal advice.

Does a VPN make crypto payments private?

Partly. A VPN hides your IP address from the sites and nodes you connect to, but the VPN provider can see it instead. It does nothing for what the blockchain, the exchange, the card network or the merchant records.

Where to Go From Here

Private spending works best layer by layer: separate wallets, a deliberate RPC choice, and confidential tokens where amounts matter. If you hold AVAX or USDC on Avalanche, you can try confidential transfers today through the Privacy Portal, which COTI says is live on Avalanche C-Chain. For the COTI app, with travel booking, the card and the VPN, join the waitlist on coti.io and follow the betas planned for Q4 2026.

Details checked October 5, 2026. Product features, roadmap dates and policies can change. Nothing here is financial or legal advice. COTI will never ask for your seed phrase or private key, and announcements only come through coti.io, docs.coti.io and COTI's official channels.

Sources