That’s a huge red flag for Whirlpool. If the coordinator chooses who gets into the round, you are basically just hoping they aren't logging everything or filling the room with fake users. Trusting a central server to pick your privacy peers defeats the whole purpose.

Hazard_sats

 the coordinator is, it's about what the coordinator can 

In Wasabi's implementations, users choose their own coinjoin rounds. A malicious coordinator would expose themselves by rejecting all other n-1 participants for the round (including other inputs owned by their target).

But in Whirlpool implementations, the coordinator chooses every user for the round. It is trivial for them to Sybil attack a target indefinitely with n-1 "participants", who each leak their xpubs or IP addresses, while extracting profit from every silently compromised user.

Coinjoins

Wasabi Wallet - Privacy by Default

Kruw

It's not about _who_ the coordinator is, it's about what the coordinator can _do_.

In Wasabi's implementations, users choose their own coinjoin rounds. A malicious coordinator would expose themselves by rejecting all other n-1 participants for the round (including other inputs owned by their target).

But in Whirlpool implementations, the coordinator chooses every user for the round. It is trivial for them to Sybil attack a target indefinitely with n-1 "participants", who each leak their xpubs or IP addresses, while extracting profit from every silently compromised user.