pull down to refresh
I just thought of another possibility: Someone trying to deanonymize the user could have deliberately sent them the 0.40156916 Bitcoin out of a coinjoin, hoping that the user would later send it to a KYC exchange, which they did.
This seems very unlikely though, since a much smaller amount could have been used. (dusting attack) Also if Wasabi Wallet 1.1.6 functioned correctly it should have marked this coin as non-private to the user.
Anyway this scenario seems very unlikely.
By the way, modern versions of Wasabi Wallet only show a maximum of 1 UTXO per address (even if the address actually holds multiple UTXOs), preventing you from spending multiple times from the same address.
reply
I see. Outputs from two different coinjoins went to the same address:
https://mempool.space/address/bc1qxp8k4un9tzkm2phsvs22r26l6l2ny93tnts7nq
This should not have happened.
Based on the date of the coinjoins (7th of September 2019), we can assume that Wasabi Wallet 1.1.6 was used.
Two possible explanations for how this happened come to mind:
The issue with scenario 1 is that I could not find any bug disclosure or fix for this.
That suggests either:
The issue with scenario 2 is that it is highly unusual to be doing that. It would likely result from either an intentional attempt to break things or an honest mistake. Given that the user also failed to notice the address reuse, user error seems plausible.