In this work, we present CoolTest, a randomness test well-suited for scenarios with only small volumes of data. CoolTest searches for a correlation among any k bits within a fixed-size window. CoolTest generalizes BoolTest (ICETE’17) and builds on the innovative idea of Chatterjee et al. (INDOCRYPT’22), making it practical. Using this idea, CoolTest identifies the strongest correlation on k bits by evaluating only 2 k candidates instead of all 2 2 k Boolean functions. CoolTest finds arbitrary k -bit correlations with complexity comparable to BoolTest and the method of Chatterjee et al., evaluating 100 MB of data in tens of seconds, while those approaches are limited to predefined or nearby-bit correlations. We evaluated CoolTest on outputs of 14 reduced-round cryptographic functions (e.g., AES, Twofish, Keccak, and MD5). CoolTest performs at least as well as BoolTest in 26 out of 28 cases and often finds stronger correlations. On 100 MB of data, CoolTest detects bias in a higher number of rounds of SHA-2, SHA-1, MD6, and SHACAL-2 than the commonly used test suites NIST STS, Dieharder, and TestU01. We estimate the minimal amount of data required to detect correlations depending on the type and relative frequency of the underlying non-random pattern, and show how increasing data size improves the statistical significance of the detected correlations.

Coinjoin is a collaborative Bitcoin transaction designed to enhance users' privacy by joining coins of multiple parties. Coinjoin implementations with a centralized trust-minimized coordinator have mixed more than 391,000 bitcoins since 2018. In June 2024, law enforcement actions led to the shutdown of coordinators of all three leading coinjoin designs-Wasabi 1.x, Wasabi 2.x, and Whirlpool-prompting a proliferation of new independent coordinators. Prior studies of this ecosystem offer little information beyond coinjoin detection and aggregation of related statistics, primarily due to the unavailability of information (intentionally) obscured by coinjoins. To overcome this limitation, we combine on-chain transaction analysis, coordinator monitoring, and active coinjoin participation, complemented by tailored analysis and visualizations, to: 1) provide a model for estimation of the number of active users at a time, 2) detect previously unknown coordinators, 3) retrospectively observe activity patterns of prominent parties, and 4) deliver continuously updated insights into the ecosystem. We show that while Wasabi 1.x remains inactive and recently resumed Whirlpool exhibits little activity, the Wasabi 2.x mixing has exceeded pre-shutdown levels under the new coordinator kruw.io, which now accounts for 99% of mixed inputs (over 46,000 bitcoins in the past 18 months) with raising concurrently active users now estimated to 70+ in average coinjoin, providing the first data-based estimate of the participants’ anonymity set. We revealed a previously unknown but significant coordinator active from early May to November 2024, with a method capable of identifying emerging coordinators. Although WW2 conceals large-input wallet activity more effectively than WW1, it is still detected by the proposed transaction-centric liquidity analysis.