Tor browser routes your internet traffic through a series of volunteer-operated relays, masking your IP address from websites, exchanges, and anyone watching the connection. For Bitcoin holders, that sounds like an obvious win. But Tor isn't a magic cloak, and using it carelessly with Bitcoin can create new vulnerabilities while you're trying to fix old ones. McLeod Pacific Investments covers what you actually need to know before combining these two tools.
What Tor does and doesn't protect
Tor hides your IP address from the sites you visit. It does this by encrypting your traffic in layers and bouncing it through three relays, called nodes, before it reaches its destination. The exit node, the last relay in the chain, sees your traffic in plain text if the destination site doesn't use HTTPS. That's a real exposure point.
What Tor does not do: it doesn't encrypt your Bitcoin transactions. Bitcoin transactions are broadcast to the public blockchain regardless of which browser you use. Your wallet address, the amounts you send, and the timing of your transactions are all permanently visible on-chain. Tor only hides the IP address that submitted the transaction to the network. That's still useful privacy, but it's narrower than most people assume.
Tor also doesn't protect against mistakes you make inside the browser. Logging into a personal account, uploading a document with your name embedded, or reusing a Bitcoin address across sessions all break the privacy Tor is trying to provide.
Setting up Tor correctly for Bitcoin use
Download Tor Browser only from the official Tor Project website. Fake Tor builds are circulating that inject malware or redirect clipboard content, which is a direct threat to Bitcoin addresses you copy and paste. Verify the cryptographic signature of the installer before you open it. The Tor Project publishes those signatures on the same download page.
Keep Tor Browser updated. Old versions have known vulnerabilities that attackers actively exploit. The browser prompts you when an update is available. Don't ignore it.
Leave the security level at "Safest" when doing anything Bitcoin-related. This setting disables JavaScript on non-HTTPS sites, turns off some media formats, and removes several browser features that can leak identifying information. To change it, click the shield icon in the top-right corner of the browser.
Don't resize the Tor Browser window from its default size. Browser window dimensions are a fingerprinting vector. A unique window size can identify you even when your IP is hidden. It sounds trivial. It isn't.
Bitcoin-specific risks inside Tor
Clipboard hijacking is a serious threat in Tor sessions. Because your session is anonymous, attackers running malicious exit nodes have a financial incentive to intercept and modify Bitcoin addresses in transit. Clipboard hijacking attacks silently replace a copied Bitcoin address with the attacker's address, and you won't notice unless you verify character by character. Always paste a Bitcoin address into a plain text editor first, visually confirm the first and last six characters, then paste it into the destination field.
Exit node attacks are a real concern on unencrypted connections. If you're accessing a Bitcoin exchange or wallet service over plain HTTP through Tor, the exit node operator can see everything, including login credentials. Confirm that any Bitcoin service you use shows a valid HTTPS padlock before entering any credentials. McLeod Pacific Investments uses HTTPS exclusively for exactly this reason.
Tor connections are slower than regular browsing. Network fee calculations and transaction broadcasts that take a fraction of a second normally can take much longer. Don't interpret a slow response as a failed transaction and re-send. Check a block explorer first. Double-sending is an expensive mistake that Tor's latency can accidentally cause.
What to avoid combining with Tor
Don't log into any account linked to your real identity while using Tor for Bitcoin purposes. Accessing your personal Gmail, social media, or any account that knows your name during a Tor session destroys the anonymity you were building. Keep those tabs in a separate, ordinary browser window on a different device if possible.
Don't use browser extensions in Tor Browser. Extensions can phone home, introduce fingerprinting vectors, or break Tor's traffic routing. The browser is designed to be used as-is.
Don't reuse Bitcoin addresses across Tor sessions. Address reuse is one of the biggest privacy mistakes Bitcoin holders make regardless of which browser they use. For a deeper look at Bitcoin privacy best practices, the core principle is the same: one address, one transaction, then move on.
Using Tor with a VPN: does it help?
The "VPN over Tor" and "Tor over VPN" debate has a practical answer for most Bitcoin holders. Running a VPN before Tor (connecting to VPN first, then opening Tor Browser) hides the fact that you're using Tor from your internet service provider. In Australia, your ISP can see that you've connected to the Tor network, even if it can't see what you're doing inside it. A VPN before Tor removes that metadata.
Running Tor before VPN routes all Tor traffic through your VPN, which means the VPN provider can see your traffic. That shifts trust from the Tor network to your VPN provider, which is generally a worse trade. Stick with VPN before Tor if you use both. And if you're unsure whether a VPN adds value to your setup, the practical guidance on how to safely use a VPN with Bitcoin is worth reading alongside this one.
The limits of Tor as a privacy layer
Tor raises the cost of identifying you. It doesn't make identification impossible. Sophisticated surveillance at the network level, timing correlation attacks, and mistakes inside the browser can all de-anonymise a Tor session. For the vast majority of Bitcoin holders using Tor to add a reasonable layer of privacy to exchange logins and wallet access, that's an acceptable trade-off.
For high-stakes operations, such as moving large amounts of Bitcoin or interacting with services that carry meaningful legal or financial risk, treat Tor as one layer in a broader security posture, not the whole answer. Keep your seed phrases off any networked device, use strong unique passwords managed offline, and verify every address before sending. The browser you use is the last line of defence, not the first.