₿ SatoshiShield
Bitcoin privacy · DNS layer · Pi-hole + AdGuard Home

Silence the background hum.

Every balance check and broadcast your wallet makes is a DNS query — and surveillance firms are listening. SatoshiShield drops those queries before they leave your network.

A curated, community-maintained blocklist that prevents the companies whose business is correlating your IP address with your Bitcoin activity from ever receiving it. No connection established. No data transmitted. They never see your IP.

Read The Background Hum → Install in two minutes

● Actively maintained — latest release v1.6.0 · 2026-05-31 · all releases →

the hum silence
Why this exists

The earliest point surveillance can be interrupted

When your wallet checks a balance, fetches fee estimates, or broadcasts a transaction, it makes DNS queries. Those queries reveal your IP address to whoever receives them — and for many wallets, that receiver is infrastructure operated by Chainalysis, Elliptic, TRM Labs, Arkham, and others who log your IP against every address you query and sell the result to exchanges, banks, and law enforcement.

SatoshiShield addresses the DNS layer. It complements your node and wallet privacy practices. It does not replace them.
Start here

If you read one thing, read this

Case study

The Background Hum

It follows one ordinary Bitcoin user — a marketing manager with about half a bitcoin saved for his daughter's college fund — through one ordinary Tuesday morning.

By sunset, a surveillance company knows his employer, his neighborhood, the names of his wife and daughter, the size of his holdings, the source of every coin he owns, and the schedule on which he checks his balance. He has done nothing wrong. He uses a hardware wallet. He thinks of himself as careful.

He has no idea the dossier exists. He will never see it.

20minute read
0technical background needed
Read it →
What gets blocked · Tier 1

25 organizations, 6 categories of surveillance

Each entry is documented with a one-sentence privacy harm, a source, and a verification date. The list is precise: it does not block Bitcoin peers, privacy-respecting explorers, exchange websites, wallet downloads, or Lightning infrastructure.

01

Blockchain Analytics

Correlate your IP with every address and transaction you look up. Chainalysis, Elliptic, TRM Labs, CipherTrace, and others.

02

Deanonymization

Publicly market linking on-chain addresses to real-world identities. Arkham Intelligence, MetaSleuth.

03

Address Screening

Score and flag addresses on demand, logging who asked about what. AnChain.AI, Match Systems.

04

KYC / AML Compliance

Flag CoinJoin and ordinary privacy techniques as "high risk." Scorechain.

05

Off-Chain Intelligence

Attribute activity using data gathered from outside the chain. Cloudburst Technologies.

06

Surveillance Analytics

Wallet labeling and "smart money" identity profiling sold as market intelligence. Nansen.

→ Browse the full list — every domain, harm, source, and verification date  ·  raw CSV

Quick install

Two minutes, then verify

Add the Tier 1 list to your DNS blocker and update. Pi-hole users must also apply the regex deny rules so wildcard entries take effect — see the full install guide for the exact steps, including the regex rules and verification checks.

Pi-hole — Settings > Blocklists > Add, then pihole -g
https://raw.githubusercontent.com/cypherpilgrim/satoshishield/main/blocklist.txt
AdGuard Home — Filters > DNS Blocklists > Add a custom list
https://raw.githubusercontent.com/cypherpilgrim/satoshishield/main/satoshishield.abp
Verify it is working (should return 0.0.0.0 or nothing)
dig api.chainalysis.com +short
Full steps — regex deny rules, AdGuard, verification, troubleshooting
Read the full install guide →
Take it with you

Your protection stops at the front door

SatoshiShield protects a network, not a device. Every phone, laptop, and tablet on your home network is covered because they all resolve DNS through your Pi-hole or AdGuard Home. The moment your phone leaves the house and drops to cellular, it resolves through your carrier instead, and the blocklist does nothing — the protection was a property of being on your network, and you have left it. There are two ways to carry it with you.

Option 1 · Keep your own resolver

Route your phone's DNS back home

Tailscale builds an encrypted tunnel between your phone and your home network. Point your tailnet's DNS at your Pi-hole and turn on Override local DNS, and every lookup your phone makes travels back to your own resolver — on cellular, on public Wi-Fi, anywhere. Only the DNS query goes through the tunnel, so it stays light.

Tailscale → DNS → Nameserver: your Pi-hole's address Tailscale → DNS → Override local DNS: on
Option 2 · No home connection needed

Filter on the device itself

Install the AdGuard app on your phone and add the SatoshiShield list as a custom DNS filter. It filters on the device, on any network, with nothing to tunnel back to. The trade-off is that you are maintaining the list in a second place, and it is the app rather than your own resolver doing the work.

https://raw.githubusercontent.com/cypherpilgrim/satoshishield/main/satoshishield.abp

The same limit applies as at home. DNS filtering only sees queries that go through the system resolver. An app that ships its own hardcoded DNS-over-HTTPS, or connects straight to a hardcoded IP, bypasses it. This closes the cellular gap for ordinary traffic — not for apps built to route around it.

Documentation

Read the evidence, deploy the defense

Case study

The Background Hum

What surveillance looks like in practice for one ordinary user. Start here.

Install

Full Install Guide

End-to-end setup: the list, the Pi-hole regex deny rules, AdGuard Home, and verification.

FAQ

Frequently Asked Questions

Wallet compatibility, running a node, mobile, VPNs, and what the list does and does not cover.

Primer

Why Bitcoin Privacy Matters

The surveillance industry and what it means for you. Short guide, plus a deep-dive edition.

Evidence

IRS Privacy-Coin Tracing

The 2020 IRS-CI contract to trace Monero and Lightning, from the public record.

Evidence

Federal Procurement Stack

A 2018–2025 survey of U.S. contracts to trace and de-anonymize crypto.

Research

Verification Records

The per-firm research behind every blocklist decision — the seven-step process, evidence, and verdict for each domain.

Technical

White Paper

Full rationale, architecture, methodology, and adversarial analysis.

Contribute

Contributor Guide

Research methodology, tools, and the domain submission process.

Project

Releases & Changelog

Version history and what changed in each release — the project's maintenance record.