SatoshiShield / SatoshiShield is on Nostr

Bitcoin privacy at the DNS layer. Maintainer of SatoshiShield, for Pi-hole & AdGuard Home. Blocking surveillance isn't concealment — it's self-defense. ₿

Last Notes

2026-06-04 11:41:00 UTC

After you install a Bitcoin node … 
After you learn how to use conjoins effectively and practice good coin control … 
It’s time to begin taking control of YOUR data. 
Taking control of your own data is not a single weekend project, and it does not have to be. You can do it in steps, and you do not need to be especially technical to start.
The first step that covers the most ground is filtering at the DNS layer on your home network. Pi-hole and AdGuard Home are both free, and with an AI assistant walking you through it, installing one is well within reach for someone who has never run a server before. Once it is running with a surveillance blocklist like SatoshiShield, every device on your network is covered, with no setup on the devices themselves.
That protection ends at the edge of your home network. The moment your phone is on cellular, it resolves DNS through your carrier and the blocklist does nothing. There are two straightforward ways to carry it with you. You can use Tailscale to route your phone's DNS back to your home Pi-hole over an encrypted tunnel, so it keeps using your filter wherever you are. Or you can install the AdGuard app directly on your phone, point it at the same blocklist, and let it filter on the device with no connection back home needed.
None of this has to happen in a day. Start with the home network, get comfortable, then extend it to your phone when you are ready. The point is that this is within reach now in a way it was not a few years ago.

2026-06-04 11:20:56 UTC

SatoshiShield started as a proof of concept. It is now being built out to cover as many confirmed Bitcoin surveillance firms that can be verified.
The layer it addresses is one most people don't know they're leaking from.
Before any app connects to anything, it asks a resolver for the server's IP. That DNS query goes out in the clear, before encryption, before your wallet has decided anything about privacy. A lot of those queries go to firms whose business is identifying Bitcoin users: the analytics API a wallet checks in with, a price tracker, a browser extension. The query alone tells that firm your IP is interested in their endpoint. Nothing has connected yet, and it's already logged.
You can run your own node, use coin control, and never touch a KYC exchange, and still leak here. A VPN doesn't stop it; it just changes the source IP. The node doesn't either, because it handles wallet traffic, not the dozen other apps on your network.
SatoshiShield is a list of confirmed surveillance firm domains. Installed on Pi-hole or AdGuard Home, every device on the network stops resolving them. The query never leaves the network. Every domain is documented with evidence, so you can audit the list yourself.
One honest limit: it protects the network, not the device. The moment your phone drops to cellular, it resolves through the carrier and the list does nothing. To carry it with you, route DNS back home over Tailscale or run an on-device filter.
It does not stop on-chain analysis, KYC exchanges, or apps that ship their own hardcoded DNS-over-HTTPS. It is one layer, but it is the one that is almost always missing. We will deal with this gap with SatoshiShield-firewall in the near future.
github.com/cypherpilgrim/satoshishield

2026-06-04 11:09:07 UTC

So I built something for that neglected layer. SatoshiShield is a free, open-source DNS blocklist for Pi-hole and AdGuard Home. It blocks the surveillance firms' domains at your resolver, so every device on your network stops reaching them — quietly, in the background, no per-app work. Every entry is documented: which firm, what they do, why it's listed, with a source. A privacy tool you can't audit is just one more thing asking for trust, so all of it is open.
github.com/cypherpilgrim/satoshishield

2026-06-04 11:06:00 UTC

This isn't hypothetical. In 2020 the IRS paid Chainalysis and a forensics firm to build tools to break the privacy of Monero and of Bitcoin sent over Lightning. It's a public contract — you can pull it up on USAspending.gov. The effort to de-anonymize ordinary users is funded, ongoing, and on the record.

2026-06-04 11:04:03 UTC

You don't have to have done anything wrong to be harmed by surveillance. You only have to be visible to it. Frozen accounts, tainted coins, a risk score you'll never get to see or contest — none of that needs wrongdoing, just a data trail. Blocking the surveillance isn't hiding. It's declining to hand it over for free.

2026-06-04 11:01:51 UTC

The part of Bitcoin privacy nobody talks about isn't your node or your coinjoin. It's DNS. The apps on your devices phone home constantly — a wallet pinging a Chainalysis endpoint, an extension fetching from Arkham, a price widget calling TRM Labs. A VPN doesn't stop that. It just changes which IP they log it against. The query still leaves your network. 

2026-06-04 03:58:44 UTC

- reply

A node fixes the wallet you point at. It doesn't stop your other apps and devices from phoning home to the surveillance firms - that's the blocklist's job. Different layers.
A node is a very important tool but there are other layers to protect as well.

2026-06-04 01:31:44 UTC

Most people think Bitcoin is anonymous. It isn't. It's pseudonymous — a public ledger that never forgets, with one thin layer of "nobody knows which address is mine" on top. A multi-billion dollar industry exists to peel that layer off, and it only has to succeed once. Get linked to a single address, ever, and your whole history reads backward.

2026-06-04 01:14:01 UTC

SatoshiShield blocks the blockchain-surveillance firms — Chainalysis, Elliptic, TRM Labs, Arkham, and others — at your network's DNS layer, so your wallets and apps can't quietly phone home to them. Free, open-source, for Pi-hole and AdGuard Home. Every domain documented and auditable.
github.com/cypherpilgrim/satoshishield