Thought experiment. Samourai whirlpool coinjoin is five inputs and five outputs. I guess the participants are selected by the coordinator, which is open source, but there's no way to tell which coordinator they are actually running.

Imagine if they were adversarial. We know they send xpubs to their server if you don't run your own dojo node. How can we be sure they don't let four participants that they know xpub for and one that runs their own node? If every coinjoin is made like this (which it could well be), whole whirpool is a total placebo.

Where am I wrong in this thought? (Excerpt trusting that they are the good guys)?

Could this be happening?

Of course two people who run their own nodes could coordinate and see if they are ever part of one coinjoin. But then the next question is - what if they do this only for "interesting" utxos?

If the coordinator is adversarial, the combination of xpubs and small sets makes this attack easy and very hard to see from the transactions themselves.

I'm just thinking "loud", not accusing anyone, I mainly want to see if I understand this correctly.