When your wallet broadcasts a transaction, spy nodes connected to many peers can guess where it started, and link it to your IP address.
Dandelion (BIP 156)
Dandelion proposed two phases: a "stem", where the transaction is passed quietly along a random path, then a "fluff", where it spreads normally. The origin becomes much harder to find.
Status
BIP 156 is marked Closed; Bitcoin Core did not adopt it, partly because of complexity and denial-of-service concerns.
What Bitcoin uses instead
- Tor and I2P: Bitcoin Core can run over Tor and I2P, hiding your IP entirely.
- Encrypted transport (BIP 324): optional in Core 26.0, default from 27.0, stops passive snooping.
- Your own full node: broadcast through your node instead of a third-party server.
See network privacy for practical steps.