Even with perfect on-chain habits, information can leak at the network layer: which IP address first broadcast a transaction, or which addresses your wallet asks about.
The problems
- Light wallets often ask a company's server about your addresses. That server can link all your addresses to your IP address.
- Broadcasting: an observer connected to many nodes may estimate where a transaction appeared first.
- Unencrypted traffic: classic peer-to-peer traffic was readable by your internet provider.
Bitcoin's answers
- Your own full node: your wallet asks your own node, so no third party learns your addresses.
- Tor and I2P: Bitcoin Core can run over Tor (for example with
-onlynet=onion) and can create an onion service automatically. I2P and CJDNS are supported too. - Encrypted transport (BIP324): added as an option in Bitcoin Core 26.0 and turned on by default in 27.0. It encrypts traffic between nodes, making passive eavesdropping and simple traffic tampering harder. It does not hide that you run Bitcoin from someone who connects to you directly.
Some proposals did not make it: Dandelion (BIP156), which aimed to hide the origin of transactions, has status "Closed". Network privacy is an active research area.
Practical order: your own node first, then Tor for the node and the wallet, and a wallet that connects only to your node.