DEV Community

Alexander
Alexander

Posted on

RingCT and Stealth Addresses: How Monero Hides Transactions

#monero #privacy #cryptocurrency #security

Blockchain Privacy Analysis Tools

This repository contains educational tools and research materials for analyzing privacy properties of public blockchains. Understanding how transaction privacy works—and fails—is essential for security researchers, forensic analysts, and anyone building privacy-preserving systems.

What This Does

Public blockchains like Bitcoin and Ethereum are transparent by design. Every transaction is visible to everyone, forever. But that doesn't mean every user is automatically identified. Privacy analysis is the process of connecting the dots: linking addresses to real identities, tracing funds through multiple hops, and understanding which privacy techniques actually work in practice.

Think of blockchain analysis like following footprints in snow. A single transaction might look anonymous, but when you step back and examine patterns—timing, amounts, address reuse, change outputs—identifiable trails emerge. This work explores both sides: how analysts break privacy, and how users attempt to preserve it.

Transaction Graph Analysis

The core technique is building a transaction graph where addresses are nodes and payments are edges. We trace funds forward (where did this money go?) and backward (where did it come from?). The tools here construct these graphs from raw blockchain data and apply heuristics to cluster addresses belonging to the same entity.

Common heuristics include:

  • Multi-input clustering: when a transaction spends from multiple addresses, they likely belong to one wallet
  • Change address detection: transactions typically have one recipient and one change output returning to the sender
  • Round number payments: a transfer of exactly 1.0 BTC suggests the 0.347 BTC output is change
  • Temporal clustering: addresses used within short time windows, especially in specific patterns like peel chains

These aren't perfect. False positives happen. But combined with off-chain data—exchange KYC records, forum posts, IP logs—they become powerful attribution tools.

Coin Mixing Detection

Mixers (or tumblers) attempt to break the transaction graph by pooling funds from multiple users and redistributing them. CoinJoin implementations like Wasabi and Samourai create collaborative transactions with many inputs and many equal-value outputs, making it unclear who paid whom.

Our detection scripts identify mixer transactions by analyzing output patterns: a transaction with eight inputs and eight identical 0.5 BTC outputs is obviously a CoinJoin round. We then score how effectively each mixer breaks traceable links using metrics like anonymity set size and backwards-tracing success rate. Recent research shows that even sophisticated mixers leak information through timing analysis and taint tracking across multiple rounds.

Privacy Coin Comparisons

Monero, Zcash, and other privacy coins take different approaches. Monero uses ring signatures (your transaction hides among 15 decoys), stealth addresses (each payment goes to a one-time address), and RingCT (amounts are hidden). Zcash offers optional shielded transactions using zero-knowledge proofs, where the entire transaction graph is encrypted but validity is cryptographically proven.

We benchmark these systems by measuring what an adversary can learn: transaction timing, amounts, sender-receiver links, and statistical attacks. Monero's mandatory privacy is stronger than Zcash's opt-in model, where only 5% of transactions use shielding, creating a small and highly visible anonymity set.

Research Use Only

These tools are built for security research, academic study, and understanding privacy engineering tradeoffs. Responsible disclosure practices apply.

Research References

The following archives provide additional research context:

Open Source Tools:

Top comments (0)