DEV Community

Alexander
Alexander

Posted on

RingCT and Stealth Addresses: How Monero Hides Transactions

#monero #privacy #cryptocurrency #security

Cryptocurrency Privacy and Security: A Research Guide

Research References

The following archives provide additional research context:

Open Source Tools:

Part I: Key Concepts

What is the fundamental privacy problem with public blockchains?

Bitcoin and most public blockchains use a transparent ledger. Every transaction is permanently recorded, publicly visible, and linkable. The common misconception is that pseudonymity equals anonymity — it does not.

A Bitcoin address is pseudonymous in the same way a username is: it conceals your legal name, but not your behavior. Chain analysis firms like Chainalysis, Elliptic, and CipherTrace have built multi-billion dollar businesses on the fact that transaction graphs are fully public. They cluster addresses using heuristics — common input ownership (if two inputs fund one transaction, both inputs likely belong to the same wallet), change address detection, and dust attacks — then anchor clusters to known identities through exchange KYC data, IP logging, and on-chain metadata.

The UTXO model used by Bitcoin makes this particularly tractable. Each unspent output has a traceable history going back to coinbase (mining) transactions. Researchers at Princeton demonstrated in 2018 that roughly 60% of Bitcoin transactions could be deanonymized using only public data and basic clustering. Ethereum is arguably worse: its account model creates persistent address identities, and every ERC-20 transfer, contract interaction, and failed transaction is logged immutably.

Three layers of exposure exist simultaneously:

  • Network layer — your IP address when broadcasting a transaction
  • Transaction layer — the on-chain graph of inputs, outputs, and amounts
  • Application layer — metadata from wallets, exchanges, and dApps that link addresses to identities

Effective privacy requires addressing all three independently.

What is CoinJoin and how does it actually work?

CoinJoin is a trustless transaction construction method proposed by Gregory Maxwell in 2013. The core idea: multiple participants combine their inputs into a single transaction with multiple equal-value outputs. Because Bitcoin script cannot enforce which input funds which output, an external observer cannot determine the mapping.

A minimal CoinJoin example: Alice wants to send 0.1 BTC to Carol. Bob wants to send 0.1 BTC to Dave. Instead of two separate transactions, they construct one transaction with two inputs and two outputs, both of exactly 0.1 BTC. An observer sees the transaction but cannot tell whether Alice paid Carol or Dave.

The equal output denomination is critical. If outputs differ in size, the linkage becomes probabilistic at best and obvious at worst. This is why Wasabi Wallet enforces a fixed denomination (historically 0.1 BTC, later configurable) and why change outputs are handled separately — change is the primary source of CoinJoin deanonymization.

Wasabi Wallet (desktop, open source) implements ZeroLink, a protocol that uses a blind signature scheme so the coordinator cannot link inputs to outputs. The coordinator knows which inputs registered but signs output credentials without learning which participant submitted them. Wasabi 2.0 moved to a WabiSabi protocol that allows variable amounts and improves UTXO consolidation behavior.

JoinMarket takes a market-based approach: "makers" provide liquidity and earn small fees; "takers" pay to use that liquidity for CoinJoins. This eliminates a central coordinator entirely. The trade-off is complexity — running JoinMarket requires a Bitcoin full node and comfort with command-line tooling.

Whirlpool (integrated into Samourai Wallet and Sparrow Wallet) uses a pool-based model with fixed denominations: 0.5 BTC, 0.05 BTC, and 0.01 BTC pools. Postmix UTXOs can be remixed indefinitely at no additional fee. Samourai's STONEWALLx2 and Stowaway (PayJoin) features extend this further for actual spending.

A key metric for evaluating CoinJoin quality is the anonymity set — the number of indistinguishable outputs a given UTXO could plausibly map to. A single Whirlpool mix with 5 participants gives an anonymity set of 5. After remixing, this grows, though the mathematical upper bound depends on assumptions about which participants re-entered the pool.

How do zero-knowledge proofs enable privacy at the protocol level?

Zero-knowledge proofs (ZKPs) allow a prover to demonstrate that a statement is true without revealing any information beyond the truth of

Top comments (0)