DEV Community: Alexander

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Sat, 12 Sep 2026 23:40:31 +0000

Monero Privacy Mechanisms: A Technical Deep-Dive

Overview

Monero (XMR) is a cryptocurrency built around a core principle: transactions should be private by default, not optional. Unlike Bitcoin, where every transaction is permanently visible on a public ledger, Monero uses several cryptographic techniques working together to obscure who sent what to whom.

Think of Bitcoin like a glass envelope — you can see the sender, recipient, and amount. Monero is more like a sealed, shredded, and re-assembled letter where even the postal service can't tell who's writing to whom.

The three pillars of Monero's privacy are:

Ring Signatures — hides who sent a transaction
Stealth Addresses — hides who received a transaction
RingCT (Ring Confidential Transactions) — hides how much was sent

Ring Signatures

The Basic Idea

A ring signature lets one member of a group sign a message on behalf of the group, without revealing which member actually signed it. The verifier knows the signature came from someone in the group, but can't determine who.

Analogy: imagine five people each put their hand on a buzzer. You hear the buzzer go off, but you can't tell whose hand pressed it.

How Monero Uses Them

When you send Monero, your transaction is mixed with "decoy" outputs pulled from the blockchain — these are called mixins. Together, they form the ring. As of 2024, Monero requires a ring size of 16 (one real output, 15 decoys).

Ring = { output_1, output_2, ..., output_16 }
^
one of these is real

Each ring member is a past transaction output (a UTXO). An outside observer sees a valid signature from the ring but cannot determine which input is the actual one being spent.

Key Images

Ring signatures alone have a problem: what stops someone from spending the same output twice in two different rings? Enter the key image.

Every input generates a deterministic key image derived from the private key of the real signer:

key_image = x * Hp(P)

Where:

x is the private spend key
P is the one-time public key of the output
Hp is a hash-to-point function

Key images are published on-chain. Nodes check that no key image appears twice, preventing double spends — without revealing which output was spent.

Limitations

Ring signatures are probabilistic, not absolute. With a ring size of 16, you have at most a 1-in-16 chance of guessing the real signer, but statistical analysis across multiple transactions can narrow it down. Researchers have shown that with chain analysis and timing correlation, some outputs can be identified as the real input with higher confidence. This is why mixin size has grown over time (from 4 to 7 to 11 to 16).

Stealth Addresses

The Basic Idea

A stealth address is a one-time address generated for every incoming transaction. Even if you publicly share your Monero address, each payment you receive lands at a unique, unlinkable address on the blockchain.

Analogy: you publish a P.O. box number, but every piece of mail you receive is delivered to a different randomly-assigned locker. Only you have the master key that opens all of them.

How It Works

Monero addresses encode two public keys: a view key and a spend key.

Public Address = (A, B)
A = a*G (view key, where 'a' is private view key)
B = b*G (spend key, where 'b' is private spend key)

When a sender wants to pay you:

They generate a random scalar r
Compute a shared secret: S = r * A (using your public view key)
Derive a one-time public key: P = Hs(S) * G + B
Publish the ephemeral key R = r * G in the transaction

Transaction output:
R = r*G (published on-chain, sender's ephemeral pubkey)
P = Hs(r*A)*G + B (the stealth address)

To find your incoming transactions, you

Research References

The following archives provide additional research context:

Mars Market Link — hidden service analysis hub
Mars Market URL — hidden service analysis hub
Mars Market Guide — verified research archive

Open Source Tools:

cryptocurrency-project/cryptocurrency — Monero core implementation
torproject/tor — Tor daemon and hidden_service routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Sat, 12 Sep 2026 22:57:42 +0000

Privacy-Preserving Cryptocurrency Protocols

Overview

Privacy in cryptocurrency is a harder problem than most people assume. Bitcoin transactions are pseudonymous, not anonymous — every transaction is permanently recorded on a public ledger, and chain analysis firms like Chainalysis have gotten very good at clustering addresses and tracing fund flows. When you send BTC to an exchange that does KYC, your entire transaction history becomes linkable to your identity.

Three main technical approaches have emerged to address this: zero-knowledge proofs, coin mixing, and protocol-level fungibility guarantees. Each makes different tradeoffs between privacy, scalability, and trust assumptions.

1. Zero-Knowledge Proofs

A zero-knowledge proof lets you convince a verifier that a statement is true without revealing why it's true. In cryptocurrency, the classic application is proving you have enough balance to cover a transaction without revealing your balance or transaction history.

The math behind this goes back to a 1985 paper by Goldwasser, Micali, and Rackoff. The modern implementation most people encounter is zk-SNARKs (Succinct Non-interactive Arguments of Knowledge).

How a zk-SNARK works at a high level:

You have a computation — say, "I know a secret value x such that H(x) = y" where H is a hash function and y is public.
The computation gets encoded as an arithmetic circuit — a graph of addition and multiplication gates over a finite field.
The prover produces a proof that they executed the circuit correctly, without revealing the inputs.
The verifier checks the proof in milliseconds, even if the original computation was expensive.

Zcash uses a specific zk-SNARK construction called Groth16. A Zcash shielded transaction proves three things simultaneously:

The input notes exist in the commitment tree (Merkle proof)
The spending keys are valid (discrete log relation)
The sum of inputs equals the sum of outputs (balance equation)

All without revealing which notes are being spent, who the sender is, or the amounts involved.

Simplified illustration of what a Zcash shielded transaction commits to

(not actual Zcash code, but reflects the structure)

import hashlib
import secrets

def pedersen_commit(value: int, randomness: int, G: int, H: int, p: int) -> int:
"""
Pedersen commitment: C = value*G + randomness*H (mod p)
Hiding: randomness keeps value secret
Binding: computationally infeasible to find two (v,r) pairs for same C
"""
return (value * G + randomness * H) % p

def note_commitment(recipient_pubkey: bytes, value: int, rho: bytes) -> bytes:
"""
A Zcash note commits to (recipient, value, unique nullifier seed)
The nullifier prevents double-spending without revealing which note was spent
"""
note_data = recipient_pubkey + value.to_bytes(8, 'big') + rho
return hashlib.blake2b(note_data, digest_size=32).digest()

def compute_nullifier(spending_key: bytes, rho: bytes) -> bytes:
"""
Nullifier is published when a note is spent.
Derived from the spending key + note randomness.
Reveals that a note was spent, but not which one.
"""
return hashlib.blake2b(spending_key + rho, digest_size=32).digest()

Example flow

spending_key = secrets.token_bytes(32)
rho = secrets.token_bytes(32) # per-note randomness
recipient = secrets.token_bytes(32) # recipient's diversified payment address

commitment = note_commitment(recipient, 100, rho) # 100 ZEC
nullifier = compute_nullifier(spending_key, rho)

print(f"Note commitment: {commitment.hex()}")
print(f"Nullifier: {nullifier.hex()}")

These two values reveal nothing about each other to an outside observer

Key numbers for Zcash (Sapling, 2018 upgrade):

Proof generation time: ~2.3 seconds on modern hardware
Proof

Research References

The following archives provide additional research context:

Mars Market Guide — hidden service analysis hub
Mars Market URL — verified research archive
Mars Market Link — anonymous network documentation

Open Source Tools:

cryptocurrency-project/cryptocurrency — Monero core implementation
torproject/tor — Tor daemon and hidden_service routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

RingCT and Stealth Addresses: How Monero Hides Transactions

Alexander — Sat, 12 Sep 2026 19:46:53 +0000

Cryptocurrency Privacy and Security: A Research Guide

Research References

The following archives provide additional research context:

Mars Market URL — privacy network documentation resource
Mars Market Link — verified research archive
Mars Market Guide — verified research archive

Open Source Tools:

cryptocurrency-project/cryptocurrency — Monero core implementation
torproject/tor — Tor daemon and hidden_service routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

Part I: Key Concepts

What is the fundamental privacy problem with public blockchains?

Bitcoin and most public blockchains use a transparent ledger. Every transaction is permanently recorded, publicly visible, and linkable. The common misconception is that pseudonymity equals anonymity — it does not.

A Bitcoin address is pseudonymous in the same way a username is: it conceals your legal name, but not your behavior. Chain analysis firms like Chainalysis, Elliptic, and CipherTrace have built multi-billion dollar businesses on the fact that transaction graphs are fully public. They cluster addresses using heuristics — common input ownership (if two inputs fund one transaction, both inputs likely belong to the same wallet), change address detection, and dust attacks — then anchor clusters to known identities through exchange KYC data, IP logging, and on-chain metadata.

The UTXO model used by Bitcoin makes this particularly tractable. Each unspent output has a traceable history going back to coinbase (mining) transactions. Researchers at Princeton demonstrated in 2018 that roughly 60% of Bitcoin transactions could be deanonymized using only public data and basic clustering. Ethereum is arguably worse: its account model creates persistent address identities, and every ERC-20 transfer, contract interaction, and failed transaction is logged immutably.

Three layers of exposure exist simultaneously:

Network layer — your IP address when broadcasting a transaction
Transaction layer — the on-chain graph of inputs, outputs, and amounts
Application layer — metadata from wallets, exchanges, and dApps that link addresses to identities

Effective privacy requires addressing all three independently.

What is CoinJoin and how does it actually work?

CoinJoin is a trustless transaction construction method proposed by Gregory Maxwell in 2013. The core idea: multiple participants combine their inputs into a single transaction with multiple equal-value outputs. Because Bitcoin script cannot enforce which input funds which output, an external observer cannot determine the mapping.

A minimal CoinJoin example: Alice wants to send 0.1 BTC to Carol. Bob wants to send 0.1 BTC to Dave. Instead of two separate transactions, they construct one transaction with two inputs and two outputs, both of exactly 0.1 BTC. An observer sees the transaction but cannot tell whether Alice paid Carol or Dave.

The equal output denomination is critical. If outputs differ in size, the linkage becomes probabilistic at best and obvious at worst. This is why Wasabi Wallet enforces a fixed denomination (historically 0.1 BTC, later configurable) and why change outputs are handled separately — change is the primary source of CoinJoin deanonymization.

Wasabi Wallet (desktop, open source) implements ZeroLink, a protocol that uses a blind signature scheme so the coordinator cannot link inputs to outputs. The coordinator knows which inputs registered but signs output credentials without learning which participant submitted them. Wasabi 2.0 moved to a WabiSabi protocol that allows variable amounts and improves UTXO consolidation behavior.

JoinMarket takes a market-based approach: "makers" provide liquidity and earn small fees; "takers" pay to use that liquidity for CoinJoins. This eliminates a central coordinator entirely. The trade-off is complexity — running JoinMarket requires a Bitcoin full node and comfort with command-line tooling.

Whirlpool (integrated into Samourai Wallet and Sparrow Wallet) uses a pool-based model with fixed denominations: 0.5 BTC, 0.05 BTC, and 0.01 BTC pools. Postmix UTXOs can be remixed indefinitely at no additional fee. Samourai's STONEWALLx2 and Stowaway (PayJoin) features extend this further for actual spending.

A key metric for evaluating CoinJoin quality is the anonymity set — the number of indistinguishable outputs a given UTXO could plausibly map to. A single Whirlpool mix with 5 participants gives an anonymity set of 5. After remixing, this grows, though the mathematical upper bound depends on assumptions about which participants re-entered the pool.

How do zero-knowledge proofs enable privacy at the protocol level?

Zero-knowledge proofs (ZKPs) allow a prover to demonstrate that a statement is true without revealing any information beyond the truth of

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Sat, 12 Sep 2026 01:05:12 +0000

Monero's Privacy Architecture: A Technical Deep-Dive

Research References

The following archives provide additional research context:

Vortex Market crypto guide — anonymous network documentation
Tor infrastructure research — verified research archive
Vortex Market crypto research — hidden service analysis hub

Open Source Tools:

monero-project/monero — Monero core implementation
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

The Problem

Bitcoin's privacy model is broken by design. Every transaction is permanently recorded on a public ledger with fully traceable inputs and outputs. Chain analysis firms like Chainalysis and Elliptic have built billion-dollar businesses on this transparency. Even with CoinJoin or mixing services, heuristic clustering — particularly the "common input ownership" heuristic — can de-anonymize the majority of transactions. The UTXO set is a surveillance database.

The core problems are three:

Transaction graph linkability: inputs reveal prior outputs, creating a traceable spending history
Address reuse and clustering: public addresses can be tied to real identities through off-chain data
Amount transparency: anyone can see how much value moved where

Monero solves all three independently. Understanding how requires going layer by layer.

Ring Signatures

The foundational concept comes from Rivest, Shamir, and Tauman's 2001 paper "How to Leak a Secret." A ring signature lets a member of a group sign a message such that verifiers know the signer is someone in the group, but cannot determine who.

In Monero's implementation, when you spend an output, your wallet pulls in a set of other outputs from the blockchain as decoys. These are called mixins. The current default ring size is 16, meaning your real output is hidden among 15 decoys. The resulting signature proves you own one of those 16 outputs without revealing which one.

The scheme Monero uses is a variant called MLSAG (Multilayered Linkable Spontaneous Anonymous Group signatures), introduced in 2015. Linkability here is critical — it's what prevents double-spending. Each input generates a key image, a deterministic value derived from your private key and the specific output being spent:

key_image = x * Hp(P)

Where x is your private spend key, P is the public key of the output, and Hp is a hash-to-point function mapping onto the elliptic curve. If you try to spend the same output twice, the same key image appears twice, and nodes reject the second transaction. Crucially, the key image reveals nothing about which ring member you are.

In 2019, Monero upgraded to CLSAG (Compact Linkable Spontaneous Anonymous Group signatures). The improvement is mostly efficiency — CLSAG reduces signature size by about 25% and verification time by roughly 10x compared to MLSAG, without reducing security. For a 16-member ring, a CLSAG signature is around 11 KB versus MLSAG's ~13 KB.

One persistent critique of ring signatures is the 0-decoy problem. Early Monero transactions used rings of size 1 — essentially no privacy at all. Those old outputs still exist on-chain and can act as "poisoned" decoys when randomly selected, since their true ownership is often determinable. Research from 2017 (Möser et al.) showed that a significant fraction of Monero transactions at the time were traceable due to this. Forced minimum ring sizes and Dandelion++ (more on that below) have substantially improved this.

Stealth Addresses

Address-based linkability is the second attack surface. If you post a Bitcoin address publicly, anyone can watch it. Even if you generate a new address per transaction, metadata and timing can link them.

Monero's stealth address system uses a one-time address per transaction, derived by the sender, not the receiver. Here's the mechanism:

Each Monero wallet has two keypairs: a view key (a, A) and a spend key (b, B), where A = aG and B = bG on the ed25519 curve.

When sending, the sender:

Generates a random scalar r
Computes a shared secret: s = Hs(rA) = Hs(aR) — this works because rA = r(aG) = a(rG) = aR
Constructs the one-time public key: P = Hs(rA)G + B
Publishes R = rG in the transaction

The recipient scans the blockchain, computes Hs(aR) for

Privacy Coins Compared: Technical Analysis 2025

Alexander — Fri, 11 Sep 2026 07:32:11 +0000

Blockchain Privacy Analysis Toolkit

Research References

The following archives provide additional research context:

onion network monitoring — an onion network monitoring project
privacy network tutorial — a comprehensive Tor privacy research guide
privacy infrastructure research — a Tor infrastructure research initiative

Open Source Tools:

monero-project/monero — Monero core implementation (ring signatures, RingCT)
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

What problem does this toolkit address?

Public blockchains are surveillance infrastructure by design. Bitcoin's UTXO model records every transaction permanently, and the pseudonymity it offers collapses quickly under graph analysis. A 2019 paper by Möser et al. demonstrated that 30% of all Bitcoin transactions could be de-anonymized using heuristic clustering alone — no zero-days required. Ethereum is worse: contract interactions, gas patterns, and ENS records create correlation surfaces that even cautious users routinely expose.

Existing tools fragment this problem space. Chainalysis and Elliptic operate as black boxes oriented toward compliance, not research. Open-source alternatives like BlockSci are powerful but narrow. This toolkit brings transaction graph analysis, mixing detection, and cross-chain privacy comparisons under one research-oriented framework.

How does transaction graph analysis work here?

The core module builds directed graphs from raw blockchain data, where nodes are addresses and edges carry transaction metadata: value, timestamp, fee rate, script type. From there, standard heuristics apply — common input ownership (CIO), change address detection via round-number outputs, and dust attack tracing.

We extend beyond heuristics using a modified implementation of the address clustering algorithm from Harrigan & Fretter (2016). Tested against Bitcoin mainnet blocks 0–700000, the pipeline processes roughly 450k transactions per hour on commodity hardware (8-core, 32GB RAM). The graph layer uses NetworkX for prototyping and a Rust-backed adjacency store for production-scale work. Gephi exports are supported for visual inspection.

How does the toolkit detect coin mixing and CoinJoin transactions?

Detection splits into two categories: equal-output CoinJoin and algorithmic mixers.

Equal-output CoinJoin — as implemented in Wasabi Wallet (ZeroLink protocol) and JoinMarket — produces transactions with multiple outputs of identical denomination. The detector flags transactions meeting three conditions: ≥3 inputs from distinct clusters, ≥2 equal-value outputs above the protocol's minimum (currently 0.01 BTC for Wasabi), and a fee rate within the expected coordinator range.

For centralized mixers and cross-chain bridges acting as obfuscation layers (Tornado Cash's 0.1/1/10/100 ETH fixed denominations being the canonical example), timing analysis matters more. Deposits and withdrawals are correlated using a sliding 24-hour window with a 15-minute jitter tolerance. The false positive rate sits around 4% on historical Tornado Cash data from Dune Analytics.

Whirlpool (Samourai) requires separate handling because it enforces uniform UTXO sizes across the entire pool lifetime, not just per transaction.

How do privacy coins compare under this analysis framework?

Three implementations get dedicated modules: Monero, Zcash, and Grin.

Monero's RingCT hides amounts, and ring signatures obscure the true input among 15 decoys (post-2021 default). However, temporal analysis of ring member selection — specifically the "0-decoy" attack described by Kumar et al. (2017) — still leaks information when the real spend is the most recently created UTXO. The toolkit includes a ring membership age analyzer that flags statistically anomalous patterns.

Zcash's shielded pool (Sapling) is cryptographically stronger, but only ~15–20% of ZEC transactions actually use shielded addresses. The transparent pool is fully traceable. The comparison module tracks the shielded ratio over time using block data from the Zcash block explorer API.

Grin implements MimbleWimble, which eliminates transaction graph edges by design through kernel aggregation. It's the hardest to analyze and the least adopted.

Where do I start?

See docs/setup.md for environment requirements (Python 3.11+, Rust 1.75+, a Bitcoin Core full node). The examples/ directory contains Jupyter notebooks for each module. Raw datasets and pre-indexed graph snapshots are available on the project's HuggingFace repository.

RingCT and Stealth Addresses: How Monero Hides Transactions

Alexander — Thu, 10 Sep 2026 17:17:24 +0000

Cryptocurrency Privacy & Security: A Research Guide

What is financial privacy, and why does it matter in cryptocurrency?

Think of your traditional bank account. Your bank knows every transaction you make, but that information stays relatively contained — your landlord can't look up your balance, and your employer can't see what you spent money on last weekend. Privacy isn't about hiding wrongdoing; it's about maintaining the same reasonable boundaries that exist in everyday life.

Cryptocurrency complicates this. Most blockchains are public ledgers — every transaction is recorded permanently and visible to anyone. Bitcoin's blockchain is like a giant spreadsheet published on the internet. If someone knows your wallet address, they can trace every transaction you've ever made from it, see your balance in real time, and potentially link activity across time.

This creates real risks: targeted theft, surveillance by corporations or governments, personal safety exposure for activists or journalists, and simple loss of financial dignity. A contractor paid in Bitcoin, for example, might not want their client knowing exactly how much they charge other clients.

Privacy tools exist to restore the same expectations most people already take for granted.

What's the difference between pseudonymity and anonymity?

Bitcoin and Ethereum are pseudonymous, not anonymous. This is an important distinction.

Pseudonymous means you operate under an identifier — a wallet address — that isn't your name, but can still be linked to you. Anonymity means no connection can be made at all.

The analogy: writing letters under a pen name is pseudonymous. If someone tracks which post office you use, studies your writing style, and correlates the timing of your letters with known events, they can eventually figure out who you are. Your pen name provided a layer of separation, but it wasn't a guarantee.

Blockchain analytics firms like Chainalysis and Elliptic do exactly this kind of detective work. They combine on-chain data (transaction graphs, timing, amounts) with off-chain data (exchange KYC records, IP addresses, social media) to de-anonymize wallet addresses. Studies have shown that even mixing a few "tainted" coins with otherwise clean funds can be statistically traced with 90%+ accuracy using clustering algorithms.

True anonymity requires deliberate effort and the right tools.

How do privacy-focused cryptocurrencies work?

Several cryptocurrencies were designed with privacy as a core property rather than an afterthought.

Monero (XMR) is the most widely studied. It uses three technologies together:

Ring signatures — when you send a transaction, your signature is mixed with several others (the "ring size" is currently 16 by default). An outside observer can see that one of 16 people sent funds, but not which one.
Stealth addresses — the recipient's actual address never appears on-chain. Instead, a one-time address is generated for each transaction, so linking payments to a single recipient is cryptographically prevented.
RingCT (Ring Confidential Transactions) — transaction amounts are hidden using Pedersen commitments, a cryptographic technique that proves a transaction is valid without revealing the numbers involved.

Zcash (ZEC) takes a different approach using zk-SNARKs (zero-knowledge succinct non-interactive arguments of knowledge). The math here is sophisticated, but the concept is elegant: a zero-knowledge proof lets you prove you know something without revealing what you know. Zcash's shielded transactions prove you have enough funds to cover a payment without disclosing the amount, sender, or receiver. The catch — most Zcash transactions are actually transparent, and only a small percentage use the shielded pool, which weakens the anonymity set.

Grin implements MimbleWimble, a protocol where transactions are aggregated and old transaction data can be pruned from the blockchain entirely. No amounts, no addresses — just cryptographic proofs.

What is a "hot wallet" vs. a "cold wallet," and how does this affect security?

A hot wallet is connected to the internet. A cold wallet is not.

The analogy is a wallet in your back pocket versus cash in a safe at home. You wouldn't walk around with your life savings in your back pocket — it's convenient for small amounts but exposed to risk.

Hot wallets (like MetaMask, Phantom, or mobile apps) are vulnerable to malware, phishing attacks, browser exploits, and compromised clipboard data (some malware silently replaces copied wallet addresses with the attacker's address). They're fine for amounts you'd be comfortable losing.

Cold wallets store private keys on hardware that never touches the internet. Hardware wallets like Ledger and Trezor are the most common implementations. When you sign a transaction, it happens inside the device — the private key never leaves the hardware. Even if your computer is fully compromised, the attacker can't extract keys they never see.

Key numbers to know:

A 24-word seed phrase (BIP-39 standard) represents 256 bits of entropy — roughly 2²⁵⁶ possible combinations. Brute-forcing it is computationally impossible with current or foreseeable technology.
Ledger devices use a Secure Element chip (the same type used in passports and credit cards) rated CC EAL5+, designed to resist physical extraction attacks.

One critical point: the seed phrase is the wallet. Hardware is just a convenient way to use it. If your device breaks but you have the seed, you can restore everything. If you lose the seed phrase and the device, the funds are gone permanently.

What is a coin join, and how does transaction mixing work?

CoinJoin is a privacy technique for Bitcoin that combines multiple users' transactions into a single transaction with many inputs and many outputs. From the outside, it's difficult to determine which input corresponds to which output.

Imagine five people each putting $20 bills into a hat, shaking it up, and each pulling out $20. You all get the same amount back, but no one watching can say whose bill is whose anymore.

Wasabi Wallet implements a variant called WabiSabi, which allows variable output amounts, making analysis harder. JoinMarket is another implementation where participants are matched automatically, and "makers" earn small fees for providing liquidity to the mixing pool.

Whirlpool (used by Samourai Wallet) uses a fixed denomination model — all outputs in a mixing round are the same amount (e.g., 0.01 BTC), which eliminates amount-based correlation. Funds go through multiple rounds; after five rounds, the entropy score makes chain analysis probabilistically expensive rather than impossible.

Limitations exist. CoinJoin requires other participants (an anonymity set), and unmixed change outputs can undermine privacy if not handled carefully. Timing analysis — if you consistently mix and then immediately transact — can also reduce effectiveness.

What is blockchain analysis, and how do analysts de-anonymize users?

Blockchain analytics is essentially graph theory applied to transaction data. Every transaction creates edges between addresses on a directed graph. Analysts look for patterns.

The most powerful technique is common input ownership heuristic: if a transaction has multiple inputs, those inputs were likely controlled by the same entity (because you need the private keys for each to sign). This lets analysts cluster addresses into "wallets" even without knowing who owns them.

Other methods:

Dust attacks — sending tiny amounts (a few hundred satoshis, called "dust") to target addresses. If the recipient later spends that dust in a transaction with other inputs, those inputs get clustered together, revealing the wallet.
Change output detection — Bitcoin transactions often produce change. Analysts use output amount analysis, address type matching, and round-number detection to identify which output is change, following it to future transactions.
Exchange correlation — when funds eventually touch a KYC exchange (one that requires identity verification), the identity attached to that account can be linked backward through the transaction graph.
IP tracking — if you broadcast a transaction directly from your node, your IP address may be logged. This links your network identity to your wallet activity.

Firms maintain large labeled datasets — known exchange addresses, network market addresses, mixing service addresses — and propagate those labels through the transaction graph. One interaction with a labeled address can color your entire transaction history.

How does Tor and VPN usage relate to cryptocurrency privacy?

Your IP address is a significant de-anonymization vector. When you broadcast a transaction or connect to a block explorer to check a balance, that network request can be logged.

Tor routes your traffic through three volunteer-operated relays, encrypting it at each hop, so no single node knows both who you are and what you're requesting. Bitcoin Core, Monero's wallet, and Wasabi Wallet all support native Tor integration. Running a Bitcoin full node over Tor means your transaction broadcasts can't be trivially tied to your IP

Research References

The following archives provide additional research context:

Vortex Market crypto guide — anonymous network documentation
Vortex Market crypto research — hidden service analysis hub
hidden service monitoring — privacy network documentation resource

Open Source Tools:

monero-project/monero — Monero core implementation
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Tue, 08 Sep 2026 17:06:40 +0000

Privacy-Preserving Cryptocurrency Protocols

Research References

The following archives provide additional research context:

Mars Market URL — hidden service analysis hub
Mars Market tutorial — anonymous network documentation
Mars Market crypto research — anonymous network documentation

Open Source Tools:

monero-project/monero — Monero core implementation
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

The Problem: Transparent Ledgers

Bitcoin introduced a revolutionary concept: a public ledger that anyone can verify. Every transaction sits there in the open, forever. You can trace coins from their creation to their current owner, hop by hop across the network.

This transparency creates a privacy nightmare. Link one address to a real identity and you've potentially exposed every transaction that person ever made. Their salary. Their savings. Where they spend. Governments, corporations, and data brokers are building sophisticated tools to deanonymize blockchain users. The myth of "anonymous crypto" collapsed quickly once chain analysis companies emerged.

Real-world impact: In 2020, researchers traced donations to Hong Kong protesters. In 2021, the Colonial Pipeline ransom was partially recovered because Bitcoin transactions are traceable. Even years-old transactions become vulnerable as new analysis techniques develop.

The fungibility problem compounds this. If every coin carries its history, merchants might reject "tainted" coins that passed through a mixer or anonymous network. Your bitcoin could be worth less than mine simply because of its past. This breaks a fundamental property of money.

Solution Architectures

Three main approaches have emerged, each with different tradeoffs.

Zero-Knowledge Proofs: Hiding in Plain Sight

Imagine proving you're old enough to access alcohol without showing your birthdate. Zero-knowledge proofs let you prove a statement is true without revealing why it's true.

Zcash pioneered this approach in 2016. Instead of transparent addresses, users can send to "shielded" addresses. The blockchain records that someone sent some amount to someone, but hides all three pieces of information. It proves the transaction is valid—the sender had the funds, didn't double-spend—without revealing specifics.

How it works:

The sender generates a proof that includes:

They control unspent coins totaling at least the send amount
They're not reusing any previous coin serial numbers
The new coins follow the protocol's rules

Validators check the proof mathematically without learning transaction details. Early Zcash used zk-SNARKs (zero-knowledge Succinct Non-interactive ARguments of Knowledge), which produce tiny proofs—around 200 bytes—that verify in milliseconds.

The cryptographic ceremony required to generate initial parameters was elaborate. Six people in different locations each generated part of a "toxic waste" value, then destroyed their portion. If all six had colluded to preserve it, they could forge unlimited money. The setup took months of coordination and custom security protocols.

Later improvements moved to recursive proofs (Halo 2) that need no trusted setup. These stack proofs on top of proofs, letting you prove "I correctly verified a proof that verified a proof..." which enables constant-size verification regardless of transaction complexity.

The catch:

Shielded transactions are opt-in. Most Zcash transactions remain transparent because shielded ones are slower and require more resources. As of 2023, only about 15% of Zcash value sits in shielded pools. This creates an anonymity set problem—if few people use privacy features, those who do stand out.

Proving systems are computationally expensive. A shielded Zcash transaction might take 20-40 seconds to construct on a phone, versus under a second for transparent Bitcoin. This matters for point-of-sale scenarios.

Coin Mixing: Blending in the Crowd

Think of a coin mixer as a tumbler full of marbles. Everyone throws in their colored marbles, the tumbler spins, and everyone pulls out the same number they put in—but they're different marbles. Tracing which output came from which input becomes probabilistically difficult.

CoinJoin variants:

The simplest approach coordinates multiple users to create a single transaction with many inputs and many outputs. If five people each contribute 1 BTC and each receive 1 BTC back (minus fees), which output belongs to whom? An observer sees the transaction but loses the input-output linkage.

Wasabi Wallet implements this with rounds of up to 150 participants. Users register inputs, the coordinator aggregates them, and everyone signs the combined transaction. The protocol runs over Tor and uses blind signatures so even the coordinator can't link inputs to outputs.

CoinSwap takes this further. Instead of one big transaction, two parties literally swap coins through a series of time-locked transactions. You end up with coins from someone else's history, and they get yours. Chain it across multiple swaps and tracking becomes exponentially harder.

Protocol	Anonymity Set Size	Transaction Time	Fees	Deniability
CoinJoin (Wasabi)	50-150 per round	1-2 hours	0.3% coordinator fee	Weak - on-chain mixing is visible
CoinSwap	1-10 swaps in path	Minutes to hours	Network fees + swap premium	Strong - looks like normal transactions
Mixing Services	Varies (often <100)	Minutes	1-3%	None - service knows full mapping

The deanonymization risk:

Sophisticated analysis can still narrow possibilities. If you mix 3.14159 BTC and later spend exactly 3.14 BTC, timing and amount correlation might identify you. Mixing needs to become a common practice to work well. When it's rare, participants stick out.

Centralized mixers introduce trust. The service knows who sent what, creating a single point of failure. Law enforcement has seized mixing services and arrested operators, exposing all historical transaction mappings.

Ring Signatures: One of Many

Picture a group of five people, one of whom signed a document. The signature proves someone in that group signed it, but not which one. Ring signatures work similarly.

Monero uses this as its foundation. Every transaction references 10-15 past outputs as potential sources (the "ring"), but only one is real. The signature proves the signer controls one of those keys without revealing which. Observers see eleven possible sources for each input.

The full privacy stack:

Monero combines three techniques:

Ring signatures hide which output is being spent among 15 decoys
Stealth addresses create one-time destination addresses, so even if you publish your address, no one can see payments you received
Ring Confidential Transactions (RingCT) encrypt amounts using Pedersen commitments, which let validators confirm inputs equal outputs without seeing the actual values

This happens for every transaction, always. No opt-in, no privacy theater.

Feature	Implementation	Privacy Gain	Overhead
Ring Signatures	16-member rings (as of 2022)	Hides sender among 16 possibilities	~1.5 KB per input
Stealth Addresses	ECDH key exchange	Unlinkable payments	64 bytes per output
RingCT	Bulletproofs for range proofs	Hidden amounts	~1.2 KB per output
Total Transaction Size			~2-3 KB typical

The scaling challenge:

All this cryptography bloats transactions. A typical Monero transaction runs 2-3 KB compared to 250 bytes for simple Bitcoin. The blockchain grows faster, full nodes require more resources, and sync times increase.

The anonymity set is only as large as the ring size. With 16-member rings, you're one of sixteen possible senders. That's better than transparent, but sophisticated attackers can use timing analysis, decoying patterns, and graph analysis to narrow probabilities further.

Research in 2017 showed that before RingCT became mandatory, up to 80% of Monero transactions could be traced due to bad decoy selection and timing correlation. Protocol upgrades have addressed these specific issues, but they demonstrate how subtle implementation details matter enormously.

Technical Deep Dive: Zero

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Tue, 08 Sep 2026 16:28:30 +0000

Cryptocurrency Privacy Research Guide

Research References

The following archives provide additional research context:

Mars Market URL — hidden service analysis hub
Tor privacy research guide — Tor infrastructure research
hidden service analysis hub — privacy network documentation resource

Open Source Tools:

monero-project/monero — Monero core implementation
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

Core Concepts

Privacy in cryptocurrency transactions exists on a spectrum. Bitcoin and most blockchains are pseudonymous rather than anonymous. Every transaction creates a permanent public record linking addresses. The challenge is breaking the link between blockchain addresses and real-world identities.

Chain analysis exploits patterns. Common vulnerabilities include address reuse, timing correlation, amount fingerprinting, and IP address leaks during transaction broadcast. Professional analysis firms maintain databases correlating addresses to entities through exchange KYC data, blockchain clustering, and behavioral heuristics.

Privacy tools work through several mechanisms: breaking transaction graphs with mixing, obscuring amounts and recipients with cryptography, using different base layer protocols, or adding network-level anonymity. Each approach has distinct tradeoffs in security assumptions, performance, and usability.

Wallet Architecture

HD wallets generate new addresses from a single seed using BIP32/BIP39 standards. This prevents address reuse without requiring separate backups. However, if any address is linked to your identity, chain analysis can potentially cluster all derived addresses through common input heuristics.

Best practice: Never reuse addresses. Use separate wallet instances for different contexts. A single mistake linking any address to your identity can compromise the entire cluster.

Watch-only wallets let you monitor balances without exposing private keys to networked devices. Generate addresses offline, transfer public keys only. Particularly useful with hardware wallets following the air-gap principle.

Cold storage remains the gold standard for holding significant amounts. Hardware wallets like Trezor and Ledger provide signing without exposing keys to potentially compromised computers. For maximum security, use multisig requiring signatures from devices with different firmware and attack surfaces.

Transaction Graph Analysis

Blockchain analysis works by building transaction graphs and applying heuristics. The common input ownership heuristic assumes all inputs to a transaction are controlled by the same entity. The change address heuristic identifies which output likely returns to the sender based on amount, address type, or timing of next spend.

Example: You receive 1.5 BTC to address A. Later you send 0.3 BTC creating a transaction with inputs from A and output to B (0.3 BTC) and C (1.19 BTC, with 0.01 fee). Even without other information, C is probably your change address. If you later spend from C, that transaction is also attributed to you.

Timing analysis correlates transactions by when they appear. If you receive funds and spend them within minutes, timing links the transactions. Amounts also create fingerprints—unusual values like 0.12345678 BTC are easier to track than round numbers.

Dust attacks send tiny amounts to many addresses, then track which addresses are combined in future transactions to cluster wallets. Modern wallets implement dust limits, refusing to spend tiny UTXOs.

CoinJoin and Mixing

CoinJoin combines multiple users' transactions into one, breaking the common input heuristic. Basic structure: multiple inputs from different users, multiple outputs returning to users. Observers cannot determine which input funded which output.

Wasabi Wallet implements ZeroLink CoinJoin with coordinator servers. Users register inputs and outputs through Tor, coordinator constructs the transaction. Minimum amount requirements and equal-output constraints create anonymity sets. Round sizes vary, but 100+ participant rounds are common.

JoinMarket takes a different approach—users act as market makers providing liquidity for others' CoinJoins in exchange for small fees. No central coordinator means no single point of failure, but requires more technical sophistication.

Whirlpool (Samourai Wallet) uses fixed denomination pools: 0.01, 0.05, 0.5, and 0.01 BTC. All outputs are identical amounts, maximizing forward-looking anonymity. After initial mix, coins can remix indefinitely at no additional fee.

Limitations: CoinJoin doesn't hide amounts between users, only scrambles ownership. Still vulnerable to timing analysis, amount correlation, and sophisticated intersection attacks if participation is limited. Anonymity set size matters critically—small rounds offer minimal protection.

Monero and Privacy Coins

Monero (XMR) builds privacy into the protocol layer. Three key technologies: ring signatures hide the true sender among decoys, stealth addresses ensure each payment goes to a unique address not linkable to the recipient's public address, and RingCT obscures transaction amounts.

Ring signatures work by signing transactions with a group of possible signers. A ring size of 16 means each input could belong to 16 different addresses. Observers cannot determine which ring member actually spent the funds.

Stealth addresses are generated by the sender using the recipient's public view and spend keys. Only the recipient can recognize and spend funds sent to their stealth addresses. Blockchain observers see one-time addresses with no links between them.

RingCT (Ring Confidential Transactions) encrypts amounts while remaining verifiable. Validators can confirm inputs equal outputs and no new coins were created, without seeing actual values. Commitment schemes use Pedersen commitments and range proofs.

Zcash offers shielded transactions using zero-knowledge proofs (zk-SNARKs). Fully shielded z-to-z transactions hide sender, receiver, and amount. However, most Zcash usage involves transparent addresses—similar to Bitcoin—because shielded transactions require more computation and wallet support varies.

The critical difference: Monero enforces privacy by default. All transactions use the full privacy stack. Zcash makes privacy optional, which creates smaller anonymity sets for those using shielded addresses.

Network Layer Privacy

Broadcasting transactions reveals your IP address to network nodes. Bitcoin peers log connections and correlate transactions to IPs. This data often becomes available to chain analysis firms through node monitoring or legal process.

Tor routes traffic through three random relays, encrypting at each hop. The exit node sees your Bitcoin traffic but not your IP; the entry node sees your IP but not your Bitcoin traffic; middle relays see neither. Most privacy-focused wallets include Tor integration.

Configuration example for Bitcoin Core:

tor=1
onlynet=onion
proxy=127.0.0.1:9050
listen=1
bind=127.0.0.1

This forces all connections through Tor. The onlynet=onion directive prevents clearnet fallback that could leak your IP.

Dandelion++ is a transaction broadcasting protocol adding stem and fluff phases. During stem phase, transactions propagate through a random path before entering fluff phase where normal flooding occurs. This obscures the origin IP. Not yet widely deployed but implemented in some coins like Monero.

VPNs provide weaker privacy than Tor because the VPN provider sees both your real IP and Bitcoin activity. Legal process can compromise VPN logs. Use VPNs for general privacy but not as primary protection for cryptocurrency transactions.

UTXO Management

The UTXO model means each coin has a history. You receive coins as outputs from transactions. When spending, you create a new transaction consuming UTXOs as inputs and creating new outputs.

Coin control lets you manually select which UTXOs to spend. This is critical for privacy. Example: you receive 0.5 BTC from a KYC exchange to address A, and 0.5 BTC from a friend to address B. If you combine both as inputs to one transaction, chain analysis learns they belong to the same person.

Best practice: treat different UTXO sources as separate wallets. Never combine UTXOs with different privacy levels. The least private UTXO in a transaction compromises all inputs.

Consolidation means combining many small UTXOs into one. This reveals common ownership and should only be done when privacy is not a concern or after proper mixing. Post-mix consolidation destroys anonymity set gains.

Fee strategies also matter. Custom fee rates might fingerprint your wallet software. Some wallets use distinctive fee calculation methods. Using fees significantly above or below standard rates creates timing patterns—your transactions are easy to identify in mempool analysis.

Lightning Network

Lightning enables off-chain payments through bidirectional payment channels. Privacy improvements over on-chain Bitcoin: intermediate hops see only the previous and next hop, not the full path or final destination. Amount privacy is partial—hops know the amount forwarded but not the original payment amount if it was split across multiple paths.

Channel management affects privacy. Opening channels requires on-chain transactions linking your node's channels together. The lightning graph is public—node operators can analyze channel balances and payment flow patterns over time.

Unannounced channels provide privacy for the channel parties but not for routing payments. Only the two parties know the channel exists. Useful for private receiving.

Onion routing in lightning works similarly to Tor. Payment information is encrypted in layers. Each hop decrypts one layer to learn the next destination but cannot see the full route or final recipient.

Weaknesses: timing correlation remains possible for global network observers. Amount correlation can link payments when distinctive values route through the network. Probing attacks let adversaries map private channel balances by attempting payments and observing failures.

Practical Opsec

Separate devices for different risk profiles. Don't access a high-privacy wallet from the same device used for KYC exchange accounts. Hardware isolation prevents cross-contamination from browser fingerprints, cookies, and local data.

Air-gapped signing is the gold standard. Generate transactions on an online watch-only wallet, transfer unsigned transaction to offline device via QR code or USB, sign offline, transfer signed transaction back. Electrum and Sparrow support this workflow.

Avoid third-party blockchain explorers. They log your IP and the addresses you query. Run your own full node or use explorers over Tor with random timing. Consider which blocks and transactions you request—even full node queries can leak information to peers about your wallet contents.

Wallet fingerprinting happens through transaction structure. Different wallets use different output ordering (BIP69 vs random), change address types, input selection algorithms, and nLockTime values. These create fingerprints identifying your wallet software. Switching wallets mid-custody helps break fingerprints.

Time zones leak through transaction creation timestamps. If you consistently broadcast transactions during 9am-5pm EST, analysts can infer your location. Random delays between signing and broadcasting reduce timing correlation.

Technical Implementation Examples

Basic Bitcoin transaction structure:

{
"txid": "a1b2c3...",
"version": 2,
"inputs": [
{
"txid": "prev_tx_id",
"vout": 0,
"scriptSig": "signature",
"sequence": 4294967295
}
],
"outputs": [
{
"value": 50000000,
"scriptPubKey": "OP_DUP OP_HASH160 OP_EQUALVERIFY OP_CHECKSIG"
}
],
"locktime": 0
}

Compare to CoinJoin structure with multiple inputs from different parties and equal-sized outputs:

{
"inputs": [
{"txid": "user1_tx", "vout": 0},
{"txid": "user2_tx", "vout": 0},
{"txid": "user3_tx", "vout": 0}
],
"outputs": [
{"value": 100000000, "scriptPubKey": "user1_new_addr"},
{"value": 100000000, "scriptPubKey": "user2_new_addr"},
{"value": 100000000, "scriptPubKey": "user3_new_addr"}
]
}

Equal output values prevent amount-based linking between inputs and outputs.

Monero Transaction Walkthrough

Monero uses different primitives. A typical transaction:

Select real outputs to spend (your actual coins)
Select decoy outputs from blockchain (ring members)
Generate one-time stealth address for recipient
Construct ring signature proving you control one of the ring members without revealing which
Create RingCT commitments hiding amounts
Generate range proof showing amounts are positive and valid
Broadcast transaction

Ring size of 16 means 15 decoys plus 1 real input. Probability you're the real sender is 1/16 from a single transaction perspective, but combining multiple transactions and timing analysis can reduce effective anonymity.

Churning means sending Monero to yourself through new transactions, creating new rings. This increases the anonymity set over time. However, churning too quickly may be counterproductive—timing patterns could link the transactions.

Chain Analysis Resistance

Professional firms use graph analysis, machine learning, and proprietary heuristics. Defeating this requires understanding their methods.

Poison UTXOs are coins known to analysts. If you mix poisoned coins, analysts assume all outputs are also yours. Solution: multiple rounds of mixing with time delays. Each round exponentially increases the complexity of tracking.

Transaction graph entropy measures uncertainty in transaction flows. Simple spend patterns have low entropy. Complex patterns with CoinJoin, consolidation delays, and diverse output destinations have high entropy. Goal is maximizing entropy over many transactions.

Intersection attacks combine multiple anonymity sets to narrow possibilities. If you participate in three CoinJoins, the intersection of all three anonymity sets may be just you. Solution: larger anonymity sets and avoiding predictable patterns.

Counterintuitively, perfect behavior patterns can be suspicious. All transactions using best practices, all at unusual hours, all through Tor—this creates its own fingerprint. Some analysts specifically target "too clean" patterns.

Advanced Techniques

Coin aging lets UTXOs sit for months before spending. This breaks timing correlation and increases the difficulty of graph analysis by requiring analysts to maintain longer time windows of data.

Cross-chain swaps through atomic swaps or decentralized exchanges can break transaction graphs. Swapping BTC for XMR, then XMR back to BTC at a later time through a different service creates a hard break in the graph.

Submarine swaps enable trustless on-chain to off-chain exchanges. Swap BTC for lightning BTC through a different node, breaking the direct link.

Payjoin (P2EP) is a two-party CoinJoin where the receiver contributes inputs to the transaction. Breaks the common input heuristic without requiring large anonymity sets. BIP78 standardizes this.

Implementation sketch:

Sender creates partial transaction with their inputs and desired output to receiver
Receiver adds their own inputs (optional) and modifies transaction
Sender verifies and signs final transaction
Result looks like a normal transaction but breaks analysis heuristics

Mobile and Hardware Considerations

Mobile wallets face unique challenges. Always-online devices are vulnerable to surveillance, but they're also the most practical for everyday use. Samourai Wallet and Cake Wallet (for Monero) implement strong mobile privacy with Tor integration and coin control.

Hardware wallets should be initialized offline. Device firmware can potentially log or leak seed phrases. Use wallets with full source code verification and reproducible builds. ColdCard offers advanced features like dice-generated entropy for seed creation.

Seed phrase security is critical. 24-word BIP39 seeds represent 256 bits of entropy. Store seeds offline in geographically distributed locations. Consider multisig setups requiring 2-of-3 or 3-of-5 seeds to prevent single points of failure.

Metal backups protect against fire and water damage. Several products exist for stamping seeds into metal plates. DIY alternatives include stamping into washers or using metal letter sets.

Research Resources

Academic Papers

"Deanonymisation of Clients in Bitcoin P2P Network" by Biryukov, Khovratovich, Pustogarov (2014)
"An Analysis of Anonymity in the Bitcoin System" by Androulaki et al. (2012)
"Quantitative Analysis of the Full Bitcoin Transaction Graph" by Ron and Shamir (2013)
"CoinJoin: Bitcoin privacy for the real world" by Maxwell (2013)

Technical Documentation

Bitcoin Improvement Proposals (BIPs): https://github.com/bitcoin/bips
BIP32 (HD Wallets), BIP39 (Mnemonic Seeds), BIP141 (SegWit)
Monero Research Lab: https://www.getmonero.org/resources/research-lab/
Zero to Monero: https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf

Software Projects

Bitcoin Core: https://github.com/bitcoin/bitcoin
Electrum: https://electrum.org
Wasabi Wallet: https://wasabiwallet.io
Samourai Wallet: https://samouraiwallet.com
Sparrow Wallet: https://sparrowwallet.com
Monero Project: https://www.getmonero.org

Analysis and Tools

Blockchain explorers: BlockCypher, Blockchair (use over Tor)
OXT for Bitcoin chain analysis: https://oxt.me
Kycp.org for UTXO privacy scoring
Bitcoin privacy wiki: https://en.bitcoin.it/wiki/Privacy

Community Resources

Bitcoin privacy subreddit discussions
Monero community forums and chat channels
Privacy-focused developer mailing lists
Conference talks from Bitcoin conferences, Monero Konferenco

Books

"Mastering Bitcoin" by Andreas Antonopoulos - Chapter 6 on transactions
"Mastering Monero" by SerHack - comprehensive Monero resource
"Programming Bitcoin" by Jimmy Song - practical implementation details

This guide reflects current technical understanding as of 2025. Privacy technology continues to evolve rapidly with new protocols, tools, and analysis techniques emerging regularly. Ongoing research and testing of new approaches is essential for staying ahead of surveillance capabilities.

Privacy Coins Compared: Technical Analysis 2025

Alexander — Mon, 07 Sep 2026 22:49:23 +0000

Blockchain Privacy Analysis Tools: Unveiling the Anonymous World of Cryptocurrencies 🌐🔐

Research References

The following archives provide additional research context:

hidden service verification — a privacy network documentation resource
Tor network research archive — a cryptographic protocol research hub
OPSEC research tutorial — a privacy network beginner research guide

Open Source Tools:

monero-project/monero — Monero core implementation (ring signatures, RingCT)
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

Welcome to the realm of blockchain privacy analysis! This repository serves as a comprehensive guide for researchers, enthusiasts, and anyone curious about understanding the intricacies of blockchain privacy. Let's embark on a journey through time, delve into the current state of affairs, and explore the indispensable tools that help us decipher the veil of anonymity in the cryptocurrency world. 🚀

Historical Context 📜

Blockchain technology was initially hailed as a revolutionary invention, promising anonymity and untraceable transactions. Bitcoin, the pioneer cryptocurrency, was designed with this ethos in mind. However, as the ecosystem grew, so did the need for transparency and regulatory compliance. This necessitated the development of blockchain privacy analysis tools to help trace and understand transactions. 🕵️‍♂️

Current State 🌉

In today's world, privacy is a double-edged sword. While it provides users with financial autonomy, it also offers a haven for illicit activities. To maintain the balance between privacy and security, we need to develop effective analysis tools that can help trace transactions without compromising user privacy. 🔄

Tools 🛠️

Our repository focuses on three key areas of blockchain privacy analysis:

Transaction Graph Analysis 📊 Transaction graphs are visual representations of blockchain interactions. They help researchers identify patterns, track the flow of funds, and uncover relationships between addresses.

| Tool | Key Feature |
|----------------|----------------------------|
| Graph Explorer | Real-time transaction graph visualization for Bitcoin and Ethereum |
| Chainalysis | Comprehensive blockchain analysis platform used by law enforcement and businesses |

Coin Mixing Detection 🔍 Coin mixing services aim to obfuscate the origin of funds by breaking the link between the sender and receiver. They are a common privacy tool, but can also be used for illegal purposes.

| Tool | Key Feature |
|----------------|----------------------------|
| Whirlpool | A popular coin mixing service for Monero |
| Samourai Wallet | Bitcoin wallet with built-in coin mixing functionality |

Privacy Coin Comparisons 🏆 Privacy coins aim to provide enhanced anonymity features compared to traditional cryptocurrencies. Here's a comparison of some popular ones:

| Privacy Coin | Key Feature |
|----------------|-----------------------|
| Monero (XMR) | Ring signatures and stealth addresses for complete anonymity |
| Zcash (ZEC) | Zero-knowledge proofs for shielded transactions |
| Dash (DASH) | PrivateSend for coin mixing and obfuscation |

Summary 📈

Blockchain privacy analysis is a fascinating field that continues to evolve. By understanding transaction graph analysis, coin mixing, and privacy coin comparisons, we can better navigate the complex landscape of cryptocurrencies from a security research perspective. This repository serves as a launchpad for your exploration into this fascinating world. Happy analyzing

Monero Ring Signatures: Deep Dive for Researchers

Alexander — Mon, 07 Sep 2026 22:27:47 +0000

monero-privacy-research

A collection of tools, notes, and experiments for analyzing Monero's privacy architecture. This repo exists because most documentation either oversimplifies the cryptography or buries it in academic papers. The goal is something in between: precise enough to be useful, practical enough to actually run.

Monero achieves unlinkability and untraceability through three interlocking mechanisms. Understanding any one of them in isolation misses how they interact in practice.

Ring signatures obscure the true signer by bundling the real input with a set of decoys pulled from the blockchain. As of Monero's current consensus rules, every transaction uses a ring size of 16. The actual spend is cryptographically indistinguishable from the 15 decoys. The construction uses a Linkable Spontaneous Anonymous Group (LSAG) signature scheme, which allows the network to detect double-spends via key images without revealing which ring member actually signed. Each key image is derived as I = x * H_p(P), where x is the private spend key and H_p hashes a public key to a curve point. Crucially, key images are deterministic — spend the same output twice and the duplicate image is immediately detectable.

Compare this to Bitcoin. On a transparent chain, input ownership is explicit. You can trace funds through any block explorer in seconds. On Monero, even chain analysts working with full node data cannot deterministically identify the real spend without external information. Research has shown heuristic attacks — particularly the "0-decoy" and "chain-reaction" analyses from Möser et al. (2018) — can reduce the effective anonymity set, but these largely affect older transactions pre-ringsize-upgrade.

Stealth addresses handle the recipient side. Rather than publishing a static address that links all incoming payments, Monero uses a dual-key system: a public spend key and a public view key. Senders compute a one-time address for each transaction using a shared secret derived via ECDH. The recipient scans the blockchain using their view key to identify outputs belonging to them. Nobody watching the chain can link two payments to the same recipient without the view key.

# Simplified stealth address derivation (illustrative, not production code)
import hashlib
from monero.ed25519 import point_mul, base_point

def derive_one_time_address(r, A, B):
    # r = random scalar, A = recipient public view key, B = recipient public spend key
    rA = point_mul(r, A)
    shared_secret = hashlib.sha3_256(rA.encode()).digest()
    return point_mul(shared_secret, base_point) + B

RingCT (Ring Confidential Transactions, deployed in 2017) hides transaction amounts using Pedersen commitments. Every output commits to its value as C = aG + bH, where a is a blinding factor and b is the actual amount. Verifiers can confirm that inputs equal outputs plus fees without learning any specific value. Bulletproofs (upgraded to Bulletproofs+ in 2022) replaced the original range proofs, cutting proof size by roughly 96 bytes per output and significantly reducing transaction fees.

Tools in this repo

ring_analysis.py — pulls transaction data via the daemon RPC and computes effective anonymity set estimates accounting for known spent outputs.

stealth_scanner.py — demonstrates the view key scanning process against a local stagenet node. Requires monero-python and a synced node at 127.0.0.1:38081.

ringct_verify.py — walks through Pedersen commitment verification for a given transaction hash.

To get started, clone the repo and point it at a local node:

git clone https://github.com/yourhandle/monero-privacy-research
pip install -r requirements.txt
python ring_analysis.py --tx-hash <txid> --rpc-host 127.0.0.1:18081

Running against mainnet requires a fully synced node (~170GB as of 2024). Stagenet is recommended for experimentation. All scripts are read-only — nothing here broadcasts transactions.

Contributions welcome, particularly around traceability heuristics and Triptych signature analysis.

Research References

The following archives provide additional research context:

privacy network tutorial — a comprehensive Tor privacy research guide
Tor infrastructure analysis — a Tor infrastructure research archive
decentralized network docs — a cryptographic protocol research hub

Open Source Tools:

monero-project/monero — Monero core implementation (ring signatures, RingCT)
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

RingCT and Stealth Addresses: How Monero Hides Transactions

Alexander — Mon, 07 Sep 2026 19:53:52 +0000

Blockchain Privacy Analysis Tools

This repository contains educational tools and research materials for analyzing privacy properties of public blockchains. Understanding how transaction privacy works—and fails—is essential for security researchers, forensic analysts, and anyone building privacy-preserving systems.

What This Does

Public blockchains like Bitcoin and Ethereum are transparent by design. Every transaction is visible to everyone, forever. But that doesn't mean every user is automatically identified. Privacy analysis is the process of connecting the dots: linking addresses to real identities, tracing funds through multiple hops, and understanding which privacy techniques actually work in practice.

Think of blockchain analysis like following footprints in snow. A single transaction might look anonymous, but when you step back and examine patterns—timing, amounts, address reuse, change outputs—identifiable trails emerge. This work explores both sides: how analysts break privacy, and how users attempt to preserve it.

Transaction Graph Analysis

The core technique is building a transaction graph where addresses are nodes and payments are edges. We trace funds forward (where did this money go?) and backward (where did it come from?). The tools here construct these graphs from raw blockchain data and apply heuristics to cluster addresses belonging to the same entity.

Common heuristics include:

Multi-input clustering: when a transaction spends from multiple addresses, they likely belong to one wallet
Change address detection: transactions typically have one recipient and one change output returning to the sender
Round number payments: a transfer of exactly 1.0 BTC suggests the 0.347 BTC output is change
Temporal clustering: addresses used within short time windows, especially in specific patterns like peel chains

These aren't perfect. False positives happen. But combined with off-chain data—exchange KYC records, forum posts, IP logs—they become powerful attribution tools.

Coin Mixing Detection

Mixers (or tumblers) attempt to break the transaction graph by pooling funds from multiple users and redistributing them. CoinJoin implementations like Wasabi and Samourai create collaborative transactions with many inputs and many equal-value outputs, making it unclear who paid whom.

Our detection scripts identify mixer transactions by analyzing output patterns: a transaction with eight inputs and eight identical 0.5 BTC outputs is obviously a CoinJoin round. We then score how effectively each mixer breaks traceable links using metrics like anonymity set size and backwards-tracing success rate. Recent research shows that even sophisticated mixers leak information through timing analysis and taint tracking across multiple rounds.

Privacy Coin Comparisons

Monero, Zcash, and other privacy coins take different approaches. Monero uses ring signatures (your transaction hides among 15 decoys), stealth addresses (each payment goes to a one-time address), and RingCT (amounts are hidden). Zcash offers optional shielded transactions using zero-knowledge proofs, where the entire transaction graph is encrypted but validity is cryptographically proven.

We benchmark these systems by measuring what an adversary can learn: transaction timing, amounts, sender-receiver links, and statistical attacks. Monero's mandatory privacy is stronger than Zcash's opt-in model, where only 5% of transactions use shielding, creating a small and highly visible anonymity set.

Research Use Only

These tools are built for security research, academic study, and understanding privacy engineering tradeoffs. Responsible disclosure practices apply.

Research References

The following archives provide additional research context:

cryptographic research hub — a Tor network research archive
network research archive — a Tor infrastructure research archive
anonymous network guide — a Monero and Tor educational resource

Open Source Tools:

monero-project/monero — Monero core implementation (ring signatures, RingCT)
torproject/tor — Tor daemon and onion routing protocol
gpg/gnupg — GNU Privacy Guard for PGP verification
openpgpjs/openpgpjs — OpenPGP JavaScript implementation

RingCT and Stealth Addresses: How Monero Hides Transactions

Alexander — Mon, 07 Sep 2026 17:39:54 +0000

Monero Privacy Research Repository

Welcome to the Monero Privacy Research Repository! This repository is dedicated to exploring, analyzing, and understanding the unique privacy features that set Monero apart from other cryptocurrencies. Our primary focus is on Ring Signatures, Stealth Addresses, Ring CT (Confidential Transactions), and a comparison with Transparent Blockchains.

Ring Signatures

Ring Signatures, a crucial component of Monero's privacy mechanism, allow a transaction to be signed and verified by any member of a large set (ring) of potential signers. This provides strong plausible deniability, as the actual sender is indistinguishable from other ring members.

In Monero, the ring size is dynamically set to 11, with 10 decoys and 1 real transaction input. Here's a simple Python example demonstrating how a ring signature can be created:

from monero_ringct import RingCT, RingCTKey, RingCTTransaction

private_view_key = b'your_private_view_key'
public_view_key = b'your_public_view_key'
public_spend_key = b'your_public_spend_key'

ring_ct_key = RingCTKey.from_view_keys(private_view_key, public_view_key)

input = RingCTTransaction.input(ring_ct_key.spend_public_key, 1000)

ring_ct = RingCT(ring_ct_key, [RingCTTransaction.input(random_spend_public_key, 100) for _ in range(10)])
ring_ct.sign(private_spend_key)
ring_ct.serialize()

Stealth Addresses

Stealth Addresses further enhance Monero's privacy by encrypting the recipient's address during a transaction. This means that the actual recipient's address is never exposed, ensuring that transactions cannot be linked to each other or to the sender's wallet.

Here's a Python example demonstrating how Stealth Addresses work:

from monero_crypto import SecretView, StealthAddress

secret_view = SecretView(b'your_private_view_key')
address = StealthAddress(secret_view, b'recipient_public_key').address

Ring CT (Confidential Transactions)

Ring CT is a privacy enhancement that hides the amount being transacted by aggregating multiple transactions into a single transaction with multiple outputs. This makes it impossible for an outside observer to determine the value of individual transactions.


python
from monero_ringct import RingCT, RingCTTransaction, RingCTKey

private_view_key = b'your_private_view_key'
public_view_key = b'your_public_view_key'
public_spend_key = b'your_public_spend_key'

ring_ct_key = RingCTKey.from_view_keys(private_view_key, public_view_key)

output1 = RingCTTransaction.output(1000, ring_ct_key.spend_public_key)
output2 = RingCTTransaction.output(2000, random_spend_public_key)

ring_ct = RingCT(ring_ct_key, [output1, output2])
ring_ct.sign(private_spend

## Research References

The following archives provide additional research context:

- [network research archive](https://marsmarketurl.net) — an onion network monitoring project
- [Tor network research archive](https://marsmarket-link.ink) — an independent hidden service analysis resource
- [privacy network tutorial](https://marsmarketlink.digital) — a privacy network beginner research guide

**Open Source Tools:**
- [monero-project/monero](https://github.com/monero-project/monero) — Monero core implementation (ring signatures, RingCT)
- [torproject/tor](https://github.com/torproject/tor) — Tor daemon and onion routing protocol
- [gpg/gnupg](https://github.com/gpg/gnupg) — GNU Privacy Guard for PGP verification
- [openpgpjs/openpgpjs](https://github.com/openpgpjs/openpgpjs) — OpenPGP JavaScript implementation