How does Monero work?

The big picture: a public ledger in which nothing can be read — yet everything can be verified

The problem: a blockchain is a glass wallet

Bitcoin's blockchain is a public table. Anyone can open a block explorer and see that 0.3 BTC moved from address bc1q…a7 to address bc1q…f2. There are no names, but once an address is linked to a person (a payment to an exchange, a transfer to a friend, a donation address posted online), their whole history is visible: how much they own, whom they pay, who pays them.

Monero makes sure none of these three things can be read from the ledger. Each uses its own technique.

1. Who received it? — one-time addresses

You have one public address (a long string starting with 4). But it never appears on the blockchain. The sender takes your address, mixes in a random number and computes a brand-new one-time address. The money goes there.

An outsider sees millions of one-time addresses and cannot tell which belong to the same person. Your wallet, using its secret view key, scans every new transaction and recognises "its own".

2. How much? — hidden amounts

Instead of an amount, the blockchain stores a commitment — a number that "locks" the amount inside. You cannot learn the amount from the commitment, but commitments have a magical property: they can be added. The network adds the commitments of inputs and outputs and checks that the balance matches — without knowing any of the amounts.

One loophole remains: what if someone writes a negative amount? "−100 + 101 = 1" also balances, and money appears from nowhere. So every output carries a range proof (Bulletproofs+): a short proof that the hidden number is non-negative and not huge.

3. Who sent it? — rings (and soon, the whole blockchain)

When you spend a coin, you must prove it is yours. In Bitcoin that is a signature that points straight at the spent output. Monero today uses a ring signature: you take your output plus 15 random outputs of other people from the blockchain (decoys) and sign in a way that convinces the verifier that "the owner of one of these 16 signed" — without revealing which one.

Then how do you stop the same coin being spent twice? Every output, when spent, leaves a unique "fingerprint" — a key image. The network stores all key images and rejects a transaction whose key image was already seen. You cannot tell from the key image which of the 16 outputs was spent, but you cannot spend it a second time.

A ring of 16 is a compromise: a bigger ring means more privacy but heavier, slower transactions. This compromise has known weaknesses. That is why Monero is preparing to switch to FCMP++: instead of 16 candidates, the real input could be any output on the entire blockchain — over a hundred million options.

All together: RingCT

The combination "ring signatures + hidden amounts + one-time addresses" is called RingCT (Ring Confidential Transactions). It has been mandatory for every Monero transaction since 2017. Privacy in Monero is not an option you can forget to switch on: all transactions look alike, so yours hides in the crowd of everyone else's.

Everything else is like Bitcoin

Under the privacy layer, Monero is an ordinary cryptocurrency:

• Blockchain — a chain of blocks, a new block roughly every 2 minutes.
• Mining — Proof-of-Work using RandomX, designed to suit ordinary CPUs.
• Emission — the main emission ended in 2022; now each block brings 0.6 XMR forever (tail emission).
• Nodes — anyone can run monerod and check every rule themselves.

Read next

• Why privacy at all? — about the fungibility of money.
• RingCT and FCMP++ in plain words — if that's what you came for.
• The Ed25519 curve — the start of the technical section.