Bitcoin and Monero began with different questions.

Which two documents are we comparing?

The Bitcoin whitepaper is a compact design argument. Its target is the double-spending problem: if a digital coin is information, what stops an owner from sending copies to two people? The paper combines signatures, a public peer-to-peer network, proof of work, and a chain of timestamped blocks. The history with the most accumulated work becomes the network’s evidence of which spend came first.

The CryptoNote v2 paper starts from that achievement, then attacks a second problem. A public transaction graph can preserve pseudonyms while still exposing relationships. CryptoNote defines privacy in two parts: an observer should struggle to determine the real spender among possible spenders, and should struggle to link separate receipts to the same recipient.

Calling this “the Monero whitepaper” is convenient but incomplete. Monero adopted and changed CryptoNote ideas. Later research added confidential amounts and replaced parts of the signature system. Whenever this article says “the paper,” it means the 2013 CryptoNote design. Whenever it says “later Monero,” it means work outside that document.

They share the same foundation

Both papers describe peer-to-peer electronic cash without a bank deciding which payments count. Both use public-key ownership, broadcasts, blocks, proof of work, and a chain whose accepted branch represents the agreed transaction order. A node checks rules for itself rather than asking a central operator for permission.

That shared foundation matters because CryptoNote does not replace consensus with privacy. It still needs the network to order transactions and stop the same value from being spent twice. Its privacy mechanisms change the evidence inside a transaction. They do not remove the need for a common ledger.

Follow the same payment through both papers

Suppose Alice pays Bob one coin. The animation below separates three audiences that are often mixed together: the public observer, Bob’s wallet, and the validating network. Switch views and watch which facts cross the public boundary.

Live comparison · conceptual model

One payment, two evidence trails

Playing automatically

Public observerRecipient wallet

Bitcoin paperPublic transaction graph

CryptoNote v2Monero’s protocol ancestor

1 / 3

The same instruction begins both payments: move one coin from Alice to Bob.

PauseReplay

Historical boundary: the amount stays visible in the 2013 CryptoNote model shown here. Monero added confidential amounts later through RingCT.

Bitcoin makes the evidence intentionally legible. Inputs point to earlier outputs. New outputs state amounts and spending conditions. Anyone can follow that structure, while pseudonymous public keys avoid writing real names directly into the ledger. The paper itself warns that multi-input transactions can link keys to a common owner and that learning one owner can expose related activity.

CryptoNote changes both ends of the payment. Bob can publish one address, while Alice derives a fresh one-time destination key from that address and new random data. Bob scans passing transactions with private information and recognizes the output meant for him. Later, when spending, he places the real output inside a ring of possible outputs. A verifier checks that one member is authorized without learning which member supplied the secret.

Two ways to expose a double spend

Privacy cannot mean letting the same coin escape twice. Bitcoin’s solution is direct: a transaction names the previous output it spends. Nodes reject another transaction that tries to spend that output again. This explicit reference also makes the flow of value easy to audit.

CryptoNote cannot simply point to the real ring member and mark it spent, because that would reveal the signer. Its paper introduces a key image, a deterministic value tied to the secret key for the spent output. The ring signature proves that the spender controls one member of the ring. Nodes store the key image and reject a later signature that repeats it. The public learns that the same secret tried to spend again, but the key image is designed not to identify which ring member produced it.

This is the cleanest statement of the design difference. Bitcoin reveals the spent object, then checks that it has not appeared before. CryptoNote hides the spent object in a set, then publishes a separate tag that can appear only once.

Privacy changes what can be audited

Bitcoin’s transparent graph gives every observer the same raw record. A full node can check signatures, amounts, and whether each named output was previously unspent. That does not automatically attach a legal identity to an address, but transaction structure, address reuse, multi-input spending, and outside records can create links. The paper’s privacy section acknowledges this tension.

CryptoNote reduces those links at the protocol layer. One-time destinations make repeated receipts harder to group by a published address. Ring signatures make the true input ambiguous among selected outputs. A tracking or view key can let Bob or a delegated scanner recognize incoming payments without granting the spend key.

Those protections introduce different evidence and different assumptions. A ring is useful only when the decoys remain plausible. Later Monero Research Lab papers documented ways that weak selection and known spends could reduce anonymity. In other words, the ring signature can verify correctly while surrounding transaction patterns still leak probability. Cryptographic validity and practical privacy are related, but they are not the same claim.

The 2013 paper also leaves amounts public. That point is easy to miss when readers project modern Monero backward. The paper’s diagrams contain an amount field, and its ring members must use outputs of the same amount. Hiding values required later work.

The papers also disagree about mining and fixed rules

Bitcoin uses SHA-256 proof of work and a predetermined issuance schedule. Its whitepaper presents proof of work as both a timestamping cost and a way to represent majority decision making without one-IP-one-vote. It also describes block rewards and fees as the incentive for miners to support the network.

CryptoNote v2 argues that specialized mining hardware can concentrate voting power, then proposes a memory-bound proof-of-work function. It also proposes smoother emission, frequent difficulty adjustment, and a block-size rule driven by recent blocks with a penalty for excess size. These are proposals in a 2013 design document. They should not be read as universal properties of every CryptoNote descendant, and they do not describe every later Monero rule.

Neither document eliminates governance. Software still encodes the rules, and people decide which software to run. Bitcoin favors a small, fixed conceptual core and transparent history. CryptoNote explicitly argues for adaptive parameters and a narrower scripting model. Each choice moves complexity rather than making it disappear.

What Monero added after CryptoNote

Monero’s protocol continued changing after launch. The most important correction for this comparison is Ring Confidential Transactions. The Monero Research Lab’s MRL-0005 paper introduced a design for hiding amounts while proving that inputs and outputs balance. Monero first implemented RingCT in 2017 and later made it mandatory, according to Zero to Monero, Second Edition.

Later systems also changed the signatures and range proofs used by Monero. Those details matter when explaining the current network, but inserting them into the 2013 paper rewrites history. CryptoNote contributed one-time addresses, ring-based spender ambiguity, and key images. RingCT, Bulletproof-style range proofs, later signature schemes, subaddresses, and other changes belong to Monero’s subsequent research and engineering.

For a practical tour of those later mechanisms, continue with Monero under the hood. For Bitcoin’s hashing, mining, forks, and runnable browser labs, read Bitcoin from zero. Developers can also follow the implementation path in the Bitcoin Core source guide.

The useful conclusion is not a winner

The Bitcoin paper makes a public history expensive to rewrite. Its transparency gives every verifier direct evidence of ownership transitions and supply movement, while creating a graph that can be analyzed. CryptoNote keeps the proof-of-work ledger and changes what a transaction reveals. It lets nodes reject a double spend without identifying the real ring member, and lets a recipient reuse a published address without placing that address on every output.

That privacy is not free certainty. Ring construction, wallet behavior, metadata, and later protocol research matter. The original CryptoNote paper did not hide amounts. Bitcoin’s pseudonyms do not make its graph anonymous. Both designs depend on assumptions about honest work, correct software, cryptographic security, and users handling keys safely.

Read the papers as answers to different failure modes. Bitcoin removes the mint that decides which digital spend is real. CryptoNote asks how much the replacement ledger should tell everyone else. Modern Monero is one evolving answer built from that second question, not a frozen implementation of the 2013 document.