Part two, after Bitcoin from zero

Monero under the hood

By Moamen Basel, September 2026, 3 labs, ~16 min read

Bitcoin's ledger is public. Every payment and every amount stay there forever. Monero treats that as the bug. This page takes its privacy machinery apart, equation by equation. Three labs model the core ideas in a tiny group you can inspect in the browser.

Ready to get XMR? Compare atomic swaps, Haveno P2P and exchanges in the practical Monero guide.

LAB 01 Stealth address handshake TOY

Generate recipient wallet Sender pays Recipient scans with view key Pay the same wallet again

Three roles, one blockchain. Start by generating the wallet.

Teaching model: multiplicative subgroup with p = 2027, generator g = 4 and order q = 1013. Production Monero uses Edwards25519 points, different encodings and additional protocol rules.

01What "more secure" actually means

"Monero is more secure than Bitcoin and Zcash" is how the claim usually arrives. Stated that broadly, it's wrong. Security only means something against a named adversary. Against several adversaries Bitcoin is the stronger system. It has the largest attack budget ever assembled behind a chain, and the simplest cryptographic assumptions (one curve, one hash, no zero knowledge machinery). Anyone can audit the supply with addition. Zcash fields cryptography that is in one specific sense stronger than Monero's. This page will be precise about all of that.

The details leave this standing. Monero is more private by default than both, and against the adversaries most people actually face (chain analysis firms, data brokers, a nosy counterparty, a hostile ex, a corrupt official, anyone who can read a public ledger), privacy is the security property that matters. A transparent ledger turns every payment into a permanent, searchable record tied to your identity the moment any single transaction touches a KYC exchange. Nobody's treating that as a theoretical leak. It's an industry. Privacy also carries a monetary property with a name, fungibility. Every coin equal to every other. On a transparent chain, coins carry history. Exchanges freeze "tainted" deposits traced from a hack five hops back, and your perfectly legal coin becomes worth less than your neighbor's. A coin with no readable history cannot be discriminated against.

02The glass ledger

Part one already covered this. A Bitcoin transaction writes its inputs in cleartext. Output addresses too. Amounts too. Forever. "Pseudonymous" is doing heavy lifting in the usual description. Addresses aren't names, but they cluster. Spend from three addresses in one transaction and an analyst learns all three share an owner. Receive your salary to one, pay rent from it, and the graph writes your biography:

Chain analysis firms sell exactly this graph, with the name tags, to exchanges and governments. A product category. Bitcoin's own culture answered with add ons such as CoinJoin mixers and the like. The last few years showed the weakness of privacy as an add on. Coordinators get shut down. Mixed coins get flagged by the same analytics firms. The users who mix stand out precisely because most users don't. An opt in minority is a suspect list.

03Monero's bet

Monero (launched 2014) makes one architectural bet from which everything else follows: transaction privacy must be mandatory, or it barely counts. That decision removes the opt in signal and gives wallets a broad pool of eligible outputs. It does not make every privacy set equal to the whole network. On the current protocol, each input proves membership in a ring of 16 outputs. Receiver and amount privacy use different mechanisms.

A Monero transaction hides all three coordinates that Bitcoin publishes, each with its own mechanism. The receiver disappears behind stealth addresses (section 4). The sender behind ring signatures (section 5) policed by key images (section 6). The amount behind Pedersen commitments with range proofs, RingCT (section 7). Underneath, the network layer and mining are shaped to match (section 8).

04Stealth addresses

Bitcoin has a receiver problem. The address you hand out is the address that appears on chain, so everyone who ever paid you can watch everything else that address receives. Monero's answer is that your published address never appears on the chain at all. A Monero address encodes two public keys, a view key A and a spend key B. Every sender derives a fresh one time output key. The sender and recipient can identify that payment, while an unrelated chain observer should not be able to link it to the published address. Only the recipient can spend it.

In production notation, the sender publishes R = rG, derives a shared curve point from rA, and creates a one time output key such as P = Hs(rA, t)G + B, where t identifies the output. The recipient recomputes the shared point from aR. The lab translates those point additions and scalar multiplications into multiplicative notation: R = g^r, S = A^r = R^a and P = g^{H(S)} · B. That translation teaches the shared secret and one time key relationship, not Monero's byte level transaction format.

LAB 01 runs the toy translation of this handshake. Pay the same wallet twice and it produces two one time P values. The two key design is deliberate. The private view key a, together with the public spend key, can find incoming payments but cannot spend them without the private spend key. A shared view key can support an incoming receipt audit, but it does not reliably reveal every outgoing transaction or a trustworthy full balance. Subaddresses let a wallet give counterparties distinct receiving addresses without publishing a direct on chain connection between them.

05Ring signatures

Receivers are hidden. Spend side is the harder half. When you spend an output, Bitcoin points to that output directly. Monero samples 15 eligible past outputs as decoys, forms a ring of 16, and produces a ring signature proving that one member authorized the spend without identifying it. The signature equations treat the seats symmetrically. Outside timing and decoy selection evidence can still change an analyst's prior probabilities, so this is plausible deniability rather than a guarantee that every seat is equally likely.

The construction (today's version is called CLSAG) is a loop of challenges. Each ring member has an equation linking a challenge to the next member's challenge around the circle. The one member whose private key you actually hold is where you can force the loop to close. A verifier walks the full circle and checks it closes, which proves a real key participated, but every seat in the circle is algebraically identical from the outside. The decoys never consented and never need to: their public outputs are simply referenced, the way a police lineup borrows bystanders.

The lab below implements an LSAG style teaching signature in the pocket group. It demonstrates a closing challenge loop and a deterministic link tag. Current Monero uses CLSAG over Edwards25519, with 16 members and commitment related keys that this five member model omits. Five wallets exist here. You control two of them. Sign as either, then verify the toy signature and compare the outputs:

1-of-16 is plausible deniability, not invisibility. It's probabilistic privacy, and section 10 covers how analysts chip at it. That's the gap the FCMP++ upgrade in section 9 exists to close.

06Key images

If you followed part one, an alarm should be ringing. Bitcoin prevents double spending by seeing spends: the coin is publicly marked spent. If nobody can tell which ring member actually spent, what stops me from spending the same output in ten different rings? Double spend protection still has to work. That's the key image.

Every ring signature must also publish I = x · H_p(P), a value deterministically derived from the real output's key, but through a one way path, so it exposes nothing about which P in the ring produced it. The signature math (you just ran it) forces I to be well formed. A signer cannot fake a different one. The trap is the same output always yields the same key image, no matter which decoys surround it. Every node keeps a ledger of all key images ever seen. Spend an output once and its I gets recorded. Spend it again in a different ring, with a different message, even years later, and the same I pops out. The ledger matches. The transaction dies. The network enforces "once and only once" while never learning "who":

If you clicked "try #1 again", the second toy signature verified and the local ledger rejected its repeated link tag. That models the role of a production key image without claiming that this browser is a Monero node. In Monero, consensus validation rejects an already seen key image while the ring signature conceals which ring member authorized the spend.

07RingCT and commitments

Receiver hidden, sender hidden. Until January 2017 that was the whole picture. Amounts were public, and public amounts are a tracing gift (an incoming 13.37121 and an outgoing 13.37121 link two "unlinkable" events instantly). RingCT closed it. Mandatory for all transactions since September 2017. The tool it uses has a property I actually like, the Pedersen commitment.

Production Monero writes a Pedersen commitment with curve points, commonly C = xG + vH, where v is the amount and x is a random mask. The lab translates that additive equation into multiplicative notation, C = g^v · h^r. Fresh randomness hides equal amounts, while the homomorphic relationship lets a verifier check that inputs equal outputs plus the public fee without opening the commitments.

One hole remains if a commitment system checks only balance. Scalars wrap modulo the group order, so the toy values 150 and −51 can balance an input of 100 after the fee. A real transaction format must also prove each encoded amount lies in its permitted range. Monero first used Borromean range proofs, moved to Bulletproofs in 2018 and later to Bulletproofs+. Monero did patch an unexploited inflation flaw in 2017, but it was a small subgroup key image bug that enabled repeated spends. It was not this negative amount example.

08Network and mining

None of that ledger crypto hides network metadata. Dandelion++ first relays a transaction through a stem path, then spreads it in a fluff phase. This makes origin inference harder, but it does not hide a node from its peers, an ISP, a VPN provider or the first remote node. Users who need stronger network privacy must configure Tor or I2P.

Mining has a separate hardware question. Monero's RandomX proof of work is optimized for general purpose CPUs, which lowers the specialized hardware barrier. It does not guarantee geographic or pool decentralization. Since mid 2022, tail emission sets a nominal subsidy of 0.6 XMR per block. Its real security value still depends on the XMR price, fees, costs and miner behavior. Monero also adjusts its block weight limit from recent block history and penalizes oversized blocks.

09FCMP++

Section 5 already conceded the honest limit: a ring of 16 is plausible deniability, and statistics can chip at it. The Monero project's answer is the largest upgrade in its history. FCMP++ (Full Chain Membership Proofs) retires decoy selection and replaces it with a zero knowledge proof that the spent output belongs to a large set of outputs on the chain, including old outputs. This expands the possible sender set far beyond the current ring of 16.

Sloppy articles get this backwards: as of this writing (September 2026), FCMP++ is not live on mainnet. The construction is real and far along. A public stressnet has been running. Veridise completed a first audit phase. Trail of Bits audited the core codebase integration in May 2026. Still no activation height from the project, and today's network still runs 16-member CLSAG rings. If you read a page telling you FCMP++ "activated in January 2026", you've found content farm output; watch the official Monero repository and blog instead. Activation would remove decoy selection from this layer, while network metadata, timing and implementation risks would remain.

10The honest scorecard

Versus Zcash

Zcash first, and credit it fully. A shielded Zcash transaction uses zk SNARKs. The sender proves, in zero knowledge, "I own an unspent note in the shielded pool, its value balances, and here's its nullifier (Zcash's key image analogue)", revealing nothing else. You don't publish a ring or decoys, so there's no statistical residue sitting around. The anonymity set is the entire shielded pool, millions of notes, which is cryptographically stronger hiding than a ring of 16. Monero's own FCMP++ is an homage to exactly this property. The classic knock on Zcash was its 2016 "trusted setup ceremony," where compromised parameters would have allowed invisible counterfeiting. Halo 2 retired that for new transactions in the 2022 NU5 upgrade. No trusted setup anymore.

Why does Monero still win the comparison this page set out to judge? Zcash made privacy optional, and optional privacy leaks at the seams. ZEC lives in two worlds: transparent addresses (Bitcoin style, fully readable) and the shielded pool, with a visible boundary between them. Exchanges overwhelmingly deposit and withdraw transparently. Every crossing of the t↔z boundary is a public event, and academic work has repeatedly deanonymized "round trippers" who shield and unshield in linkable patterns. 2025 to 2026 changed the picture meaningfully. Shielded holdings grew from about 8% of ZEC supply in early 2024 to roughly 29% today (about 4.9M ZEC, crossing $1B in August 2026). The shielded share of transactions hit an all time high near 59% in February 2026. The July 2026 Ironwood upgrade even made the shielded pool's total supply provable. That's real adoption, and it strengthens Zcash's anonymity set. Invert the numbers anyway. ~70% of the supply still sits in the transparent world. Default flows remain transparent, and the moment privacy is a choice, choosing it is a signal. Monero's position is architectural: the strongest lock matters less than whether the door ships locked. On Monero there's no transparent world to leak into. 100% of transactions, 100% of supply, since 2017.

Versus Bitcoin

Bitcoin beats Monero on axes this page won't pretend away. Its accumulated proof of work and hashrate dwarf Monero's, so rewriting Bitcoin history costs incomparably more. Its cryptographic surface is smaller. Its supply is trivially auditable by adding the UTXOs. Monero's hidden amounts mean supply integrity rests on cryptographic soundness and correct implementation. The unexploited 2017 Monero inflation flaw came from accepting a small subgroup key image, which enabled repeated spends. It was not a confidential amount or range proof bug.

Monero's sender privacy today is also probabilistic, not absolute. Rings of 16 are vulnerable at the margins. Timing heuristics. Poor decoy selection in old wallets. "EAE" attacks where an exchange sees you on both ends. Then 2024's "black marble" spam episode, where flooding the chain with attacker owned outputs statistically thinned everyone's effective ring. Pre-2017 transactions, made in the 0-decoy era, are substantially traceable. Chain analysis firms' real Monero successes live mostly in that old corner and at the endpoints (exchanges, IP metadata), not in breaking today's cryptography. Privacy attracts regulators, and Monero pays for that outside the protocol. Japan and South Korea forced delistings years ago. Binance delisted XMR in 2024. The EU's anti money laundering framework is set to push regulated exchanges away from anonymity coins by 2027. Monero's usability increasingly routes through decentralized and atomic swap rails. Supporters call that the point. Critics call it the writing on the wall. They're describing the same fact.

11Verdict by adversary

Security is a table, not a trophy. This whole page has been building that table.

Read the columns. The opening claim sits in the right place. Bitcoin is the most secure ledger; Monero is the most secure user. Zcash holds the strongest single cryptographic instrument and, as of 2026, a growing shielded world. It still asks each user to choose privacy, and most value hasn't. Monero's design refuses to ask. If your threat model is "someone might read the chain" (and for nearly every human being, it is), that refusal is the property that matters. It's the precise, defensible sense in which Monero is more secure than both.

The labs are inspectable teaching models in a 1013 element multiplicative subgroup. They are not Monero implementations. Primary references: Zero to Monero for protocol equations, the Monero technical specification for current ring size, emission and network limits, the 2017 vulnerability disclosure for the key image flaw, and the FCMP++ milestone for activation status. Facts checked 20 September 2026.