Monero

• 1. Introduction

  ›

  Monero, traded under the ticker XMR, is a cryptocurrency engineered to hide almost everything about a transaction. It conceals who sent it, who received it, and how much moved. In 2022, a study published in FSI Digital Investigations summed up the stakes in one blunt line: "For now, Monero is untraceable. However, it is probably only a matter of time and effort before it changes." The Monero protocol obfuscates transaction details by default, though a user can choose to share a view key so someone else can audit their history. A global network of miners validates every transaction and receives new coins in return. That mix of privacy and openness has drawn cypherpunks and privacy advocates who feel other cryptocurrencies fall short. It has also drawn a different crowd. Monero is increasingly turning up in money laundering, on darknet markets, inside ransomware demands, in hidden cryptojacking scripts, and elsewhere in organized crime. Where did this coin come from, how exactly does it hide its trail, and who is trying to break it?

• 2. Anonymous Origins

  ›

  In October 2013, a presumed pseudonymous author named Nicolas van Saberhagen published a white paper describing a cryptocurrency protocol called CryptoNote v2. Van Saberhagen called privacy and anonymity "the most important aspects of electronic cash" and singled out bitcoin's traceability as a "critical flaw."

  A Bitcointalk forum user going by the name thankful_for_today turned those ideas into a coin called BitMonero. Other forum members disagreed with the direction thankful_for_today wanted to take the project, and in 2014 they forked it, creating Monero.

  The word Monero translates to "coin" in Esperanto, and its plural, moneroj, follows the same language's grammar. Both van Saberhagen and thankful_for_today have remained anonymous ever since.

  Monero has built the third-largest developer community of any cryptocurrency, trailing only bitcoin and Ethereum. Its longtime lead maintainer was Riccardo Spagni, a South African developer, though much of the core development team still works under pseudonyms.

  That founding culture of anonymity carried directly into the technical choices made for Monero's next phase: hiding not the developers, but every user's transaction.

• 3. Hiding In Plain Sight

  ›

  Ring signatures group a sender's transaction outputs together with decoy outputs, so an outside observer cannot tell which output is real. This obfuscation stands in sharp contrast to bitcoin, where every address, balance, and transaction is publicly visible.

  In 2017, developers began encrypting transaction amounts through a method called Ring Confidential Transactions, or RingCT. They later added a zero-knowledge proof method called Bulletproofs, which can confirm that a transaction happened without ever revealing its value. Recipients get their own layer of protection through stealth addresses. These are one-time public keys, generated by the sender, that a network observer cannot trace back to the receiver.

  Monero also runs a protocol called Dandelion++ to obscure the IP address of whoever is broadcasting a transaction. A new transaction first passes to a single node on Monero's peer-to-peer network. A probabilistic process then decides whether it moves to one more node or floods out to many at once.

  Those defaults are exactly what outside researchers began testing soon after Monero's privacy features rolled out.

• 4. Testing The Shield

  ›

  In April 2017, researchers identified three major threats to Monero users' privacy. The first involved transactions with a ring signature size of zero, which exposed the actual output amounts to anyone watching. The second, called "Leveraging Output Merging," tracked cases where two outputs belonged to the same user. That included times when someone sent funds back to themselves, a process known as churning. The third, "Temporal Analysis," showed that guessing the correct output within a ring signature could be easier than experts had previously assumed.

  In 2018, researchers published further findings in a paper titled "An Empirical Analysis of Traceability in the Monero Blockchain," pointing to additional possible vulnerabilities.

  In September 2020, the Internal Revenue Service's criminal investigation division offered a $625,000 bounty for contractors who could build tracing tools. The target technologies included Monero, other privacy-enhanced cryptocurrencies, the Bitcoin Lightning Network, and similar layer 2 protocols. The contract went to two blockchain analysis firms, Chainalysis and Integra FEC.

  In 2021, researchers unveiled an attack called FloodXMR at the IEEE International Conference on Blockchain and Cryptocurrency. The attack relied on specific assumptions about transaction fees and structure. It modeled how an adversary flooding the blockchain with their own transactions could, over time, deanonymize a substantial share of new transaction inputs. The researchers found this could be done at a relatively low cost.

  Those attacks targeted Monero's transaction graph, not the computational engine validating it, a separate front where the protocol was also evolving.

• 5. Mining On Ordinary Hardware

  ›

  In November 2019, Monero replaced its former mining algorithm, CryptoNightR, with a new one called RandomX. Both algorithms were built to resist application-specific integrated circuits, the specialized chips known as ASICs that dominate mining for cryptocurrencies such as bitcoin.

  RandomX lets Monero be mined reasonably efficiently on ordinary consumer hardware, including x86, x86-64, ARM processors, and GPUs. That choice reflects the Monero project's opposition to the kind of mining centralization that ASIC-dominated networks create.

  That same accessibility keeps mining decentralized. It has also made Monero popular among a very different kind of miner: malware that mines without a computer owner's consent.

• 6. Dominant On The Darknet

  ›

  On-chain data from 2024 and 2025 shows Monero's transaction volumes running significantly higher than during 2020-2021. That elevated baseline points to steady, ongoing demand rather than a temporary spike. After a wave of cryptocurrency exchange delistings in 2024-2025, trading in Monero shifted toward decentralized and peer-to-peer platforms. That shift signaled resilient demand despite the pressure.

  In August 2016, the dark web marketplace AlphaBay began letting its vendors accept Monero as an alternative to bitcoin. Law enforcement took the site offline in 2017, but it returned in 2021 with Monero as the only currency it would accept.

  A 2024 report covered by Wired found that vendors selling child sexual abuse material increasingly laundered their proceeds through Monero using instant exchangers. The blockchain analysis firm Chainalysis described Monero in that context as "the currency of choice."

  By 2025, nearly half of newly launched darknet markets operated exclusively on Monero, a sharp jump from previous years. That shift was driven largely by law enforcement's improving ability to trace bitcoin and stablecoins. That shift left markets relying only on bitcoin looking less secure, pushing more users toward Monero-only platforms that better shield them from financial surveillance.

  White House Market, a darknet marketplace that ran from 2019 to 2021, became a prominent example. It trafficked fentanyl and cocaine while processing its transactions in Monero. The platform was referenced in multiple federal indictments. Even after it closed, subsequent darknet markets kept adopting Monero-only models that users considered harder to trace.

  The United States Department of Justice and Treasury Department have identified Monero as a frequent tool in darknet and ransomware-related money laundering. They note that sanctioned exchangers have processed hundreds of millions of dollars in XMR.

• 7. Malware And Ransom

  ›

  In late 2017, malware and antivirus providers began blocking Coinhive, a JavaScript tool that let websites and apps mine Monero directly through a visitor's browser. Coinhive positioned itself as an alternative to advertising. A site could embed the script, use a visitor's CPU to mine coins while they browsed, and keep a percentage of what was mined. Some sites and apps ran the script without telling visitors, or let it consume all available system resources. That prompted ad blockers, antivirus tools, and antimalware services to block it outright.

  Before the crackdown, Coinhive had turned up hidden inside Showtime-owned streaming platforms and inside Starbucks Wi-Fi hotspots in Argentina. In 2018, researchers found a similar strain of malware that mined Monero and funneled it to Kim Il-sung University in North Korea.

  According to CNBC, Monero was used in 44% of cryptocurrency ransomware attacks during the first half of 2018.

  The group behind the 2017 WannaCry attack, which the US government attributed to North Korean actors, tried converting its bitcoin ransom into Monero. Ars Technica and Fast Company reported the exchange succeeded, though BBC News reported that ShapeShift, the service the attackers allegedly used, denied any such transfer. The Shadow Brokers leaked the exploits later used in WannaCry, despite having no apparent role in the attack itself. The group started accepting Monero as payment later in 2017.

  In 2021, CNBC, the Financial Times, and Newsweek reported rising demand for Monero. That followed the US government's recovery of part of a bitcoin ransom paid in the Colonial Pipeline attack. That May 2021 hack forced the pipeline operator to pay $4.4 million in bitcoin. Federal authorities recovered a large portion of it the following month. DarkSide, the group behind the attack, normally accepted payment in either bitcoin or Monero. It charged a 10-20% premium for bitcoin because of its greater traceability risk. Ransomware group REvil dropped the bitcoin option entirely in 2021, demanding Monero only. Negotiators who help victims pay ransoms have contacted Monero's developers directly to understand the technology.

  Even so, CNBC reported that bitcoin remained the currency demanded in most ransomware attacks, since insurers refuse to cover Monero payments over traceability concerns.

• 8. Falling Out Of Favor

  ›

  Exchanges in South Korea and Australia delisted Monero and other privacy coins under regulatory pressure. That made it harder for users to trade Monero for fiat currency or other cryptocurrencies.

  In 2018, Europol director Rob Wainwright wrote that the coming year would see criminals shift from bitcoin toward Monero, along with Ethereum, Dash, and Zcash. Bloomberg and CNN both reported that the shift in demand traced back to authorities getting better at monitoring the bitcoin blockchain.

  On the 20th of February 2024, the exchange Binance delisted Monero, citing regulatory compliance. That delisting removed one of the largest, most liquid exchanges willing to list Monero, leaving fewer easy on-ramps between Monero and other currencies.