Is Monero traceable? Sender privacy is a ring of 16, and the IP is a separate problem
Is Monero traceable? Not the way Bitcoin is, and not "never." Monero's technical specs, last modified 19 October 2026, split the promise into three: sender privacy is probabilistic, from a ring of 16, and recipient privacy and the amount are marked strong. The page title on the FAQ still says "untraceable." The FAQ body does not: "There is no such thing as 100% anonymous," the anonymity set is the people using Monero, and "attacks only get better." The leaks that put a name on a payment are mostly off the chain. An exchange that collected identification, a remote node that saw your address, and the IP that broadcast the transaction. Ring signatures do not cover those.
What the chain hides, in the project's own words
| Who or what | The tool | The assurance they print |
|---|---|---|
| Sender | Ring signatures, ring size 16, meaning 15 decoys | Probabilistic. Plausible deniability. |
| Recipient | Stealth addresses | Strong |
| Amount | Ring confidential transactions (RingCT) | Strong |
| Your IP | Not part of those three. A remote node has no IP protection by default. Full protection means wrapping the node with Tor yourself. | A separate job |
The FAQ's plain version is that ring signatures, RingCT and stealth addresses hide the sender, the amount and the receiver, that every transaction is private by mandate, and that you cannot accidentally send a transparent one. That "hide the sender" sentence is looser than the specs. The specs are the ones that say the sender's protection is a probability. Use the specs when the two pages disagree. The FAQ is right about the mandate: there is no public Monero payment the way there is a public Bitcoin payment.
How the three work, without the paper. A ring signature spends one output you own and points at 15 others you do not, and the signature is valid for the set. An observer who sees the transaction sees 16 candidates. Sixteen is the current ring size, 15 of them decoys. Probabilistic means the real one is in there and the math does not name it. It does not mean a later, better analysis cannot shrink the set. The FAQ's seatbelt line is this: the protection can fail, and future attacks get better.
A stealth address is a one-time destination derived for that payment. The recipient's wallet scans the chain with a view key and recognises what is theirs. The chain does not show the recipient's long-term address the way a Bitcoin address is reused in public. RingCT hides the amount in the same transaction, so the chain does not show what moved. Those two are the rows marked strong. Strong is the project's word. It is not a certificate that no one will ever narrow them.
Is Monero more private than Bitcoin?
Monero vs Bitcoin is a difference in the default, not a feature you turn on. On the chain, Monero is the more private of the two. Bitcoin's ledger is public: amounts, addresses and the links between them are there for anyone to cluster, and a name arrives when one of those addresses touches an exchange or a shipment. Monero does not publish that graph. Privacy Guides, whose cryptocurrency page was last modified 12 August 2026, says an outside observer cannot read Monero addresses trading, amounts, balances or histories. You do not opt in. The FAQ calls that mandate exclusive to Monero.
The honest subtraction is the sender's ring, and the things that were never on the chain. The same Privacy Guides page says transaction-graph privacy is limited by those relatively small rings, especially against a targeted attack, that severe bugs have been found and patched, and that the privacy claims have not been proved one way or the other. Bitcoin's problem is a public history plus a sloppy next payment. Monero's problem is a small anonymity set on the sender, plus every time you tell someone who you are. "Monero is not magic. If you use Monero but give your name and address to another party, the other party will not magically forget your name and address." Giving the exchange your passport is that sentence. Zcash is not this comparison. Privacy there is a property of the address you used, not of every payment, and Monero vs Zcash is the page that draws that line.
The exchange, and the node, are where a name gets attached
Does buying Monero on a KYC exchange ruin the privacy? It attaches your legal name to the purchase, and to the withdrawal the exchange sent. Privacy Guides' reading of the chain after that is specific: the seller knows you bought Monero, and does not know how much you hold or where you spend it once it has left. For Kraken, their advice is to move the coins off it into a wallet you hold the keys to. The withdrawal is the last transaction the exchange can see as its own. What you do with the coins after that is the ring, the stealth address and the amount hiding, unless you send them back to a place that knows you, or you spend them in a way that identifies you off the chain. Leaving them on the exchange means there is no privacy at all. The company has the balance and your name, and Monero's cryptography is not in the path.
A remote node is the other desk. The FAQ says the operator can see the IP a transaction comes from, cannot see the recipient or the amount, and in extreme cases can run attacks that reduce your privacy. The docs, also modified 19 October 2026, are tighter. A remote node does not get your spend key or your wallet file, and it cannot decrypt amounts. It can learn your IP, the transactions you send, and which outputs those transactions spend. If you mark the node trusted, it can also learn which outputs you own, because key-image checks and targeted scans go only to a trusted node. Some wallets, the docs name air-gapped ones, need a trusted node and so reveal those outputs. A dishonest node can hand you biased decoys and weaken the ring. Is a remote node dangerous? A clearnet one you do not run is the leaky default. A hidden-service node hides your IP from the operator and still shows the operator your transactions.
| How you connect | Who learns the link |
|---|---|
Your own node, with --proxy and --tx-proxy |
Nobody, in that guide's column. Peer traffic and your own transactions go over the anonymity network. |
Your own node, with only --tx-proxy |
Your transactions go over Tor or I2P. Syncing blocks still uses the clearnet, so peers can see that your IP runs a node. |
| Someone else's node, over a Tor or I2P hidden service | The operator sees the transactions and not your IP. |
| Someone else's node, plain clearnet | The operator, and anyone on the path. The guide says avoid it. |
| A remote node through a VPN | The VPN provider sees your real IP. The node sees the VPN's address. |
Dandelion++ is the propagation trick the specs mention, and they are explicit about its edge: it does not protect you from your ISP or from the first remote node the transaction is sent to. Running a node at home without Tor means your provider can see that you run Monero. The FAQ says that outright. The node is safer than a stranger's node. It is not invisible.
Using Monero over Tor or I2P
The current instructions and the old ones disagree, and the dates are why. The FAQ still says Tor support "is still in its infancies," that you can already send transactions natively over Tor and run a daemon on Tor, and that better Tor and I2P integration is in progress. The remote-node page, last modified 19 October 2026, tells you to broadcast with --tx-proxy and to put the rest of the node's traffic through --proxy as well. Follow the docs page. The FAQ's "infancies" sentence is older than the flags.
There is a separate wallet guide for connecting to your own node's onion. It was tested, by its own note, with Monero v0.15.0.1. It says the example does not put peer-to-peer traffic over Tor, only the wallet's RPC connection, and that trying the graphical wallet under torsocks "may leak info" and should not be relied on if anonymity is life-or-death. That guide is a 0.15-era recipe. It is not the --tx-proxy setup. If a tutorial still leads with torsocks and a hidden service on port 18081, check it against the remote-node page before you trust it. I2P is in the same docs sentence as Tor: connect to a hidden service, or wrap the daemon. The old wallet guide does not give I2P steps.
Tor on the node does not fix the exchange, and it does not fix a ring. It fixes the IP on the broadcast. How that sits next to the rest of holding crypto is the wider page. This one is the coin.
What CipherTrace claimed, and what a 2026 paper actually tested
Monero's own FAQ and docs never mention CipherTrace. Privacy Guides is the account that names it: in August 2021 CipherTrace announced enhanced Monero tracing for government agencies, and public postings show FinCEN licensed a "Monero Module" in late 2022. That is Privacy Guides describing the company's announcement, not a method you can read, and not a Monero project concession. Their conclusion on the same page is the one to keep: mass surveillance of the Bitcoin kind is unlikely, targeted tracing tools are a real possibility, and the claims are not settled. A vendor saying it can trace Monero is a press release until someone publishes the attack. The ring of 16 is why a press release is not absurd. It is also why the press release is not a proof.
The paper people will wave at "Monero over Tor" in 2026 is a preprint. Ruisheng Shi, Shihan Zhang, Yulian Ge, Lina Lan, Qingfeng Zhang and Qin Wang, "Deanonymizing Monero Transactions in Tor Network," arXiv:2607.07062, submitted 8 July 2026. It is not a journal article. An abstract version went to a WWW 2024 workshop under a different author list. The claim is not that RingCT broke. They say Monero's Tor integration forwards a node's own transactions to two outgoing Tor hidden-service peers before the clearnet, so an adversary who occupies those connections can catch the transactions the node originated, and they build a three-stage attack they call ProxyMark, including linking a Tor node to an IP. They also write the limit: the target has to be using Monero over Tor, the attacker has to run hidden-service peers that fill the target's connections, and the IP step needs an adversarial Tor relay chosen as the entry guard. "Not as a claim that every Monero-over-Tor transaction is automatically deanonymized."
Read that next to the docs, not instead of them. The project already tells you that Tor on the transaction broadcast is what hides the IP, and that the first hop still matters. The preprint is a 2026 argument that the way a node picks its Tor peers can mark the transactions it created, if the attacker is in a position the paper spells out. It is one group's experiment, with the versions they name (Monero v0.18.3.1 in the tests they describe). It is not a dashboard a stranger can point at your wallet. It is a reason not to treat "I turned on Tor" as the end of the IP problem, and not to treat the paper as proof the amounts are public. The amounts are the RingCT row. This attack does not claim that row.
Delistings, full-chain proofs, and which wallet keeps the view key
Why have exchanges delisted Monero? The clearest case is Kraken's, for Europe, and it does not describe a tracing breakthrough. Kraken's notice, last updated 31 March 2025, says it delisted XMR in the European Economic Area "due to regulatory changes," after deciding it had no workable alternative. Trading and deposits for EEA clients stopped on 31 October 2024 at 15:00 UTC. Withdrawals ran until 31 December 2024. Coins still there were converted to bitcoin, and that bitcoin was distributed by 6 January 2025. Privacy Guides notes Monero is not available in every jurisdiction Kraken operates in. One exchange's regulatory exit is not a statement that the chain became transparent. It is a statement that the on-ramp closed. The FAQ's line on exchanges is only that some require identification and some, including decentralized exchanges, do not. A decentralized exchange moves the identification problem. It does not delete the IP problem or the ring.
What is FCMP++, and when does it go live? It is the planned replacement for the ring of 16. Full-chain membership proofs let a spend point at any output on the chain instead of at 16 candidates, which would remove the probabilistic sender row in the table above. It is not live on the main network. The third beta of its test network, a separate chain, forked on 5 October 2026, and the developers were still asking for testers. The roadmap lists "Full-Chain Membership Proofs" under Coming Soon, with no date. Until a main-network fork is announced and your wallet has upgraded, the assurance you have is the ring of 16, and anything that quotes a launch date is guessing.
Which wallets keep the view key on the device? Privacy Guides names four self-custody wallets where the view key does not leave the device: the official client, Cake Wallet, Feather, and Monerujo. The other kind is a lightweight wallet. The FAQ says it gives the view key to a node, which learns when you receive money, and does not learn the amount, the sender, or where you send. For more privacy, the FAQ says, use a normal wallet on your own node. The exchange's wallet is neither: the coins are in their books. Which of the four to open, the seed that is not always 25 words, and the hardware lists that disagree, are the next section. A cold wallet, Electrum, and a node reached over Tor are a different choice, for where any coin sits.
The FAQ's list of ways to lose is the right last pass: hand over a secret key, get keylogged, pick a weak password, put the seed in the cloud. None of those are a failure of ring signatures. They are how a private chain becomes a named person anyway. The chain is the part Monero changed. The computer, the exchange and the node are the part you still have to get right, and the sender's ring is the part the project itself refuses to call certain.
The best Monero wallet is the one that keeps the keys
The best Monero wallet is not the one that opens fastest. A large balance belongs on the official GUI, with your own node. A desktop you use most days is Feather. A phone is Cake Wallet, or Monerujo if you want Android and a wallet whose site talks about Monero and nothing else. Hot versus cold, and Electrum, are not this choice. They are on the wallet page.
- The amount is large, and you can leave a node running
- The official GUI, from getmonero.org/downloads. Simple mode connects to a remote node by itself. Advanced mode is the one with your own node, and pruning downloads a third of the chain. Current version on that page: 0.18.5.4, Fluorine Fermi.
- A desktop, and you will not run a node
- Feather. Its comparison marks built-in Tor and coin control as present, and a local node manager as absent. The homepage lists 2.8.1, for Linux, Tails, Windows and macOS.
- A phone
- Cake Wallet on iOS or Android. It also holds other coins. Monero.com, which Cake Labs says it runs, offers a Monero-only build, and the same page says the project site is getmonero.org, not Monero.com. Monerujo is the Android wallet whose homepage is Monero features, a custom node, and a Ledger on a USB cable.
- The spend key should not live on the computer
- A Ledger or a Trezor, opened through one of those apps. Trezor Suite itself does not support Monero. The device is not a wallet you open on its own.
| Official GUI | Feather | Cake Wallet | Monerujo | |
|---|---|---|---|---|
| Site | getmonero.org/downloads | featherwallet.org | cakewallet.com. Monero-only build: monero.com | monerujo.app |
| View key | Privacy Guides names these four as wallets where the view key stays on the device. The download page files Cake, Feather and Monerujo under local sync: they scan on your device and do not share a key with the node. The other pile on that page is a lightweight wallet. The name it puts there is Edge, which shares the private view key with a remote server. | |||
| Node if you change nothing | Simple mode picks a remote node. Advanced mode is where you run one. | No local node manager. You are on a remote node until you point it at your own. | In the v6.5.0 node list, the default is Cake's own node, xmr-node.cakewallet.com. You can replace it. | A curated list, a node you add, or a scan for open public nodes. The homepage does not name one default host. |
| Tor | Feather's table marks built-in Tor as absent on the GUI and the CLI. The CLI download page still lists transactions over Tor or I2P, which is the setup in the Tor section above, not a switch in the GUI. | Built-in Tor: yes. | The node list includes an onion node that connects only while Tor is on. The address is on that docs page. | The homepage does not describe a Tor switch. |
| Seed a new wallet creates | The restore guide calls a valid seed 13, 14, or 25 words, and the GUI steps say to type the 25-word seed. | Polyseed. Feather can also restore 14-word and 25-word seeds. Its footnote says that as of 1.0.0 only English is supported for Polyseed. | The MyMonero shutdown notice told people making a new Cake wallet to use Polyseed, and described a separate 12-word BIP-39 seed for holding other coins in Cake. | Not stated on the homepage. |
Polyseed is 16 words. The phrase carries an approximate creation date so the wallet knows where to start scanning. Sixteen is not in the GUI restore guide. Feather can take a 25-word seed. A Polyseed created in Feather is not what those 25-word steps tell you to type. The GUI page also has a seed-offset field: the words plus a passphrase compute a different wallet. Polyseed offsets work the same way. Lose the passphrase and the words alone restore an empty wallet.
MyMonero has closed. You can no longer see a balance or send through it. The letter on that site said the service would end on 6 January 2026 because light wallets that hold view keys were at odds with where Monero was going. It said those view keys would not be handed to Cake, and that server data, including the view keys, was to be destroyed within 30 days, which the letter dated 6 February 2026. The page now up says those destruction sentences describe the plans announced at the time. A MyMonero seed is the 25-word kind. The letter's line that it works in a Monero wallet is about that seed, not about a Polyseed.
The spend key stays on the Trezor. A Trezor backup is not a Monero seed you type into Feather. Trezor derives the Monero keys with SLIP-0010, and it says another brand can derive them differently and not find the funds. The recovery it promises is another Trezor that supports Monero.
- The project's download page: Ledger Nano S, Nano S Plus and Nano X, with the GUI, the CLI, Cake, Feather or Monerujo. Trezor Model T, Safe 3 and Safe 5, with the GUI, the CLI or Feather. Cake and Monerujo are not in that Trezor row. Safe 7 is not on the page.
- Trezor's page: Cake on iOS for the Safe 7. Cake on Android for the Safe 7, Safe 5, Safe 3 and Model T. The GUI and CLI for the Safe 5, Safe 3 and Model T. Model One does not support Monero. The GUI setup guide says the GUI does not support the Safe 7 or the Model One.
- Feather adds the Ledger Stax and Flex, and says the Safe 7 is not supported, because the device uses a protocol Feather says is not in the Monero code yet.
Buy the device that appears on the page of the app you will open. A Safe 7 is a Cake wallet on Trezor's telling, and it is not a Feather wallet on Feather's. Trezor also says Exodus no longer supports Monero. It does not date that. Monerujo's homepage names the Ledger Nano S series, on a USB OTG cable, and does not mention Trezor.
GUI and CLI only from the downloads page. It tells you to check the hash, and it says a corrupted archive can cost you the funds. The canonical list is the GPG-signed hashes.txt. Feather from featherwallet.org, Cake from cakewallet.com, the Monero-only build from monero.com, Monerujo from monerujo.app. Write the seed on paper before you receive anything you care about. Monero.com offers a cloud backup. That copy sits behind a login. Then send a small amount, wait until it shows, and only then move the rest.