Can Monero Be Traced? Bitcoin Chain Analysis vs Monero
Can Monero be traced? Not by the method that traces Bitcoin. A payment on the current chain hides the sender in a ring of 16, the receiver behind a one-time address, and the amount with RingCT. Bitcoin chain analysis has no graph to walk. The traces that stick are off the chain: the exchange account that bought the coins, the node that saw your IP, and any proof you later hand to someone who already knows your name.
The 2018 percentages still circulating measured a chain on which most inputs had no decoys. The IRS later paid two firms to try again, and closed those contracts out without a public method for today's rules. Neither fact is a trace of a payment made since the August 2022 upgrade.
How Bitcoin Gets Traced
Bitcoin gets traced because every payment publishes the sender, the receiver, and the amount, and those payments are one graph back to January 2009.
The unit on that graph is an unspent output. A payment consumes old outputs and writes new ones. When several inputs are spent in the same transaction, chain analysis treats them as one wallet. That heuristic has a name, common-input-ownership, and it is the backbone of the business. The output that is not the payment is read as change coming back to the sender, so the next hop is already labeled as yours. A coin that once touched a flagged output keeps that history. The word for the stain is taint, and it does not expire.
Firms such as Chainalysis and Elliptic sell that graph to exchanges and to police. They do not need a broken signature. The ledger is the product. A new address per payment slows a human reading the page. It does not remove the inputs that were spent together, and it does not remove the withdrawal that left an exchange account with a name on it.
A market deposit address paid by hundreds of customers becomes a labeled dot on the same graph. Once an investigator has that dot, every Bitcoin payment into it is a line they can walk backward. That is the record a Bitcoin checkout on a market leaves, and it is still there after the market is gone.
The Name Attaches at the Exchange
The name attaches where the coins meet an account that already has a passport scan. That place is the KYC exchange, not a middle block of the chain.
A withdrawal from that account to an address you control is the last labeled hop. On Bitcoin, everything after it can be followed until the coins touch another labeled hop: a second exchange, a broker, or a market address the analyst has already clustered. The chain in between is not anonymous. It is unnamed, which lasts until one end gets a name.
Monero cuts that graph at the withdrawal. The exchange still knows the customer bought or withdrew XMR, and it keeps that record under its own retention rules. What it cannot hand an investigator is the onward path, because the onward path was never written down. Sending the withdrawn coins straight to a market from the exchange itself skips the cut. The exchange sees the destination, or sees a withdrawal that lands where the market told you to pay. The acquisition steps exist so the coins leave the named account into a wallet you run before anyone asks to be paid.
Swapping back the other way reopens a public ledger from the swap forward. Monero in the middle breaks the Bitcoin history. It does not make the exchange account you cash out into a stranger.
What a Monero Transaction Hides
A Monero transaction spent today hides the three fields Bitcoin publishes, and it hides them on every payment, with no setting to turn them off.
| Bitcoin | Monero | |
|---|---|---|
| Sender | The address that signed the input | One member of a ring of 16 |
| Receiver | The address written on the output | A one-time stealth address. The wallet address is not on the chain |
| Amount | The exact number of satoshis | Hidden by RingCT |
| Where a name joins | A KYC exchange, then the graph | A KYC exchange, or a node that saw the IP. The graph is not there to walk |
Ring signatures are the sender's cover. Since the August 2022 upgrade the ring size is 16: the output you actually spend, plus 15 decoys the wallet picks. An observer can say the real spend is one of those 16. The signature does not say which. The network is still on that protocol, version 16. A replacement called FCMP++ would prove membership in the whole set of outputs instead of a ring of 16. It is running on a test network with worthless coins. No mainnet date has been set. A payment you send today is still a ring of 16.
Stealth addresses are the receiver's cover. The transaction writes a one-time output. The address you gave the payer, and any subaddress your wallet showed you, does not appear in the transaction. Two payments to the same wallet do not share an on-chain address an analyst can group. The grouping, if it happens, happens inside your wallet or inside an exchange's database.
RingCT hides the amount. It was optional from January 2017 and mandatory from the September 2017 upgrade. Before that, amounts were public, and matching denominations made the decoy pile smaller. Amount privacy is why a modern output cannot be priced by eye, and why the old denomination trick has nothing to grip.
The network layer is a separate cover, and a thinner one. Dandelion++ relays a new transaction so the first clearnet node is not obviously the sender. It blurs a hop. It does not hide you from a node you chose to talk to. Turning on Tor or I2P in the wallet, before the first sync, is the control you actually have. The short version of this split sits in the Monero versus Bitcoin note on the directory.
What the Tracing Claims Actually Showed
The claims people repeat are about an older chain, or about a tool whose maker never showed the working.
The 2018 traceability paper measured Monero before RingCT inputs, up to the height it studied. On that chain, 64% of all inputs used no decoys at all. They named the output they spent, the way Bitcoin does. Those naked spends then poisoned other people's rings: a decoy that was already spent in the open could be crossed off. Among inputs that had at least one decoy, about 62% could be deduced by that elimination. On the inputs deduced that way, the real one was the newest member of the ring 92% of the time. The authors estimated the same "guess the newest" rule would be right about 80% of the time across all inputs that had decoys. They also estimated that more than 200,000 transactions from July 2016 to February 2017 were affected.
Those are real numbers, and they describe a sampler and a rule set that are gone. RingCT became mandatory in September 2017. The ring later grew, and the way the wallet picks decoys was changed because the age pattern was so obvious. Quoting 62% or 80% against a payment made under a fixed ring of 16 is how a headline gets a number the chain no longer supports.
CipherTrace's press release of 21 August 2020 announced "the world's first Monero tracing capability," built in part under a US government contract. In the public conversation that followed, the CEO, Dave Jevans, described a statistical model that narrows candidates and produces leads. Asked by Sarang Noether, of the Monero Research Lab, what the math was and whether the tool named the true signer or only scored a likelihood, he did not produce the method. A likelihood with no published error rate is a lead for an investigator who already has other evidence. It is not a block explorer.
The IRS came at the same problem with a contract, not a break. On 30 September 2020 it awarded Chainalysis and Integra FEC up to $625,000 each, $1.25 million between them, to pilot tracing of Monero and of second-layer Bitcoin payments. The Chainalysis award obligated $625,000, and Integra's matching award did the same. Both were closed out in the first quarter of 2022. Nothing published from that pilot lets a reader point at one member of a ring of 16 and show the spend. Paying for the attempt is what an agency does when the obvious tools fail. It is not a receipt for a solution.
Where a Monero Payment Still Leaks
A Monero payment leaks at the computer, the node, and the on-ramp. Those are the places the cryptography does not cover, and they are where real cases get made.
A remote node sees the IP of whatever connected to it, unless that connection is over Tor or I2P. It sees that a wallet is syncing. It does not, from the sync alone, learn your address. A light service you hand your view key does learn the incoming payments, because the view key is what scans for them. Those are two different mistakes. "I used a remote node" and "I gave a website my view key" should not be filed as the same event.
The exchange record survives the privacy of the chain. If the account that bought the XMR is in your name, the purchase is in your name. The chain after the withdrawal does not show the market, the vendor, or the amount of the next hop. The bank-side record of the buy is still a record. Cashing out later, into a deposit address the exchange gave that same account, tells the exchange that this named customer paid them in XMR. It does not unlock the earlier history. It does put the name on that one payment.
A transaction proof does the identifying for them. The tx key, or the proof the wallet exports, shows one specific payment to whoever you send it to. A vendor who demands it, or a support ticket you paste it into, has been shown that payment on purpose. The chain did not leak. The clipboard did.
The seed leaks the rest of the wallet at once. Whoever has the words spends every output the wallet will ever have, and the ring signatures are irrelevant. A photo of the card in a camera roll is the usual way that happens. The offline copies are covered in how to store a seed phrase offline.
Own Wallet, Tor On, No Direct Exchange Payment
Hold the coins in a wallet you run, turn Tor on before the first sync, and pay from that wallet. A withdrawal that goes from the exchange straight to a market never gets the protection the chain is capable of.
Your own node is the cleanest view of the chain, because nobody else's server sees the sync. A remote node reached over Tor is the workable substitute, and it is still a stranger's server: it can lie about the data, and it can go offline. It should not be given the view key. The routes into the wallet, including the swap off Bitcoin before the coins are spent, are the acquisition steps.
"Untraceable" is the wrong word for any of this. The accurate one is narrower. Bitcoin chain analysis has a public graph, and a current Monero payment does not add an edge to it. Investigations that succeed start from a name, a server log, or a proof someone volunteered. DrugHub dropping Bitcoin entirely is one market deciding that the graph is not an acceptable payment rail. The coin does not finish the job if the wallet is syncing in the clear from a machine with your seed on the desktop.
Tracing Questions
Can Monero be traced?
A Monero payment made under the current rules cannot be followed the way Bitcoin can. The sender is one of 16 ring members, the receiver is a one-time address, and the amount is hidden. Tracing that does stick starts off the chain: a KYC exchange account, a remote node that saw your IP, or a payment proof you handed to someone. The often-quoted percentages from 2018 describe the chain from before RingCT was mandatory.
Is Bitcoin anonymous?
No. Every Bitcoin transaction since 2009 shows the sending address, the receiving address, and the amount. Chain analysis treats coins spent in the same transaction as one wallet, follows the change output, and attaches a name where the coins touch a KYC exchange. A fresh address slows the work. It does not delete the ledger.
Did the IRS crack Monero?
No published method from the IRS pilot picks the real signer out of a ring of 16. On 30 September 2020 the IRS awarded Chainalysis and Integra FEC up to $625,000 each, $1.25 million between them, to pilot Monero tracing. Both contracts were closed out in the first quarter of 2022. The money says the problem is hard. It does not say the problem was solved.
Is Litecoin private?
No. Litecoin is a public ledger in the same shape as Bitcoin, and chain analysis treats it that way. An optional extension, MWEB, can hide coins that were moved into it. A market deposit address is an ordinary Litecoin address, so the payment the market sees is the public one. Catharsis and Omega take Litecoin as a convenience coin. Privacy is not what it adds.