Monero Ring Signatures Explained: How XMR Hides the Sender

On Bitcoin, anyone can see which coin was spent and follow it from one transaction to the next. Monero breaks that trail with ring signatures, which hide the coin being spent among a group of other coins taken from the blockchain. This guide explains how rings work, what key images do, and where the ring model falls short.

The core idea: “one of us signed this”

A ring signature lets someone sign a message on behalf of a group without revealing which member signed. Anyone can check that the signature came from one of the group’s keys, but working out which one is computationally infeasible.

Three things make this useful for a cryptocurrency:

• No setup is needed. The group, or “ring”, can be put together on the spot. The other members never agree to take part and never find out.
• Anonymity cannot be revoked. No master key exists that could later reveal the real signer.
• Every member is equally plausible. To the verifier, each ring member looks like it could be the signer.

In Monero, ring members are outputs: earlier transaction outputs already recorded on the blockchain. When you spend an output, your wallet adds other outputs as decoys and signs for the whole set.

How a Monero ring works, step by step

Say your wallet holds one output worth 2 XMR and you want to pay a merchant. In simplified form:

1. Your wallet picks the real input. This is the output you own and are spending.
2. It selects 15 decoys. These are other outputs from the blockchain, chosen by a decoy selection algorithm that favours recent outputs, because recent ones are the most likely to be spent in real life.
3. It builds a ring of 16. The real output and the decoys are placed together.
4. It signs. Using the private key of the real output, the wallet produces a signature that verifies against all 16 public keys.
5. It attaches a key image. This one-way tag, explained below, prevents double spending.
6. Nodes verify. Each node checks that the signature is valid for the ring and that the key image has never appeared before.

Every input in a transaction gets its own ring. A transaction spending three outputs contains three rings of 16, and every one of them has to verify.

Key point: Decoys are not “fake coins”. They are real outputs that belong to other people. The ring only claims that one of them is being spent, and the rest of the protocol makes sure no extra money is created.

Key images: stopping double spends without revealing anything

If nobody can see which output was spent, what stops someone from spending the same output twice in two different rings?

The answer is the key image. When your wallet spends an output, it computes a value from that output’s private key, written as I = x · Hp(P), where x is the private key and Hp(P) hashes the public key to a point on the curve. The key image has three important properties:

• Deterministic: the same output always produces the same key image, no matter which decoys surround it.
• Unlinkable: given only the key image, you cannot tell which ring member it came from.
• Bound to the signature: the ring signature proves the key image was made with the real signer’s key, so it cannot be forged or swapped.

Every node keeps a list of key images it has already seen. If a new transaction contains a key image that already exists, nodes reject it as a double spend. This is why ring signatures in Monero are called linkable: two signatures by the same key can be linked to each other, but not to the key itself.

Note: Key images are also why a view-only wallet cannot normally tell when you have spent money. Computing a key image needs the private spend key, which a view-only wallet does not have.

From MLSAG to CLSAG: how the signature scheme evolved

Monero’s ring signatures have been upgraded several times. The underlying idea has stayed the same, while efficiency and the ring size have improved.

CLSAG (Concise Linkable Spontaneous Anonymous Group signatures) took effect in the network upgrade of 17 October 2020. The project expected it to cut typical transaction size by about 25% and improve verification by about 10%. It does the same job as MLSAG with less data per ring member.

The August 2022 upgrade raised the ring size from 11 to 16, which the Monero Project called the largest ever absolute increase in the base anonymity set.

Why is the ring size fixed?

It might seem that letting privacy-conscious users pick a ring of 50 would help. It would actually hurt them. If almost everyone used 16 and you used 50, your transactions would stand out from everyone else’s. Fixing the ring size means every transaction looks the same from the outside, so everyone shares one large crowd.

The cost explains why the ring size was never set much higher. Each ring member adds data to the transaction and work for verifiers, so size grows roughly linearly with the ring. Doubling the ring makes signatures roughly twice as big and twice as slow to verify.

What ring signatures protect, and what they do not

Ring signatures are one of three layers in Monero’s on-chain privacy:

Rings handle only the sender side. They do nothing to hide your IP address when you broadcast a transaction. That is the job of network-level tools such as Dandelion++, Tor and I2P, covered in our Privacy & OpSec section.

The known weaknesses of rings

Rings give plausible deniability, not certainty. Researchers have documented several ways the effective anonymity of a ring can drop below 16.

1. Decoys that do not look like real spends

If decoys are picked from a different age distribution than the one people actually spend from, statistics can help an observer guess the real one. Research published on getmonero.org in April 2025 (the OSPEAD project) estimated that an adversary using the best available timing analysis would guess the real spend correctly about 1 time in 4.2 at ring size 16, against a baseline of 1 in 16. The same write-up stresses that the best guess is still usually wrong and that the attacker cannot confirm when a guess is right.

2. Implementation bugs

In 2023 the project disclosed a bug: from v0.13.0.2 to v0.18.2.1, the reference wallet never picked decoys that were exactly 10 blocks old. A ring containing a 10-block-old member therefore often revealed the real spend. The bug was fixed in v0.18.2.2. Keeping your wallet up to date matters.

3. Chain reactions and flooding

If an attacker owns many outputs on the chain, for example by spamming the network with their own transactions, they can rule out their own outputs whenever those appear as decoys. Fewer plausible members leaves a smaller effective ring. This “black marble” scenario is covered in our decoy selection guide.

4. Behavioural patterns

Rings cannot hide patterns you create yourself. If you receive coins from an exchange and send exactly the same amount straight back, timing and context may point to you even though the cryptography holds. See the Privacy & OpSec category for practical habits.

Warning: Ring signatures are strong in combination with the rest of the protocol and good habits. They are not a guarantee against an attacker who also has exchange records, network surveillance or control of the node you connect to.

Why Monero is moving past rings: FCMP++

Every weakness above comes from one design choice: the anonymity set is small (16) and chosen by the sender. If the set were every output on the chain, decoy selection would stop mattering.

That is the goal of Full-Chain Membership Proofs (FCMP++). Instead of signing for a ring of 16, the spender proves in zero knowledge that the spent output is somewhere in the full set of eligible outputs on the chain, which runs to well over a hundred million. Key images remain, so double-spend protection works the same way.

FCMP++ is still in testing. In November 2026 it runs on a public beta “stressnet”, and no mainnet activation date has been announced. Our separate FCMP++ guide in this category explains the design and its current status.

Common misconceptions

“Decoys mean other people’s coins get spent.” No. Only the real input is consumed. Decoys are referenced, not moved, and their owners are unaffected.

“If my output is used as a decoy, someone can link me.” Being a decoy in someone else’s ring reveals nothing about you. It actually adds plausible deniability to your own outputs, because they appear in many rings.

“Bigger rings would fix everything.” Bigger rings help, but they grow transactions linearly and leave the decoy selection problem in place. The long-term fix is an anonymity set covering the whole chain.

“Ring signatures hide amounts.” Amounts are hidden by RingCT, a separate layer. Rings hide which output was spent.

Summary

Ring signatures let a Monero wallet prove that it spent one of 16 outputs without saying which. Key images make double spending impossible while keeping the real input hidden. CLSAG made this efficient, and the 2022 upgrade raised the ring to 16 members. The model still has statistical weaknesses, which is why the community is working toward FCMP++ to make the whole chain the anonymity set.

For more fundamentals, browse Monero Basics or the rest of the Technology category.