RingCT and Bulletproofs+ Explained: How Monero Hides Amounts

Hiding who sent and who received a payment is only part of the job. If amounts were visible, an observer could still match a 3.14159 XMR output to a 3.14159 XMR withdrawal and link them. Monero hides amounts with RingCT (Ring Confidential Transactions) and keeps transactions compact with Bulletproofs+ range proofs. This guide explains how nodes can verify a transaction whose numbers they never see.

A short history of hidden amounts

Monero did not always hide amounts. In its early years, outputs were split into standard denominations (like 0.01, 0.2, 3 XMR) and amounts were visible on-chain.

Since September 2017, every non-coinbase transaction on Monero has hidden its amounts. Users do not have to opt in.

The building block: Pedersen commitments

A commitment is like a sealed envelope: you put a value inside, everyone can see the envelope, and later you can prove what was in it. You cannot change the contents once sealed (binding), and nobody can peek inside (hiding).

Monero uses Pedersen commitments:

C = x·G + a·H

• a is the amount, for example 2.5 XMR expressed in atomic units.
• x is a random secret called the blinding factor (or mask).
• G and H are two fixed points on the curve, chosen so that nobody knows the relationship between them.

The blinding factor makes C look random. Two outputs with the same amount have completely different commitments, so an observer cannot even tell when amounts are equal.

The trick: commitments add up

Pedersen commitments are additively homomorphic:

C(x1, a1) + C(x2, a2) = C(x1 + x2, a1 + a2)

Adding two sealed envelopes gives a sealed envelope containing the sum. This lets nodes check arithmetic on values they cannot see.

How a node checks the balance without seeing it

A valid transaction must not create money: the amounts going in must equal the amounts going out plus the fee. With commitments, a node checks:

sum(input commitments) − sum(output commitments) − fee·H = 0·H

If the amounts balance, the H parts cancel and only a combination of blinding factors on G remains. The sender arranges the blinding factors so that this leftover is zero too, or proves knowledge of it as part of the signature.

Pseudo-outputs: why rings complicate things

There is a catch. Ring signatures hide which output in a ring is being spent, so the node does not know which input commitment to use in the sum.

RingCT solves this with pseudo-output commitments. For each input, the sender publishes a fresh commitment to the same amount as the real input, with a different blinding factor. The ring signature (CLSAG today) then proves in zero knowledge that:

1. The signer owns one of the ring members, and
2. The pseudo-output commits to the same amount as that ring member’s commitment.

The node then runs the balance check using the pseudo-outputs. The real amount, the real input and the receiver all stay hidden, yet the books balance.

Key point: RingCT does not just hide amounts next to the ring signature. It ties amount hiding and sender hiding together into one proof, so neither can be checked without the other.

Why you also need range proofs

The balance check has a dangerous loophole. Curve arithmetic works modulo a huge prime number, so a “negative” amount is simply a very large number that wraps around.

Imagine a sender with 1 XMR creating two outputs: one of 1,001 XMR to themselves and one of −1,000 XMR. The sum is 1 XMR, so the balance check passes, yet they have just printed 1,000 XMR.

A range proof closes this hole. For every output it proves, in zero knowledge, that the committed amount lies between 0 and 2^64 − 1. Negative amounts are impossible, so the balance equation can only be satisfied honestly.

Bulletproofs: the 80% diet

Monero’s first range proofs, based on Borromean ring signatures, worked but were large: they made up most of a typical transaction’s size, which pushed fees up.

Bulletproofs, proposed in a 2017 paper by researchers associated with Stanford’s applied cryptography group, changed that. According to the Moneropedia they are short non-interactive zero-knowledge proofs that need no trusted setup. Their key properties:

• Logarithmic size. Proof size grows with the logarithm of the number of bits proved, not linearly.
• Aggregation. One proof can cover all outputs in a transaction, and each added output costs only a little extra space.
• No trusted setup. There is no secret ceremony whose leftovers could be abused to forge proofs.

Monero’s implementation was audited by QuarksLab and Kudelski Security in 2018 and activated in the October 2018 upgrade (v0.13 “Beryllium Bullet”). The Moneropedia reports that average transaction size fell by at least 80%, and fees fell with it.

Bulletproofs+: a leaner refinement

Bulletproofs+ is a later variant from a different group of researchers that rearranges the underlying inner-product argument to be more compact. It keeps everything good about Bulletproofs (no trusted setup, aggregation, logarithmic size) and trims the proof further.

It went live in the August 2022 network upgrade alongside ring size 16 and view tags. The Monero Project estimated it would reduce typical transaction size by about 5-7% and improve typical verification performance by a similar 5-7%.

Comparison of Monero’s range proofs

What stays public

RingCT hides a lot, but not everything:

• The fee is in plain text. Nodes need it for the balance check, and miners need it to choose transactions. Wallets use a few standard fee tiers so the fee reveals little beyond the priority you picked.
• Coinbase (block reward) amounts are public, so anyone can verify that miners claim only what the emission schedule allows.
• The number of inputs and outputs is visible. Most wallets create transactions with two outputs (payment plus change), which helps everyone blend in.

Note: Because block rewards are public and every other transaction is proven balanced, the total supply can be computed. It is not looked up directly from visible amounts but follows from the cryptography holding. This is the basis of supply audit discussions in the community.

How the receiver learns the amount

If the amount is hidden, how does your wallet know you received 2.5 XMR?

The sender encrypts the amount using the same shared secret that creates the stealth address (see our stealth address guide). Your wallet, holding the private view key, recomputes the shared secret, decrypts the 8-byte amount field, and checks that it opens the published commitment. Anyone with your view key can do the same, which is why view keys are used for audits.

For one-off proof, Monero wallets can generate a payment proof (also called a transaction proof) that shows a specific amount went to a specific address, without handing over a view key. This is handy for disputes with merchants or exchanges.

Does hiding amounts have costs?

The community accepts these costs because transparent amounts would undo much of the privacy that rings and stealth addresses provide.

What FCMP++ changes for amounts

The planned FCMP++ upgrade replaces ring signatures, not range proofs. Amounts will still be hidden in Pedersen commitments with Bulletproofs+-style range proofs. The membership proof will cover the full chain instead of 16 ring members. Each spent output, including its amount commitment, is “re-randomised” so the proof can show it exists on-chain without revealing which one it is, a role similar to today’s pseudo-outputs. FCMP++ is in beta testing as of November 2026 with no announced mainnet date.

Summary

RingCT hides every Monero amount inside Pedersen commitments, which can be added together so nodes verify that nothing is created from nothing. Range proofs block the negative-amount trick, and Bulletproofs+ makes those proofs small enough that a private transaction stays affordable. Only fees and block rewards are public.

Continue with the other privacy pillars in Technology, or learn the basics in Monero Basics.