The Stash #01: What Monero Hides, and What It Doesn'tThe Stash #01: What Monero Hides, and What It Doesn't

Level: Intermediate Reading time: ~10 min Last verified: 26 Oct 2026 Version covered: Monero v0.18.5.4 "Fluorine Fermi" (GitHub release)

ContentsContents

• In short
• Scenario
• Stop 1: Exchange
• Stop 2: Swap
• Stop 3: Payment
• Deadly zone: network and OPSEC
• Summary table: who knows what?
• Despite all this
• Sources

In shortIn short

By default, Monero hides three things on-chain: who sent, who received, and how much was sent.[1] But the steps around a payment (exchange records, the Bitcoin chain, swap services, the internet connection) sit outside that protection.

In this post we follow an ordinary spend from start to finish and ask the same question at every step: who sees what at this point?

ScenarioScenario

Actors

• Exchange: A centralized exchange that requires KYC.
• Swap service: An intermediary service that converts Bitcoin to Monero.
• Alice: The person who will spend the Monero.
• Bob: The person Alice will pay.
• Eve: A state. She watches the chain, uses chain analysis tools, and can request records from the exchange, the swap service, node operators and the internet service provider (ISP) through her legal authority. She can't break Monero's cryptography and can't access Alice's device.

NOTE: Scope of this post
In this post we assume Eve can get any record she asks for. This is a deliberate worst case: the exchange, the swap service and remote nodes keep everything they log, IP addresses included, and hand it to Eve.

Story

Alice buys Bitcoin from a KYC exchange and withdraws it to her own wallet. Then she converts that Bitcoin to Monero through a swap service. The XMR arrives directly in Alice's Monero wallet. Finally, Alice sends part of that XMR to Bob.

The picture below shows the whole flow at a glance. Then we'll zoom in on each stop.

https://stasher.news/uploads/976

Out of scope: decentralized exchanges, exchanges that don't require KYC, and buying XMR directly with cash in person.

I picked this route because it's the easiest, lowest-friction path for an ordinary person. The others are valid too, but they carry a different threat model. Also, the choice of BTC is arbitrary: the same scenario applies to other cryptocurrencies with a transparent chain.

Questions this post answers

When making an ordinary Monero spend:

1. What does the exchange know?
2. What does the swap service know?
3. What does Eve see at each stop?
4. What does Bob know?
5. Outside all of this, what leaks on the network side?

Stop 1: ExchangeStop 1: Exchange

What is Alice doing?What is Alice doing?

For Alice to get XMR, she first has to buy BTC from an exchange. To do that, she verifies her identity (KYC), buys BTC with fiat money, and withdraws the BTC to her own Bitcoin wallet. Now let's look at who can see what at this step.

What does the exchange know?What does the exchange know?

The exchange now holds Alice's identity, her purchase and withdrawal records, and her connection details (details in the diagram).

https://stasher.news/uploads/977

The most dangerous data the exchange holds is the identity information. It's what puts "by Alice" on top of every record. It's also the most useful thing for Eve. Let's turn to her.

What does Eve see?What does Eve see?

Here Eve is a state, and through her legal authority she requests everything the exchange has on Alice:

https://stasher.news/uploads/978

Eve now has everything Alice gave the exchange. More importantly, she knows who Alice is. Without the records, she would see the withdrawal address on-chain but wouldn't know whom it belongs to. The identity data closes that gap. Combined with the records the state already has, Eve ends up with a full profile of Alice. For example, she also knows Alice is 23 and doing a physics PhD at a university.

On top of that, Eve now knows the address Alice withdrew her BTC to belongs to Alice. She can follow that address's history, and everything it does from now on, on the Bitcoin chain.

Result of this stopResult of this stop

This is where the most information is exposed in the whole flow. Alice isn't inside Monero yet: the Bitcoin chain is public, the exchange knows Alice's identity, and the withdrawal address is tied to that identity. The exchange's records end at the withdrawal, but because the chain is open, anyone who wants to look at what happens to that address afterwards can. That link stays at the exchange, no matter how carefully Alice uses Monero afterwards.

Stop 2: SwapStop 2: Swap

What is Alice doing?What is Alice doing?

Alice goes to an instant swap platform. She enters the amount of XMR she wants, and the BTC amount she has to send is calculated and shown at the current rate. Then she enters the Monero address the XMR should go to and clicks "Create transaction". On the transaction screen that appears, she sends the stated amount of BTC to the stated address (by scanning the QR code or typing the address in by hand). The swap completes and the XMR arrives in Alice's wallet.

What does the swap service know?What does the swap service know?

The service sees which address the BTC came from, the amount, the Monero address Alice receives the XMR at, and the timestamps. On top of that, the IP address Alice made the swap from is in its records.

https://stasher.news/uploads/979

What does Eve see?What does Eve see?

Through her legal authority, Eve requests the swap service's records of the transaction made by Alice's BTC address. Now she has two paths to Alice: the BTC source address in the record matches the withdrawal address from Stop 1, so it's clear Alice made the swap. The IP address in the record, if it wasn't masked, leads to the same result when she asks the ISP. So Eve also learns Alice's XMR address and the amount she received.

https://stasher.news/uploads/980

But there's an important difference here: even though Eve knows this address and amount, she can't directly read Alice's later spends from this address off the chain. However, since the swap service sent this transaction itself, it can also show Eve which output went to Alice.[2] If that output later shows up in a transaction's ring, Eve will notice. The ring has 16 members and the signature doesn't reveal which one was actually spent, so this is a hint, not certainty. This only holds for the chain side. The network side is a separate matter, covered in the network section at the end of the post.

Result of this stopResult of this stop

This is where information starts to shrink. The two paths to Alice (BTC address and IP) are still open, but from here on Eve has nothing she can follow with certainty on the chain, only hints from the rings.

Stop 3: PaymentStop 3: Payment

What is Alice doing?What is Alice doing?

Alice now has XMR. Bob gives her his address, and Alice sends some XMR to it.

In this scenario we assume Alice gives Bob nothing about her identity. If she gives him something like a shipping address or an email, information leaks through Bob.

What does Eve see on-chain?What does Eve see on-chain?

On-chain, the transaction's existence, time, size and fee are visible. Who sent it, who received it and the amount are not.[1]

https://stasher.news/uploads/981

What does Bob know?What does Bob know?

Bob sees the amount he received and the time. He doesn't know Alice's address, her identity or where she got the XMR. Eve can also reach Bob's records through legal channels, but since Bob has nothing on Alice, those records alone don't lead Eve to Alice. However, the time Bob knows can help Eve with timing correlation on the network side. We'll look at that in the network section.

Result of this stopResult of this stop

There's very little to see on-chain about Alice's payment: there's a transaction, but who sent what to whom, and how much, isn't visible. The things Monero can't hide mostly come from steps outside Monero: the exchange, the Bitcoin chain, the swap service, and the network. Now it's the network's turn.

Deadly zone: network and OPSECDeadly zone: network and OPSEC

Outside all of this there's a layer that covers the whole flow and gets skipped most often: the network. Even after Alice holds Monero, the gaps that let Eve watch her are mostly here.

OPSEC, short for operational security, applies at all three stops and beyond the flow. It's a huge topic on its own, because it's about real life as much as Monero. Here we only look at the part that concerns this flow, the one thing everything shares: the internet.

https://stasher.news/uploads/982

Remote nodeRemote node

There's something we haven't said out loud at the stops: to send a transaction on both Bitcoin and Monero, you have to connect to a node. If the node Alice connects to isn't a local node she runs herself (most people don't bother), she's connecting to a public remote node. On the Monero side, the remote node operator sees Alice's IP address and can link transactions to that IP.[3] The Bitcoin side is similar: with lightweight wallets like Electrum, the server you connect to sees the wallet's addresses and your IP address.[4] Whether the operator keeps this data is entirely up to what they claim, and there's no guarantee. Even if they don't, Eve can use her authority to ask the operator to keep it.

IP address and timingIP address and timing

Alice's IP address is on record in more than one place in the flow: at the exchange, at the swap service and at the remote nodes. The ISP also knows whom that IP belongs to. Since Eve can request all of these records, the same IP becomes a common trail across the stops.

Timing works in the same direction. Eve can match the broadcast time the remote node saw against the time of the transaction on-chain. On its own it isn't proof, but combined with the other records it's a hint that ties the Monero transaction to an IP address, and through the ISP, to Alice.

Summary table: who knows what?Summary table: who knows what?

Despite all thisDespite all this

Eve tried to follow Alice step by step: through the exchange, the swap service, the Bitcoin chain, the ISP, the IP address and the remote node she connected to. At every one of these points she found trails leading to Alice.

But once she reached the Monero chain, things changed. Unless Eve gets into Alice's device, say with malware, she can't learn the recipient or the amount from the chain. The sender stays hidden inside the ring, and the most she gets is hints. Monero's cryptography held up at these three points, for both Alice and Bob.

So most of the leaks happened outside Monero. The closer we got to Monero, the less information there was.

SourcesSources

1. Monero Project, "Ring CT," Moneropedia. https://getmonero.org/resources/moneropedia/ringCT.html
2. Monero Project, "Stealth Address," Moneropedia. https://getmonero.org/resources/moneropedia/stealthaddress.html
3. Monero Project, "Remote Node," Moneropedia. https://getmonero.org/resources/moneropedia/remote-node.html
4. Electrum Documentation, "Frequently Asked Questions." https://electrum.readthedocs.io/en/latest/faq.html

Author's note:
Sorry for how long the posts took. As I said, I had been building up a stock so the series wouldn't stall, but two weeks still went by, longer than I expected. Two of the upcoming posts are about ring signatures and decoy selection, and about FCMP++. I had to read the sources to explain them properly, which took time. I also didn't like one of the posts and rewrote it from scratch. Still, I tried to make them as good and as clear as I could. Sorry for keeping you waiting, and I hope you like them.

I'd love to hear your comments and criticism on this post. Are the visuals good? Too many? Too few? Unnecessary? If I got something wrong or left something out, please don't hesitate to say so.

I'm posting this on Monday, but if another day would work better, please tell me. If most of you suggest the same day, I'll publish every week on that day. You can also tell me which time (UTC) suits you best. Personally I was thinking Fridays at 18:00 UTC, but I published today, on a Monday, so I wouldn't keep you waiting any longer. If the majority agrees on a day, I'll build the schedule around it.