The Stash #03: What Could $100 Million Do to Monero?The Stash #03: What Could $100 Million Do to Monero?

Level: Beginner Reading time: ~15 min Last verified: 13 Nov 2026

Author's note:
In the previous post, I mentioned that the next one would be about FCMP++. However, since I didn't want to publish two technical posts back-to-back, I pushed its release date back and decided to put out a lighter, easier-to-read post instead. It's not canceled though, I will just publish it at a later date.

As always, I'd love to hear your comments and thoughts.

Enjoy the read!

Contents

• In short
• 1. The question and the rules
• 2. What are we targeting?
• 3. Door 1: Hash power
• 4. Door 2: Exposing users (deanonymization)
• 5. Door 3: The network's reputation and usability
• 6. So what's the result?
• Sources

In shortIn short

We have $100 million and one goal: to weaken Monero, to undermine, by any means necessary, the promise Monero makes to its users. The question is simple: where would we spend this money to do the most damage to Monero?

The answer actually depends on the goal. There are two technical places you can attack Monero: the consensus that decides which blocks the network accepts (this one is common to every cryptocurrency), and the privacy that is Monero's core promise, the thing that hides who pays whom. The first breaks the network, the second exposes people; the two can't be done with the same budget or the same method. There's also a third, non-technical route: attacking not the network itself but the world around it (exchanges, banks, laws).

In this post we test three doors in turn: messing with consensus through hash power, exposing users, and attacking the network's reputation and usability.

1. The question and the rules1. The question and the rules

This is a thought experiment, so let's fix the rules first, so that the answer to every "but what if we did this?" is settled in advance. We are a state official trying, if possible, to manipulate the Monero network, or at least to undermine Monero's purpose as much as we can. Legally nothing stands in our way; we can do anything within our power without worrying about the law. But we are limited by our budget: we can use anything money can buy, like hardware, cloud power, servers, experts, lawyers and lobbying.

• Budget: $100,000,000, one time.
• Authority: We're authorized by the state itself. So we have almost complete legal protection and authority; our wishes equal the state's wishes. Things like bribery or censorship are legal for us.
• Time: 1 year.
• Restriction: No breaking cryptography "somehow". Everything we use is something that can be bought today.

We gave ourselves both broad authority and clear limits, because in this thought experiment we want a tangible, meaningful result, and we also want to keep our capabilities as realistic as possible so the scenario could actually be carried out. Raising the budget much further, or relying on methods we can only discuss in terms of possibilities (like quantum computers), is out of scope for this post; they have no limit, and leaning on small probabilities would hurt the post's realism.

2. What are we targeting?2. What are we targeting?

Before spending the money we need to decide what we want to bring down, because there are three different goals and each one needs a different door. The first is to break the network: censoring transactions, rolling back blocks, making the network look untrustworthy. The second is to expose a user (or enough users to shake trust) in order to undermine Monero's main purpose. The third is to wear down trust and usability: getting it delisted from exchanges, applying legal pressure, splitting the community. These three look nothing alike; an attack can be very effective at one and not touch the others at all.

3. Door 1: Hash power3. Door 1: Hash power

Monero's consensus mechanism, like that of most cryptocurrencies, is based on proof of work. Miners produce blocks using an algorithm called RandomX, and the network treats the chain with the most work done as the valid one.

There's an important distinction here that seriously affects the attack scenarios: RandomX, which went live in late 2019, is designed to run efficiently on ordinary processors (CPUs) in particular. Unlike Bitcoin and other mainstream cryptocurrencies (there are a few exceptions like Wownero; I mean the mainstream ones), the goal is to let people mine with hardware anyone can have at home. Monero has a serious track record here: when ASIC makers have targeted Monero, the community has changed the mining algorithm and rendered those devices useless. This is the main reason Monero's hash power has stayed democratized, and why big companies or states haven't been able to build ASIC farms and monopolize mining.

But let's be honest: RandomX doesn't make ASICs impossible, it only aims to reduce their advantage. We're still not going into ASICs in this post, because there's no such threat today and, to repeat, a hard fork can turn such devices into scrap. The Monero community has experience with this. So we'll work either with ordinary processors or, as we'll see below, with other people's processors.

For our scenario we fix the network's size at about 6.3 GH/s (a round figure in the range of recent values), and a handful of big pools run most of it. (A small note: pools aren't the final owners of that hash rate. The power stays in a pool only as long as miners stay connected to it; if miners stop connecting, the pool is left with nothing.)

So why does this matter? Cryptocurrencies need a consensus mechanism to stay decentralized, and it's simple: the one who gets listened to is the one spending the most computing power. If we want the network to accept our own cheated ledger, we need at least 51% of the network's hash rate. By cheating I don't mean printing unlimited Monero, I mean double spending. Say I have 1 XMR. After I convert it to cash or another cryptocurrency, I tamper with the ledger and erase that transaction as if it never happened; since I hold the majority of the hash rate, everyone else has to accept it. The XMR I just spent comes back to my wallet as if nothing had happened.

Taking over the hash rate and cheating on the ledger is what we call a "51% attack". Let's briefly summarize what it can and can't do:

The question is: could we buy this power, or rent it for part of our one-year window? Let's assume we can; how much would it cost, and what would we get in return?

How much would this attack cost?How much would this attack cost?

The first thing that comes to mind would probably be buying hardware with our money and building a huge farm. But a little thought shows this makes no sense at all. Let's think in terms of ordinary processors, the way RandomX was designed: we buy a pile of the processors with the highest hash rate on the market and set up a mining farm. But there's something we need to pay attention to here: with every processor we buy, we add brand-new hash rate to the network. So the power we'd need to produce to take over the network isn't 51% of the current network; it's more than the entire current network. Because as we add, the total grows too, and our share doesn't grow at the same rate.

A small example: say the network has 10 units of hash rate. If we add 6 units, the total is 16 and our share stays around 37%. To get to half we need to add 10 units: the total is 20 and we hold exactly half. For a majority, a bit more on top. Long story short, the power we need with this method is more than the current network's hash rate. (For our scenario's network of roughly 6.3 GH/s, that means more than 6.3 GH/s of power.)

On top of that, processors alone aren't enough: there are motherboards to connect them to, electricity, cooling, procurement and installation. No need to give figures one by one, it's clear this would be expensive; it's about the same as building a giant data center, and it could even go past hundreds of millions into the billions. And gathering all this within a year without drawing anyone's attention is a headache of its own.

Here's a much more reasonable method (and, as we'll see later, one that has been tried in the real world): buying the miners! We pull the hash rate that's already out there over to our side, without spending on new hardware or new electricity.

There's a very striking calculation here. Monero produces 0.6 XMR per block, and a block comes every two minutes. That's 720 blocks a day, or 432 XMR; at $600 (a round figure near recent prices, which we fix for our scenario), about $260,000 a day and about $95 million a year. In other words, the total the network pays all miners over a year is about the same size as our budget. But we don't need the whole network, only 51% of it. And not for a whole year either, only until we reach our goal, that is, until we've damaged the network. Here's what I'm getting at: if we can pay miners several times what they'd normally earn, for as long as we'll be harming the network, and gather their hash rate in our own pool, we can reach the hash rate for a 51% attack without even using up our budget.

What I'm describing isn't just theory. In 2025, a 51% attack attempt was made on the Monero network with a method very much like this one: the Qubic project.

The August 2025 Qubic incidentThe August 2025 Qubic incident

In 2025 a project called Qubic took this from theory to practice by pointing the mining power of its own network at Monero. There are two different accounts of the event. The first is Qubic's own blog post [1]: it presents the episode as a demonstration in which they reached 51% of Monero's hash rate and reorganized the chain in August 2025. The second is the paper "Inside Qubic's Selfish Mining Campaign on Monero" by Suhyeon Lee and Hyeongyeong Kim [3] (it came out on arXiv in December 2025 and was later published at the AFT 2026 conference). This study measures what actually happened on the network instead of relying on Qubic's own claims, and it was published at a peer-reviewed conference; that's why I find it more reliable. According to the paper, Qubic's average share stayed well below a majority, and a sustained majority was never observed. What the paper does show is this: Qubic applied selfish-mining-style tactics on the network, which increased the number of orphan blocks and caused deeper chain reorganizations.

Even though Qubic didn't reach a sustained majority, the hash rate it captured was enough to cause noticeable disruption across the network [3]. Interestingly, the paper also finds that the campaign didn't earn more than honest mining would have, and the authors suggest it may have been about disruption as much as profit [3].

Qubic got this hash rate in a way similar to the method we described above: by pulling miners over to its side. And it did so not in secret but through a completely open incentive. According to Qubic's own epoch recap [2], the experiment was at one point roughly three times more profitable than mining Monero directly, and this drew new computing power to the network. Then the Qubic community voted on how to split the Monero earned: half would be used to buy back and burn Qubic tokens, and the other half would go to Computors and miners as extra incentive [2]. This incentive pulled miners away from other Monero pools to Qubic. And according to the paper, the technical side of the attack wasn't entirely in the open: the authors identify periods where blocks appear to have been withheld, which is how selfish mining creates orphan blocks and deeper reorgs [3].

In the end, we saw that an organization can, by giving miners more profit and pulling them to its side, cause serious disruption on the Monero network. Qubic presented this as an experiment and a demonstration, and wrote that it chose not to take over the network's consensus [1]; the network kept running, though it suffered more orphaned blocks and deeper reorgs [3]. But this attempt became a historical lesson proving that the method is possible.

The real cost of the attackThe real cost of the attack

Qubic's blog post has no cost figure, only the incentive structure; so we don't know what Qubic actually spent on this. So let's do the real calculation for our own scenario: if we ran a Qubic-style attack, how far could $100 million take us?

Let's run the calculation through the rewards. 51% of the roughly $260,000 daily block reward is about $133,000; in other words, the owners of that hash rate already earn this much a day while working honestly. Let's assume that to pull them into our pool we pay 3 times that (an incentive similar to Qubic's roughly threefold profitability): about $400,000 a day. $100 million lasts roughly 250 days at that rate. (Note: this calculation doesn't depend on the size of the hash rate, only on the daily reward; even if the network grows, the figure doesn't change.)

But there's something we can't skip: the blocks found with the hash rate we capture come to our pool. So part of what we pay comes back to us as the block rewards our pool earns. In that case the net cost falls to about $265,000 a day (3x payment minus 1x returned reward), and $100 million lasts about 380 days, that is, almost the entire year.

(A small note: in this calculation we don't distribute block rewards to miners the way classic pools do. The blocks come to us; to the miners we make a separate payment worth 3 times what they'd normally earn. So what we pay them isn't the Monero they mined itself, but a payment equivalent to it. How that payment is made is our choice.)

But things aren't as easy as they look, because there's the part about convincing the miners. When you launch a program that pays 3 times as much, the community (having learned from Qubic, too) probably won't trust you at all. Say we convinced them. We'd also have to keep the extra hash rate from being too obvious; this is exactly where selfish mining comes in, because it works out of sight. If everything were done openly, miners and the community would probably notice and leave the pool. But the order of magnitude is clear: this isn't beyond our budget.

So such an attack is possible. It's expensive, hard to sustain and hard to get people to go along with, and it has to be done without anyone noticing, but it's not outside our budget: for a while we can censor, roll back blocks, double spend and, most importantly, create doubt about the network's trustworthiness. But no matter how far we go through this door, we don't get one step closer to the identity of a single user. We can make the network look "untrustworthy"; we can't make it look "not private".

4. Door 2: Exposing users (deanonymization)4. Door 2: Exposing users (deanonymization)

Let me say up front that this section will be shorter than the others, because this is exactly where Monero is at its strongest. Exposing users in bulk isn't a realistic option even with $100 million. Let's see why.

If we want to expose users, the first road that comes to mind is looking at the chain itself. But in Monero this isn't the kind of "chain analysis" you'd do on chains where transactions can be read in the open. In Monero the sender, receiver and amount of a transaction can't be read from the chain; what we're left with isn't certain information, it's probability. For example, there are methods that, with a lot of effort and by combining certain clues, can guess the real output in a ring signature with some likelihood, but you can't prove it. (Let's be honest: things used to be worse. Older ring sizes and decoy selection had serious weaknesses. Even today it wouldn't be right to say "absolutely impossible", but what you get is at the level of "probably this one".)

Looking outside the chain, the picture changes. Most of the traces that break privacy are outside Monero: the identity and records a user leaves at an exchange on the way into Monero, the swap service, the IP address, the remote node they connect to. Once the user is inside the Monero network, though, chain analysis and the other methods used to expose people really don't work all that well (see The Stash #01: What Monero Hides, and What It Doesn't).

Here's the really important part: yes, we can focus on a selected, limited number of people. We can spend our money tracking these people meticulously and exposing them by combining the traces they leave not in the Monero network but in normal life. But the problem is this: doing it to the majority of the network is practically impossible, especially for a budget limited to $100 million like ours. Let alone exposing millions of Monero users, even for a single person the results always stay in the realm of "probabilities". And spending a budget on months of intelligence tracking of a handful of people wouldn't dent anyone's trust in Monero; on the contrary, once people see how expensive and laborious it is, trust would probably go up.

Here's the deal: in Monero, mass exposure through the chain or by following users one by one just doesn't work. By its structure, Monero has really strong walls against this kind of attack. The mass exposure we'd want in order to undermine Monero's purpose, which is our goal, hits a brick wall here.

5. Door 3: The network's reputation and usability5. Door 3: The network's reputation and usability

We can't expose the people who use Monero. But if we stop people from using Monero, logically we've still reached our goal. If people can't easily buy and sell Monero, can't spend it, it will slowly die out on its own. No matter how strong the privacy is, a currency that can't be used gives nobody anything.

This door is very different from the other two: here we don't deal with Monero's cryptography or network at all. What we deal with is the world around Monero: exchanges, payment companies, regulators, the news. And our authority is strongest in exactly this world.

What can we do with the authority we have?

• Pressure on exchanges: We can get them to delist Monero. There are real-life examples of this: over the years several major exchanges, including Kraken (in the UK), OKX and Binance, have removed Monero [4]. When an exchange removes Monero, it gets harder for people to get into Monero; the "easiest path" closes.
• Fiat gateways: By pressuring banks and payment companies, we can have accounts involved in buying and selling Monero closed and transactions flagged as suspicious. "Buy with a bank card", the most ordinary way into Monero, starts to carry risk.
• Swap services and service providers: Services that offer BTC-to-XMR conversion are companies open to legal pressure. Shutting them down or forcing them to ask for KYC narrows the ways into Monero.
• Legal burden and perception: Feeding the perception that "using Monero is suspicious" through laws and the news deters the ordinary user. We can do this with money too: lobbying, lawyers, media, all within our budget.

The interesting thing about this door is that on the other two we ran into technical walls; here there's no wall. But the door doesn't swing open all at once either.

Think of it like this: a state wants everyone in a neighborhood to eat white bread. But there are also bakeries in the neighborhood that sell whole wheat bread, so the state shuts them down and keeps only its own white bread bakery open. People who want whole wheat bread don't go without bread: they either walk to the next neighborhood or bake it at home. But when the walk goes from five minutes to half an hour, and baking at home is a real chore too, most people who aren't that picky about bread say "oh well, white bread is still bread" and go to the state's bakery. Only the people who really want it are left. This door's attack does exactly this: it doesn't destroy Monero, it makes it harder to reach, and it pushes anyone unwilling to put up with the hassle toward the easy path, the one in plain view of the state.

Moreover, there's a limit to making things harder, because there isn't just one way into Monero. When you shut down the exchange, peer-to-peer trading (P2P), buying with cash and decentralized exchanges are still there; they're all more of a hassle and more niche, but since there's no central off switch, they can't be shut down. Removing it from exchanges hits "convenience", not "the network": someone who already has Monero can keep spending with their wallet. There's also a limit to our authority: it extends only as far as the state's borders, and another country's exchange or service doesn't have to obey our orders. And an open campaign can backfire too; trying to ban something can increase interest in it.

The real issue is the crowd we're up against. People who use Monero are already people looking for privacy, a stubborn crowd, and despite all this regulation they're still transacting: Monero's daily trading volume these days is above a hundred million dollars. As long as you don't ban Monero outright, these people will find a way to keep using it, hassle or not. On top of that, most of them aren't committing any crime, they're just using a cryptocurrency; you can't easily punish them just for that.

So on this door we're using our authority more than our money, and we're up against a stubborn crowd that won't give up easily. But is everyone this stubborn? Let's look at that in the conclusion.

Let's take cryptography out of the picture anywayLet's take cryptography out of the picture anyway

We can't break cryptography. Nobody can. Unless a zero-day vulnerability or an inflation bug is discovered in Monero, breaking cryptography today is impossible. Quantum computers, the first "solution" that comes to mind, neither fit our budget nor are at a level today where they could break cryptography. In short, until quantum computers advance and break cryptography, or someone miraculously proves P=NP and finds a practical shortcut (which would probably bring not just the end of cryptography but the end of the world or something), this is practically impossible.

6. So what's the result?6. So what's the result?

We looked at three doors. The hash power door fits our budget and can really shake the network for a while, but it doesn't touch privacy; and it's an attack that miners and the community can notice and react to. The door of exposing users targets privacy head on, but because of Monero's structure it only produces probabilities and doesn't scale. The third door targets the world outside Monero, and this is where money and authority work best. So the privacy layer turned out to be the part that holds up best against $100 million; the real damage is done not to the network itself but by hitting the people and institutions that reach out to it.

We can't make the stubborn crowd give up, sure; but not everyone is that stubborn. People are very attached to comfort and, as long as they haven't been burned, they think they don't need privacy. The fact that the most common answer we get when we tell people privacy is a right is "I have nothing to hide" is a sign of this. As in the bakery example, those willing to walk half an hour are always a minority. So this door doesn't hit Monero's current users; it hits its chances of gaining new ones.

It's also very clear that making use harder really hurts Monero. Within a day of Binance's delisting announcement, XMR fell sharply [4]. So in the short term, at least, this door's effect is visible.

There’s one more side to this: this door can work against the attacker, too. The ever-growing “verify your identity” craze, which they keep trying to shove into nearly everything, has reached the point of making people uncomfortable, and even “normies” are noticing something, because they realize they too have “something to hide”. The harder we make the road, the more this discomfort can grow, and as privacy technologies become more widespread, some of these people will become aware of Monero, and Monero’s use and adoption will probably grow. Most will carry on with their lives, but some will “radicalize” on privacy.

In short, what we can do with our money and power is attack the world around Monero, isolating it and making it very hard to use. But at a time when people are slowly starting to understand why they need privacy, the chance that our strongest card backfires is too high to ignore.

Thanks for reading.

SourcesSources

1. Qubic, "Qubic Performs 51% Monero Network Takeover Demonstration", 12 Aug 2025. https://qubic.org/blog-detail/historic-takeover-complete-qubic-miners-now-secure-monero-network
2. Qubic, "Epoch 172 Recap - The Monero Experiment", 7 Aug 2025. https://qubic.org/blog-detail/epoch-172-recap-the-monero-experiment
3. Suhyeon Lee, Hyeongyeong Kim, "Inside Qubic's Selfish Mining Campaign on Monero: Evidence, Tactics, and Limits", AFT 2026 (LIPIcs, article 28). Full version: arXiv:2512.01437. https://arxiv.org/abs/2512.01437
4. Decrypt, "Binance Finalizes Monero Delisting Amid Surprising Market Response", 20 Feb 2024. https://decrypt.co/218194/binance-finalizes-monero-delisting