Mixers, CoinJoin and privacy coins · Lesson 4 of 5
Privacy coins
8 min read
When a trail enters Monero or a Zcash shielded pool, ordinary tracing stops, and the temptation is either to give up or to over-read the few signals that remain. Neither is acceptable in a forensic report. Building on the IDFE-BA lesson Other chain designs analysts meet, this lesson sets out what each protocol hides, what investigators can still observe and prove, what published research supports, and how to word findings so that they hold up.
Monero: what is hidden and what remains
Monero hides the three things a trace needs. Payments go to one-time stealth addresses derived from the recipient's public address (and its subaddresses), so the recipient's address never appears on chain. Each input is signed with a ring signature over the real output and decoys: since the network upgrade of August 13, 2022 every ring has 16 members, the real one and 15 decoys. A key image stops double spending without revealing which member was spent. RingCT, enabled in January 2017 and mandatory from September 2017, hides amounts behind commitments with range proofs.
Dates matter for older evidence, because protection grew in steps. The minimum ring size rose from 3 (March 2016) to 5 (September 2017), 7 (April 2018), 11 (October 2018) and 16 (August 2022), and transactions have been relayed with Dandelion++ since 2020, which makes it harder to infer the originating node from network observation.
What remains public: that a transaction exists, its block and time, its fee, its numbers of inputs and outputs, the ring members of each input (the candidate set), and the extra field.
Full-chain membership proofs. A planned upgrade, FCMP++, would replace 16-member rings with a proof over the entire set of outputs. Once activated, ring-based analysis will not apply to new transactions; it will still apply to the ring-era history. Date any statement about its status.
Keys that disclose. Monero has several ways for a holder to reveal information without giving up spending power, and all of them are verifiable by the examiner:
- a private view key reveals incoming payments to an address (outgoing spends need key images as well);
- a transaction key or payment proof proves that a specific transaction paid a specific address a specific amount;
- a reserve proof proves that a wallet holds at least a stated balance.
For a ransom paid in Monero, ask the victim for the transaction ID, the transaction key or payment proof and the destination address. Check the proof with an open-source wallet against your own node, record the software version, and the payment becomes a grade A fact even though the chain hides it from everyone else. Seized wallets are a different matter: legacy Monero wallets use 25-word seeds rather than BIP-39 (see the lesson Wallet recovery under lawful authority).
Zcash: pools, boundaries and the turnstile
Zcash has a transparent pool (t1…, t3… addresses), which behaves like Bitcoin, and shielded pools: Sprout (legacy, zc…), Sapling (since October 2018, zs…) and Orchard (since the NU5 upgrade of May 31, 2022, used through unified addresses beginning u1). Inside a shielded pool, sender, recipient, amount and memo are hidden; the fee is always visible.
The boundaries leak. Shielding reveals the transparent sender and the amount; deshielding reveals the amount and the transparent recipient. Because value crossing each boundary is visible, the total held in each shielded pool can be computed by anyone, a mechanism called the turnstile. A consensus rule (ZIP 209) makes any block that would drive a pool's balance negative invalid, so counterfeiting inside a pool would be detected at the turnstile. Record the pool balances at the time of your events: they give the scale of the anonymity set. Holders can disclose shielded activity voluntarily with viewing keys.
What each design reveals, side by side:
| Observation | Monero | Zcash shielded | Zcash transparent |
|---|---|---|---|
| Sender | One of 16 ring members | Hidden | Visible |
| Recipient | Hidden (stealth address) | Hidden | Visible |
| Amount | Hidden (RingCT) | Hidden; visible at the pool boundary | Visible |
| Time and fee | Visible | Visible | Visible |
| Voluntary disclosure | View key, payment proof | Viewing key | Not needed |
| Entry and exit at services | Service records | Service records | Service records |
What investigators can still observe
| Observation | Where it comes from | Evidential use |
|---|---|---|
| Entry and exit at exchanges and swap services | Service records obtained through legal process | The main lever: identity, deposit and withdrawal addresses, times, IP data |
| Cross-asset timing and amounts | A Bitcoin or token deposit to a swap service and a Monero payout, or the reverse | Grade D candidate sets until the service's records confirm (see the lessons Chain-hopping as an obfuscation and laundering pattern and Swaps, DEXs and instant exchanges) |
| Zcash transparent flows | Public chain | Bitcoin-style tracing, grade A for flows |
| Zcash boundary amounts | Shielding and deshielding transactions | Round-trip matches of similar amounts; inference only |
| Monero ring membership | Public chain | A known output (for example, one a cooperating exchange paid to the subject) appearing in a ring of a later transaction is one candidate among 16, not a spend |
| Payment proofs, view keys | Victims, cooperating services, seized wallets | Verifiable disclosure of specific payments |
| Wallet data | Lawfully seized devices | Full history of the wallet's own transactions |
| Remote-node use | A wallet that connected to a third-party node exposed its network address to that operator | A possible record holder; expect little |
The ring-membership row deserves care. If the same service sees an output it paid to a customer appear in a ring of a transaction later deposited back to it, that coincidence can be weighed, but decoy selection deliberately draws recent outputs, so a known output appearing in a ring is expected by chance. No published, validated error rate exists for such links. Report them as inferences with the ring size and the number of rings in which the output appeared.
Published research and its limits
| Study | Finding | Period and limits |
|---|---|---|
| Möser et al. (2018), Monero | About 62% of inputs with at least one decoy were traceable by elimination ("chain reaction"), and guessing the newest ring member was right about 80% of the time | Data to April 2017; the authors found RingCT-era transactions generally immune to elimination; mandatory ring sizes and new decoy selection followed |
| Quesnelle (2017), Zcash | Round-trip matching linked 31.5% of coins sent to shielded addresses | The author calls the matches circumstantial, with possible coincidental pairs |
| Kappos et al. (2018), Zcash | Founder and miner behavior explained 69% of shielded-pool activity; unique-value matching linked more than 1 million ZEC, 28.5% of coins deposited in the pool | Data to January 2018, when most activity was transparent |
| Biryukov et al. (2019), Zcash | Active attacks and hidden channels that could fingerprint shielded transactions | Mechanisms, not field linkage rates |
In March 2024 Monero researchers also investigated a suspected black-marble flooding episode: a large volume of transactions whose outputs, if created by one party, that party would know to be decoys, weakening rings during the episode. It shows that a ring's effective size can be smaller than 16 for some periods, which matters when you assess a ring-era transaction.
Read this research as an examiner. Each figure describes a historical period and an aggregate rate. None tells you that a specific input in your case was traceable. Elimination results from pre-2017 Monero do not apply to a 2025 transaction. Claims by commercial providers that they can trace Monero or shielded Zcash have not been published with methods and validated error rates, so they cannot be the basis of a finding; at most they suggest where to look for records.
Delistings and shifting exit points
From 2023 to 2024 several large exchanges delisted Monero or restricted it in some regions, citing regulatory expectations. Rules differ between jurisdictions, and some are moving to bar regulated providers from handling privacy coins altogether. The investigative effect is that the regulated, record-keeping exit points are fewer, and flows move to non-custodial instant-exchange services, peer-to-peer trading and atomic swaps. Identify the service at each edge early, preserve its public data, and ask what records it holds (see the lesson Working with service providers).
Wording that holds up: "The subject's exchange account withdrew 41.2 XMR at 14:05 UTC (exchange records). The ransom payment of 41.0 XMR to the attacker's address is proven by the victim's payment proof, verified against our node. Between these events the chain shows no link we can assert." Wording that does not: "Blockchain analysis traced the Monero to the subject."
Exam focus: Monero stealth addresses, subaddresses, ring size 16 since August 2022, key images and RingCT, and the ring-size history for dating evidence; why ring-based analysis would not apply to transactions made after a full-chain membership upgrade, but still applies to ring-era history; view keys, payment proofs and reserve proofs as verifiable disclosures; Zcash transparent, Sprout, Sapling and Orchard pools, boundary leaks, the turnstile and ZIP 209; what can still be observed (service edges, transparent flows, boundary amounts, ring membership as a candidate); Möser et al., Quesnelle and Kappos et al. findings and why they do not transfer to current transactions; delistings and the shift to non-custodial exit points.