# Is Monero Traceable? What XMR Hides, What Leaks and What’s Next

> Is Monero traceable? XMR is private by default and much harder to trace than Bitcoin, but not perfectly. What it hides, tracing claims and where it leaks.

Source: https://ghostswap.io/is-monero-traceable/
Updated: 2026-10-20

Updated 20 October 2026

**Quick answer:** Monero (XMR) is private by default and much harder to trace than Bitcoin, but it isn't perfectly private. Every transaction hides the sender among 16 possible inputs, pays a one-time address and hides the amount. Known tracing has relied on weaknesses in Monero's early years, statistical guesses, or data from outside the blockchain, such as exchange records and IP addresses.

If you want to hold XMR, you can swap BTC, ETH or USDT to Monero on GhostSwap with no account.

## How does Monero hide your transactions?

Bitcoin's own site says: "Anyone can see the balance and all transactions of any address." Monero's [FAQ](https://www.getmonero.org/get-started/faq/) says there is "no way to accidentally send a transparent transaction."

Four features do the work:

- **Ring signatures hide the sender.** Each input is signed with 15 decoys from the blockchain, so an observer sees 16 possible coins. The ring size has been 16 since 13 August 2022 (11 before).

- **Stealth addresses hide the receiver.** Every payment goes to a new one-time address that can't be linked to the address you shared.

- **RingCT hides the amount.** It arrived in January 2017 and became mandatory in September 2017.

- **Dandelion++ hides where a transaction started.** Since Monero 0.16 (May 2020), it makes it "much harder to link a transaction to an IP address," in the Monero project's words.

| What an outside observer sees | Bitcoin | Monero |
|---|---|---|
| Which coin was spent | Shown exactly | One of 16 ring members |
| Who was paid | The address, on a public ledger | A one-time address, not linked to the address you shared |
| Amount | Shown | Hidden (RingCT) |
| Balance of an address | Anyone can look it up | Not shown |

## Has anyone traced Monero?

In some cases, yes, through three routes: early weaknesses, statistical guesses and off-chain data. We found no public report showing a break of Monero's cryptography.

### Monero's early years (2014 to early 2017)

Early Monero allowed zero-decoy transactions. A 2018 study by researchers at Princeton, Carnegie Mellon, Boston University, MIT and the University of Illinois, using data up to April 2017, found that about 62% of inputs with decoys could be traced by ruling the decoys out. It also found the real input was usually the newest in the ring, a guess that was right about 80% of the time.

Monero closed these gaps: a minimum ring size from March 2016, RingCT from January 2017, a fixed ring size of 11 and a new decoy-selection method in October 2018, and 16 from August 2022. The project said transactions with traceable inputs fell to nearly 0% once RingCT took over. A 2019 study from the Austrian Institute of Technology found that, for recent transactions, the known guessing methods did "not significantly outperform random guessing." Coins that moved before February 2017 remain at risk, because blockchain data is permanent.

### Statistical guesses and bugs

With 16 candidates per input, statistics can sometimes rank them. The Monero project says rings "enable statistical analysis" and are open to the "EAE attack": a party that sends you XMR and later receives it back from you, such as an exchange that knows who you are, may be able to link the two.

Bugs count too. Wallets from version 0.13.0.2 to 0.18.2.1 never picked outputs exactly 10 blocks old as decoys, so spending one exposed the real input. Version 0.18.2.2 fixed it, and the project published a post-mortem in June 2023.

### Claims by analytics firms and police

| Date | Who | Claim | What's public |
|---|---|---|---|
| Aug 2020 | CipherTrace (US Homeland Security contract) | Tools to "search, explore, and visualize" Monero transactions | Probabilistic, the firm said; no independent test |
| Sep 2020 | US Internal Revenue Service (IRS) | Contracts worth up to $625,000 each to Chainalysis and Integra FEC for Monero tracing tools | No results published |
| Jan 2024 | Finland's National Bureau of Investigation | Traced XMR in a criminal case | Method not disclosed |
| Sep 2024 | Chainalysis (leaked training video) | Tracing that, community members said, relied on IP addresses logged by the firm's own nodes | Chainalysis had no comment |
| Feb 2026 | TRM Labs (research report) | "Monero's on-chain privacy remains intact," but some network peers behave unusually | Behavior study |
| Jul 2026 | Norway's national police unit, Kripos | A method built in 2025 traces Monero transactions in specific cases; used in a case with 28 arrests in seven countries | Method not disclosed |

The firms' claims are probabilistic or unconfirmed, and the most detailed one points to IP data, not the blockchain. The police haven't said what came from the chain and what from other evidence. On the Finnish case, a Monero community member pointed to users' own mistakes, such as switching back and forth between Bitcoin and Monero.

## Where does Monero privacy actually leak?

Most real risks sit where Monero meets everything else. As its FAQ says, "Monero is not magic."

- **Exchanges that know who you are.** They record what they send you, what you send them and the addresses involved. TRM Labs lists exchange interactions and wallet clustering among the patterns that still help investigators.

- **Your IP address.** A remote node's operator "is able to see from what IP address a transaction comes from," says Monero's FAQ (not the recipient or amount). In December 2024 the Monero Research Lab warned that suspected spy nodes may be able to guess "which user's IP address was the original sender," and recommended a voluntary block list, updated in January 2026.

- **The transparent side of a swap.** Your BTC, ETH or USDT deposit is an ordinary public transaction, and so is the payout when you swap back out. Reused addresses link them to each other and to everything else they touched.

- **Timing and amounts.** When value leaves one chain and similar value appears on another soon after, the match can show on the public chains even though the Monero part doesn't.

- **You and your devices.** Screenshots, seed backups in the cloud and a compromised computer leak more than the blockchain does. So does old wallet software, as the 10-block bug showed.

## How do you keep your Monero private?

It's ordinary privacy hygiene:

- **Use your own wallet and keep it updated.** Feather, Cake Wallet and the official Monero GUI are common choices ([compare Monero wallets](/best-monero-wallets/)).

- **Run your own node if you can.** Monero's FAQ says a personal node is how "to achieve the highest rate of privacy," and that Tor, I2P or a VPN can reduce the risks of a remote node.

- **Use a fresh subaddress for each payment you receive,** including each swap.

- **Don't reuse addresses on transparent chains.** Bitcoin's own advice is to "use a new Bitcoin address each time you receive a new payment."

- **Keep your seed offline,** not in screenshots, email or cloud storage.

**Follow the law where you live.** Follow your local laws and tax rules, and keep records of your trades. A view key lets an accountant see your incoming payments; spending needs a separate key.

## What will FCMP++ change, and when?

FCMP++ (full-chain membership proofs) would replace rings. A transaction would prove its input is one of all eligible outputs on the chain, without saying which. The Monero project's [2024 post](https://getmonero.org/2024/04/27/fcmps.html) says each input would go "from an immediate anonymity set of 16 to 100,000,000," and that the design effectively removes ring weaknesses such as the EAE attack and statistical analysis.

| As of 20 October 2026 | Status |
|---|---|
| Live on mainnet? | No. The latest release, Monero 0.18.5.4 (16 October 2026), is a minor bug-fix release. The last network upgrade was on 13 August 2022. |
| Fork date | Not set. In May 2026 the project wrote that "a FCMP++ fork date is not set," and we found nothing newer that sets one. |
| Testing | A beta "stressnet" for FCMP++ and a related change called Carrot was scheduled to fork from Monero's testnet on 5 October 2026 at block 3,102,800. |
| Audits | A three-phase audit of the integration code was proposed in April 2026; no phase was marked complete when we checked. |

Some sites already call FCMP++ live; Monero's own releases don't support that. And it only changes what the blockchain reveals, not exchange records, IP addresses or the public side of a swap.

## How to swap BTC to XMR without an account

GhostSwap is a no-KYC crypto exchange: there's no account, and we never ask for your name, email, phone number or identity documents to start a swap. The XMR is paid straight to your own wallet.

- **Pick the pair.** Open [BTC to XMR](/exchange/btc-xmr/), or another coin you hold, such as [ETH](/exchange/eth-xmr/) or [USDT (TRC20)](/exchange/usdtrx-xmr/).

- **Check the quote.** Rates are floating, and network fees are included in the quote. The box shows what you receive and the minimum and maximum before you send.

- **Paste your own Monero address.** It starts with 4, or 8 for a subaddress. Copy and paste it; never type it by hand. Add the address you send from, for refunds.

- **Send the exact amount** to the one-time deposit address.

- **Receive XMR in your wallet.** From BTC this usually takes 20 to 60 minutes, mostly waiting for confirmations (5 to 15 from USDT TRC20, 10 to 25 from ETH). The XMR is spendable after 10 confirmations, about 20 minutes.

If a swap can't be completed, the coins go back to the sender address you entered. GhostSwap also has an official [onion mirror for Tor Browser](/help/can-i-use-ghostswap-over-tor/). It hides your IP address from the website; your BTC deposit is still public. All pairs: [GhostSwap's Monero exchange](/monero-exchange/).

## FAQ

**Can Monero be traced?** Sometimes, but it's much harder than tracing Bitcoin. A Monero block explorer shows 16 possible inputs, not who paid whom or how much. Known tracing has relied on early weaknesses, statistical guesses, or off-chain data such as exchange records and IP addresses.

**Can police trace Monero?** In some cases, they say so. Finland's National Bureau of Investigation (2024) and Norway's Kripos (2026) reported tracing XMR in specific investigations without disclosing how. Monero is a privacy tool, not an exemption from the law.

**Is Monero more private than Bitcoin?** Yes. On Bitcoin, anyone can see every address, amount and balance. Monero hides all three by default.

**Can I buy Monero anonymously?** GhostSwap needs no account or ID to swap BTC, ETH or USDT to XMR, and Monero is private by default once you hold it. But your privacy also depends on how you got the coins you send, your IP address and your wallet habits, so no service can promise anonymity. Use your own wallet and a fresh subaddress, and follow your local laws and tax rules.

**Where can I buy Monero without KYC?** Coinbase, Binance and OKX don't list XMR. Without an ID check, you can swap crypto you already hold on a no-account service such as GhostSwap, or trade peer to peer on RetoSwap (built on Haveno) or Bisq.

**Is Monero legal, and why are exchanges delisting it?** We found no general ban on owning XMR in the US or the EU. Many delistings follow rules for regulated platforms. Since 30 December 2024, MiCA Article 76(3) has stopped EU trading platforms from admitting coins with built-in anonymity features unless holders and their history can be identified, and from 10 July 2027 EU banks and crypto providers can't keep accounts that use privacy coins. You can still swap to XMR on GhostSwap with no account. More: [Is Monero legal?](/is-monero-legal/)

**Will FCMP++ make Monero impossible to trace?** No upgrade can promise that. FCMP++ would hide each input among every eligible output instead of 16, but it won't change exchange records, IP exposure or the public side of a swap. It has no mainnet date yet.

## Keep reading

- [Is Monero legal?](/is-monero-legal/)

- [Monero vs Bitcoin](/monero-vs-bitcoin/)

- [Best Monero wallets](/best-monero-wallets/)

- [How to buy Monero](/how-to-buy-monero/)

GhostSwap is a crypto swap service that lists XMR. This page explains how Monero's privacy works; it isn't legal or tax advice.