Bulletproofs are a compact cryptographic proof that lets Monero show a hidden transaction amount is valid using far less data than before. When Monero adopted them in 2018, the average private transaction shrank by at least 80 percent, and fees fell with it. They made privacy cheaper to use without making it any weaker.
Bulletproofs are best understood as an efficiency upgrade to how Monero hides amounts, not a change to what is hidden. The privacy was already there; Bulletproofs made it lighter to carry.
To see why that mattered, it helps to start with the size problem Bulletproofs were built to solve.
The problem: hiding amounts made transactions heavy
Hiding a transaction amount is not free. To keep amounts secret while proving no one is cheating, Monero attaches a cryptographic proof to every output. In the early years those proofs were large, so a private Monero transaction was several times bigger than a transparent payment, which made it slow to verify and expensive to send.
The culprit was the proof attached to each hidden amount. To conceal amounts, Monero uses ring confidential transactions, which hide the amounts while still allowing verifiable, trustless coin generation (source: Monero project, Moneropedia: Ring CT). The way it originally proved those hidden amounts were valid worked, but it produced bulky proofs, and each output needed its own. Size is not a cosmetic issue on a blockchain. Larger transactions take up more space in every block, cost more in fees, and take longer for the network to check, all of which push against a currency meant for everyday payments. The same pressure exists on transparent chains, where block space is scarce and fees rise with demand, as explained in why Bitcoin fees get high. For a privacy coin the problem was sharper, because the privacy itself was what made the transactions heavy. That is an awkward tradeoff for a project whose goal is usable money. A privacy feature that makes every payment slow and costly limits how many people will actually use it, so the size of those proofs was not a side detail but a real obstacle to adoption.
What a range proof is, and why hidden amounts need one
A range proof is the tool that keeps hidden amounts honest. It is a proof that a secret number lies within a valid range, in this case zero or above, without revealing the number itself. Monero needs one for every output, because without it someone could hide a negative amount and forge money while the totals still appeared to balance.
This is the part of a confidential transaction that does the heavy lifting. When an amount is hidden, the network cannot simply read it to check that it is sensible, so it relies on a range proof to guarantee the hidden value is not negative and not impossibly large. Skip that check, and the whole system of hidden amounts collapses, because a cheater could balance the books with impossible numbers. The reason the network cannot simply peek is the entire point of a confidential transaction: the amount is deliberately concealed even from the nodes verifying it. So the range proof has to do something that sounds paradoxical, convince a skeptical verifier that a number is well-behaved without ever disclosing the number. That is a real cryptographic feat, and it is why the proof carries real weight in the first place. The general idea of proving something about a secret without revealing the secret runs through cryptography, and the basics are covered in Bitcoin privacy basics; Monero applies it to amounts. The catch, historically, was that a thorough range proof took a lot of data to express, and every output needed its own. That is precisely the cost Bulletproofs were designed to cut, without giving up the guarantee.
What Bulletproofs are
Bulletproofs are a compact kind of range proof. They are short, non-interactive zero-knowledge proofs that require no trusted setup, which means they prove a hidden amount is valid using very little data and without any risky one-time ceremony. They were introduced in 2017 by a Stanford-led group of cryptographers.
The title of the paper says a lot: Bulletproofs: Short Proofs for Confidential Transactions and More (source: Bulletproofs paper, 2017). Two properties matter for Monero. First, they are short, so replacing the old range proofs with Bulletproofs sharply cuts the data each transaction carries. Second, they require no trusted setup. Some privacy systems depend on a special setup ceremony to generate secret parameters, and if that ceremony is ever compromised, the whole system can be quietly broken; Bulletproofs avoid that risk entirely, because there is no such ceremony. The work was led by the applied cryptography group at Stanford, working with collaborators elsewhere, and its project page collects the research and its uses (source: Stanford, Bulletproofs). The broader machinery of proving a statement while revealing nothing is part of how Monero works overall, described in how Monero works. It is worth unpacking the jargon. "Zero-knowledge" means the proof reveals nothing beyond the fact that the amount is valid, not even a hint of the number itself. "Non-interactive" means the prover can generate it in one shot, with no back-and-forth, so it can simply be attached to the transaction and checked later by anyone. Both properties are exactly what a public blockchain needs. In short, Bulletproofs kept the same guarantee and made it far cheaper to express.
Why they are so small: proving many amounts at once
Part of what makes Bulletproofs so compact is that they can prove many amounts together. A single Monero transaction often has more than one output, and instead of attaching a separate proof to each, Bulletproofs can bundle those range proofs into one, so the total size grows much more slowly as outputs are added.
This is called aggregation, and it is a big reason the savings are so large. With the older approach, every output carried its own full-size range proof, so a transaction with several outputs stacked up several bulky proofs. Bulletproofs let a single proof cover all the outputs at once, and the size of that combined proof grows only slightly as more outputs are included, rather than adding a full new proof for each one. The practical effect is that even a transaction with multiple recipients stays small. Combined with the compactness of each individual proof, aggregation is what turned an 80 percent reduction from a nice idea into a real one. It is a good example of how a cryptographic improvement is not only about a cleverer proof, but about how proofs compose when a real transaction has many parts.
How much smaller: Monero's 2018 upgrade
The impact was large and measurable. Monero adopted Bulletproofs in its October 2018 network upgrade, replacing the old range proofs. According to the project, the size of an average transaction then dropped by at least 80 percent, and transaction fees fell along with it. Almost overnight, private Monero payments went from bulky to broadly practical.
This is one of the clearest before-and-after moments in Monero's history. The Monero documentation states plainly that the original range proofs were a big drawback because of their huge size, and that switching to Bulletproofs cut the size of an average transaction by at least 80 percent, with a corresponding drop in fees (source: Monero project, Moneropedia: Bulletproofs). An 80 percent reduction is not a tweak; it is the difference between a payment that feels expensive and one that does not. Smaller transactions and lower fees also ease pressure on everyone running the network, since every node stores and verifies less data per payment. The benefit compounds over time, too: a blockchain grows forever, so trimming the size of every transaction slows how fast the whole chain balloons, which keeps running a node more affordable for ordinary people and helps keep the network decentralized. Crucially, none of the privacy was traded away to get there: the amounts stayed exactly as hidden, and the network could still verify every transaction in full. The upgrade simply proved the same thing with far less data.
Why it matters: privacy and efficiency together
Usually, more privacy costs something, in size, speed, or fees. Bulletproofs are notable because they improved privacy's practicality without weakening it. That combination is rare, and it is a large part of why Monero became usable at scale rather than staying a heavy experiment. The guarantee did not change; only the cost did.
It is worth dwelling on how unusual that is. Privacy features almost always come with a tax: extra data, slower verification, higher fees. Bulletproofs cut that tax sharply while keeping the guarantee intact, which Wikipedia describes as a zero-knowledge method that lets a transaction be confirmed without revealing its value (source: Wikipedia, Monero). That guarantee is one piece of the larger promise that the sender, receiver, and amount of every Monero transaction are hidden by default (source: Monero project, what is Monero). The hidden amounts are still recovered by you alone, using your own keys, whose roles are covered in Monero's view and spend keys. From the vantage of an exchange operator, an upgrade that cuts a private transaction's weight by most of its size is what makes a privacy coin practical to run at scale rather than a curiosity. That is a structural observation about the protocol, not a comment on price. It is the kind of upgrade that is easy to overlook precisely because nothing visible changed. Users did not gain a new feature; they simply found their transactions smaller and cheaper, which is often what genuine progress looks like.
The honest limits and what came next
Bulletproofs are powerful, but it helps to be precise about what they are. They are an efficiency improvement to how amounts are proven, not a new privacy guarantee. They did not change what Monero hides, they do not protect you off-chain, and, like any proof, they still cost something to create and verify. Monero has kept refining them since.
The most common misunderstanding is to treat Bulletproofs as the thing that makes Monero private. They are not. Monero's privacy comes from hiding the sender, the receiver, and the amount; Bulletproofs simply made the amount-hiding cheaper to prove. Nothing about what is concealed changed in 2018. It is also worth remembering that a proof is still work: Bulletproofs are far smaller than what came before, but verifying them is not free, and researchers have continued to refine the approach for further gains. There is a useful subtlety here. A single Bulletproof is quick to check, but the real efficiency comes from verifying many of them together in a batch, which nodes take advantage of when validating a full block. That kind of engineering, squeezing more out of the same proof, is where much of the ongoing work has gone, rather than into changing what the proof guarantees. And, as with every on-chain privacy feature, none of this protects you off the chain, where an exchange that knows you, a reused address, or careless habits can still expose you. For the network-level side of privacy, Monero's network privacy and Dandelion++ covers how transactions are broadcast, and for the practical real-world picture, whether Monero is safe is the right next step.
Frequently asked questions
What are Bulletproofs, in one sentence?
Bulletproofs are a compact zero-knowledge range proof that lets Monero prove a hidden transaction amount is valid using far less data than the older method, which made private transactions much smaller and cheaper. They are the part of a confidential transaction that keeps hidden amounts honest, packed into a fraction of the space the previous approach needed.
Did Bulletproofs make Monero more private?
No. Bulletproofs made private transactions smaller and cheaper, not more private. Monero's privacy comes from hiding the sender, receiver, and amount, and Bulletproofs did not change any of that. They improved how efficiently the hidden amount is proven valid, which is an engineering win rather than a privacy one. This is the single most common misconception about them, so it is worth being clear: the guarantee stayed the same, only the cost of providing it fell.
How much smaller did transactions get?
According to the Monero project, adopting Bulletproofs in the October 2018 upgrade cut the size of an average transaction by at least 80 percent, and fees dropped with it. That is a dramatic reduction, and it is one of the clearest efficiency improvements in Monero's history. It changed private payments from something noticeably heavy and costly into something much closer to an ordinary transaction in size and price.
Do Bulletproofs need a trusted setup?
No, and that is one of their key advantages. Some zero-knowledge systems rely on a one-time setup ceremony to create secret parameters, which becomes a serious risk if that ceremony is ever compromised or done dishonestly. Bulletproofs require no trusted setup at all, so there is no such ceremony to trust, to run correctly, or to worry about later. That property makes them attractive well beyond Monero.
Are Bulletproofs unique to Monero?
No. Bulletproofs were invented by a Stanford-led group of cryptographers and are a general technique, not a Monero-only feature. Monero was an early and prominent adopter, putting them into every transaction from 2018 onward, but the underlying method has been studied and used more widely across cryptocurrency and cryptography. Their combination of small size and no trusted setup made them broadly useful.
What is a range proof?
A range proof is a way to prove that a hidden number falls within a valid range, such as being zero or above, without revealing the number. Monero uses one on every output so that hidden amounts cannot be negative or otherwise forged, which is what stops someone from creating money out of nothing while the totals still balance. Bulletproofs are simply a much more compact way of producing that same proof.
Is Bulletproofs the same as RingCT?
No. RingCT is the feature that hides transaction amounts; Bulletproofs are the compact range-proof component that RingCT uses to prove those hidden amounts are valid. Before Bulletproofs, RingCT used a bulkier range proof that made transactions large. So Bulletproofs are a part of how RingCT works, an upgrade to one component, not a replacement for RingCT itself.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Updated July 2026. Sources: the official Monero Moneropedia at getmonero.org, the Monero entry on Wikipedia, and the 2017 Bulletproofs paper and project page from the Stanford applied cryptography group. All facts independently verified against cited documentation current as of July 2026.
This article is educational and general in nature, not financial, legal, or tax advice. Cryptocurrencies like Monero carry real risks, including price volatility and regulatory changes, and privacy technology is strong but never an absolute guarantee of anonymity. Nothing here is a recommendation to buy, sell, or hold any asset. BloFin offers the XMRUSDT perpetual contract for trading; to get started, create a BloFin account, fund it with cryptocurrency, and open the XMRUSDT perpetual contract trading page. Do your own research and consider a licensed professional before making financial decisions.