A ring signature lets someone sign a transaction as one member of a group without revealing which member. Monero uses this to hide the sender: your real output is combined with a set of decoy outputs from the blockchain, and no outside observer can tell which one actually spent the funds. That is how the payer stays hidden.
Ring signatures cover one of Monero's three privacy layers, the sender. Stealth addresses hide the receiver and confidential transactions hide the amount, but ring signatures are what break the link between a payment and the person who made it.
To see how that works, it helps to start with the general cryptographic idea before looking at Monero's version.
What a ring signature actually is
A ring signature is a type of digital signature that any member of a group can produce, so a signed message is provably endorsed by someone in that group, yet it is computationally infeasible to tell which member signed. The anonymity cannot be undone later, and the group can be assembled on the spot with no prior setup.
The classic illustration is a leak. Imagine an anonymous statement signed by "a high-ranking White House official." A ring signature could prove the signer really is one of that group, without ever revealing which official it was (source: Monero project, Moneropedia: ring signatures). Two properties make this powerful: the anonymity is permanent, and the group can be improvised from any set of valid public keys, so the signer does not need the others' cooperation. This is a specific cryptographic tool, not the same as a plain digital signature that identifies exactly one signer. The general theory of digital signatures and how public keys secure a payment sits outside Monero, and the primer on Bitcoin privacy basics is a useful companion. Here the focus is what Monero does with the ring.
How Monero uses ring signatures to hide the sender
When you spend Monero, your wallet builds a ring. It takes the real output you are spending and pulls in several decoy outputs from past transactions on the blockchain. The signature proves that one output in the ring is genuinely yours to spend, without revealing which. To an observer, every member of the ring is an equally plausible sender.
The decoys are real past outputs belonging to other people, selected from the chain so they look just like your own. Because all ring members are valid and equal, blockchain analysis sees only ambiguity: the sender's true output is grouped with decoy outputs, and there is no reliable way to pick out the real one (source: Wikipedia, Monero). This is why describing ring signatures as "coin mixing" is misleading. Nothing is pooled or swapped, and your coins never leave your control. The ring is a mathematical crowd that your real spend hides inside, and it is one part of the architecture explained in how Monero works. One question this raises: if the network cannot see which output you spent, how does it stop you from spending the same output twice? Monero solves that with a key image, a unique tag derived from the real output that reveals nothing about which output it is, but reappears if you ever try to reuse that output, so the network rejects the double-spend.
Verifying the signature is what ties this together. A ring signature is valid only if the signer holds the private key for exactly one of the sixteen outputs, which proves the right to spend without saying which output was spent. The underlying math has evolved over time, from the original scheme to more compact versions such as CLSAG, but the guarantee is the same: authorization without identification.
Decoys and ring size: how big is the crowd?
Ring size is the total number of outputs in the ring, your real one plus the decoys. Monero fixes this number for every transaction so they all look identical. The current ring size is 16, which means each spend hides among your one real output and 15 decoys pulled from the chain.
The exact figure matters, and so does the fact that it is fixed. Monero mandates a single ring size for all transactions, currently 16, made up of your output plus 15 decoys, precisely to force uniformity (source: Monero project, Moneropedia: ring size). If users could choose their own ring size, the choice itself would leak information, and smaller rings would be easier to analyze. A uniform, mandatory size means every transaction presents the same shape to an observer. The decoys are not chosen at random, either. The wallet selects them with a gamma distribution that mimics real spending patterns, so a decoy is hard to distinguish from a genuine, recently received output. Bigger rings give more cover but cost more space and higher fees, so the fixed size is a deliberate balance between privacy and efficiency.
The size was not always this large. Monero began with an optional number of decoys, then made a minimum mandatory, and raised that minimum in steps across several network upgrades until it reached the current fixed 16. Each increase widened the anonymity set but also enlarged every transaction, which is the tension the protocol has to manage. Decoy selection has been tuned in parallel, so the outputs chosen are weighted toward the recent past, where real spends are most likely to originate.
Plausible deniability and untraceability
The deeper effect of ring signatures is plausible deniability. Because any output in a ring could be the real one, and because past outputs are reused as decoys across many different rings, the network cannot even say for certain which outputs have already been spent. Every output keeps a defensible claim to being unspent.
This is what makes Monero's outputs untraceable rather than merely obscured. Your real spend is indistinguishable from the decoys, and because your own past outputs serve as decoys in other people's rings, the whole set of possibilities stays tangled together (source: Monero project, what is Monero). Plausible deniability is also the root of Monero's fungibility: if no one can prove where a coin has been or whether it was spent, no coin can be singled out and flagged as tainted. The sender's privacy is only as strong as the keys behind it, though, and the roles of your view key and spend key are covered in Monero's view and spend keys. In practice, ring signatures turn every transaction into a knot that an analyst cannot cleanly pull apart.
What a blockchain analyst actually sees
It helps to picture a Monero transaction from the outside. An analyst reading the chain sees each input reference a ring of sixteen outputs, with no marker for which is real. The amounts are cryptographically hidden and the destination is a one-time address. There is very little to grab onto.
Compare that with a transparent chain, where an input points to exactly one previous output and an analyst can follow the money hop by hop. On Monero, each input instead points to sixteen candidate outputs, and the key image only confirms that some output in that set was spent, not which one. Because the same past outputs appear as decoys in many rings, an analyst cannot even build a reliable graph of which outputs are still unspent. Add the hidden amounts and the stealth-address destinations, and the usual tools of blockchain analysis, clustering addresses and tracing flows, largely stop working. What remains are side channels, such as timing, network-level metadata, or mistakes by the user, rather than the on-chain trail itself. That is the practical meaning of Monero's sender privacy: the ledger is public, but it does not answer the question an analyst most wants to ask.
The honest limits: how private are ring signatures really?
Ring signatures are strong, but they have not always been airtight. Early in Monero's history, researchers showed that weak decoy selection and optional, sometimes zero, decoys made many transactions traceable. Monero has since closed those gaps, but the honest answer is that privacy here is very good rather than mathematically absolute.
In 2017, academic work including "A Traceability Analysis of Monero's Blockchain" found that a large share of early inputs could be de-anonymized (source: Kumar et al., 2017). A separate empirical study the following year reached similar conclusions about those early transactions (source: Möser et al., 2018). The problems were concrete. Some transactions used a ring size of zero, meaning no decoys at all; decoys were sometimes chosen so poorly that the real, newest output stood out; and timing patterns leaked hints.
Monero's response was systematic. It made a minimum ring size mandatory, so every transaction became private by mandate rather than by choice (source: Monero project, about). It then raised that ring size over time, made confidential amounts mandatory in 2017 so amounts could no longer help link outputs, and refined how decoys are chosen, the same gamma-based selection described earlier. The result is that those old attacks no longer work on current transactions. Privacy research is ongoing, though, so the sober framing is that modern ring signatures make tracing very hard rather than provably impossible.
It is also worth separating the on-chain picture from everything around it. Even with strong ring signatures, privacy can still leak at the edges: through an exchange that knows your identity, a reused or published address, or network-level observation of when and where a transaction is broadcast. Those are not flaws in the ring signature itself, but they are part of an honest account of how private a real user actually is. If you are weighing that in practice, whether Monero is safe covers the real-world picture.
Where ring signatures fit in Monero's privacy
Ring signatures are one leg of a three-part privacy design. They hide the sender, stealth addresses hide the receiver, and confidential transactions hide the amount. All three are mandatory and apply to every transaction by default, which is what makes Monero private as a whole rather than only for users who opt in.
No single technique would be enough on its own. A hidden sender still leaks information if the receiver or the amount is visible, so Monero combines all three. The receiver side is handled by Monero stealth addresses, and the amounts are hidden by ring confidential transactions, which build directly on the ring-signature idea. From the vantage of an exchange operator, a mandatory and uniform ring signature is what makes Monero's privacy a property of the whole network rather than a setting a few users enable. That is a structural observation about the protocol, not a comment on price. Ring signatures are the piece that specifically severs the link between a payment and its sender, and they reach full strength only as part of that larger set. Understood together, the three layers answer the three questions a public ledger would otherwise expose: who sent a payment, who received it, and how much moved. Ring signatures answer the first, and only the first, which is why they are best understood as one precise tool rather than the whole of Monero's privacy.
Frequently asked questions
What is a decoy in a Monero transaction?
A decoy is a real past output belonging to someone else, pulled from the blockchain and added to your ring so your real spend blends in. Decoys are not fake entries created just for you; they are genuine outputs reused as plausible alternatives, which is exactly what makes the ring convincing. When your wallet signs, the decoys and your real output are mathematically interchangeable to anyone watching, so the presence of real, unrelated outputs in every ring is what gives the whole system its cover.
How many decoys does a Monero transaction use?
Currently 15. Monero uses a fixed ring size of 16, which is your one real output plus 15 decoys. The number is deliberately the same for every transaction, so no single transaction stands out by having a larger or smaller ring than the rest. The ring size has grown over the years as the protocol matured and as research showed that larger, uniform rings resist analysis far better than small or user-chosen ones.
Can a ring signature be traced back to me?
On a modern transaction, tracing the sender is extremely hard, because your real output is indistinguishable from 15 decoys and the amount is hidden as well. It is not a mathematical guarantee, though. Early Monero transactions that used weak or zero decoys were partly traceable, which is documented in published research. Today's transactions have closed those specific gaps, but honest sources describe ring-signature privacy as very strong rather than absolutely unbreakable.
Do ring signatures hide the transaction amount?
No. Ring signatures hide the sender only. The amount is hidden by a separate mechanism called ring confidential transactions, or RingCT, and the receiver is hidden by stealth addresses. All three run together by default on every Monero transaction, but each solves a different part of the privacy problem. It is a common misconception that ring signatures do everything; they are specifically the sender-hiding layer of a larger design.
How do ring signatures stop double-spending?
Through a key image. When you spend an output, your wallet publishes a unique tag that is derived from that specific output. The tag reveals nothing about which member of the ring is the real one, so it does not break your privacy, but it is always the same for a given output. If you ever try to spend the same output a second time, the identical key image appears again, the network notices the repeat, and it rejects the duplicate spend.
Are ring signatures unique to Monero?
The cryptographic idea predates Monero and appears in other systems, but Monero is the best-known cryptocurrency to make ring signatures mandatory for every transaction. Monero inherited the approach from the earlier CryptoNote protocol and has refined it heavily since, especially the way decoys are selected and the size of the ring. Making the technique compulsory and uniform, rather than optional, is a large part of what sets Monero apart.
Will ring signatures ever be replaced?
Possibly. Monero researchers have been developing newer privacy constructions that could eventually replace ring signatures with a design offering a much larger anonymity set, meaning your real spend would hide among far more possibilities than 15 decoys. If such a change is adopted, the aim would be stronger sender privacy with better efficiency, but the underlying principle, hiding your real spend among many equally plausible ones, would carry straight over.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Updated July 2026. Primary sources: the official Monero Moneropedia at getmonero.org, the Monero entry on Wikipedia, and the academic traceability analysis by Kumar et al. (2017). All facts independently verified against cited documentation current as of July 2026.
This article is educational and general in nature, not financial, legal, or tax advice. Cryptocurrencies like Monero carry real risks, including price volatility and regulatory changes, and privacy technology is strong but never an absolute guarantee of anonymity. Nothing here is a recommendation to buy, sell, or hold any asset. BloFin offers the XMRUSDT perpetual contract for trading; to get started, create a BloFin account, fund it with cryptocurrency, and open the XMRUSDT perpetual contract trading page. Do your own research and consider a licensed professional before making financial decisions.