What is RingCT in Monero?

RingCT (Ring Confidential Transactions) is the cryptographic system that hides transaction amounts in Monero. Introduced in January 2017 (mandatory since September 2017), it ensures that nobody except the sender and receiver can see how much XMR was transferred. It uses Pedersen commitments to hide amounts while mathematically proving that inputs equal outputs.

How does RingCT hide amounts?

RingCT uses Pedersen commitments — a cryptographic technique that 'commits' to a value without revealing it. The commitment looks like random data on the blockchain, but the math ensures: (1) the sender can't create XMR from nothing (inputs = outputs + fee), and (2) all amounts are positive (no negative amounts to inflate supply). Range proofs (Bulletproofs+) verify these properties without revealing the actual numbers.

What are Bulletproofs in Monero?

Bulletproofs (and the newer Bulletproofs+) are efficient range proofs used in RingCT. They prove that a committed amount is between 0 and 2^64 without revealing the amount. Bulletproofs+ (implemented in August 2022) reduced transaction sizes by ~5-7% compared to the original Bulletproofs, saving fees and blockchain space.

Was RingCT always part of Monero?

No. RingCT was added in January 2017 and became mandatory in September 2017. Before RingCT, Monero transaction amounts were visible on the blockchain. Ring signatures and stealth addresses already hid senders and receivers, but amounts were public. RingCT completed the privacy trifecta: hidden sender + hidden receiver + hidden amount.

Can RingCT be broken?

RingCT is based on the Discrete Logarithm Problem, which is believed to be computationally infeasible with classical computers. Quantum computers could theoretically break it, but Monero's development community actively researches post-quantum alternatives. As of 2026, no known attack has compromised RingCT in practice.

RingCT — How Monero Hides Transaction Amounts

TL;DR: RingCT (Ring Confidential Transactions) hides how much XMR is sent in every transaction. It uses Pedersen commitments to encode amounts as math, and Bulletproofs+ to prove amounts are valid — all without revealing the actual numbers. Combined with ring signatures (hidden sender) and stealth addresses (hidden receiver), RingCT completes Monero's privacy: who sent what to whom is all hidden.

Monero's Three Privacy Layers

Ring Signatures Hides the sender among decoys

Stealth Addresses Hides the receiver (one-time addresses)

RingCT Hides the transaction amount

Each layer hides a different piece of information. Together, they make Monero transactions fully opaque — an outside observer sees nothing useful on the blockchain.

The Problem RingCT Solves

In Bitcoin, every transaction shows the exact amount transferred. Anyone can see that address A sent 0.5 BTC to address B. This reveals spending patterns, income, and wealth.

Before RingCT (pre-2017), Monero had the same problem. Ring signatures hid who sent funds, and stealth addresses hid who received them, but the amount was publicly visible. An observer could track value flows even without knowing identities.

RingCT fixed this by hiding amounts cryptographically while still proving the transaction is valid (no XMR created from nothing).

How It Works (Simplified)

Step 1: Pedersen Commitments

Instead of putting the real amount on the blockchain, Monero uses a Pedersen commitment — a mathematical value that "locks in" the amount without revealing it.

      Commitment = (amount × G) + (blinding_factor × H)

      G, H = known elliptic curve points

      amount = the real XMR value (only sender/receiver know)

      blinding_factor = random secret value

      Result: a point on an elliptic curve that reveals nothing about the amount

The commitment is binding (the sender can't change the amount after committing) and hiding (nobody can extract the amount from the commitment without the blinding factor).

Step 2: Proving Inputs = Outputs

Every valid transaction must satisfy: sum of inputs = sum of outputs + fee. If this doesn't hold, XMR would be created or destroyed.

The genius of Pedersen commitments is that this verification works on the commitments themselves — without knowing the actual amounts:

      Commit(input1) + Commit(input2) = Commit(output1) + Commit(output2) + Commit(fee)

      This equation holds if and only if the underlying amounts balance.

      Miners verify this without learning any individual amount.

Step 3: Range Proofs (Bulletproofs+)

There's a subtle attack: what if someone creates an output with a negative amount? They could pair it with a large positive output, effectively creating XMR from nothing. The math would still balance.

Range proofs prevent this. They prove that every committed amount is between 0 and 2^64 — without revealing the amount. This is the most computationally expensive part of RingCT.

      Bulletproofs+ (2022): Monero upgraded from Bulletproofs to Bulletproofs+ in August 2022, reducing range proof sizes by ~5-7%. This means smaller transactions, lower fees, and less blockchain bloat — while maintaining the same security guarantees.
    

RingCT Timeline

2016: Paper Published

Shen Noether publishes the RingCT paper, proposing hidden amounts for CryptoNote-based cryptocurrencies.

January 2017: Optional Activation

RingCT goes live on Monero mainnet as an optional feature. Users can choose to hide amounts.

September 2017: Mandatory

RingCT becomes mandatory. All Monero transactions now hide amounts. The last transparent transactions are history.

October 2018: Bulletproofs

Bulletproofs replace Borromean range proofs. Transaction sizes drop ~80%. Fees plummet.

August 2022: Bulletproofs+

Bulletproofs+ further reduces proof sizes by ~5-7%. Current state of the art.

RingCT vs Other Privacy Approaches

Technology	Hides Amounts?	Used By	Trade-off
RingCT (Pedersen + Bulletproofs+)	Yes (mandatory)	Monero	Larger transactions than transparent chains
zk-SNARKs	Yes (optional in Zcash)	Zcash	Trusted setup required, optional = weak
Mimblewimble	Yes (mandatory)	Grin, Beam, MWEB (Litecoin)	No addresses, interactive receiving
CoinJoin	No	Bitcoin (Wasabi, Samourai)	Amounts visible, mixing only
Transparent	No	Bitcoin, Ethereum, most chains	Everything public

What's Next: FCMP

Monero is preparing Full-Chain Membership Proofs (FCMP) — a major upgrade that replaces ring signatures with a system where the anonymity set is the entire blockchain. RingCT will continue hiding amounts. FCMP upgrades the sender privacy from "16 decoys" to "everyone who ever transacted." See our FCMP guide for details.

Why RingCT Matters

Without RingCT, Monero would be like Bitcoin with extra steps — ring signatures would hide senders, but amount analysis could still trace value flows. RingCT is the piece that makes Monero truly fungible: when nobody can see amounts, no coin can be "worth less" because of its history.

This fungibility is why P2P trading works safely with Monero. You never have to worry about receiving "tainted" coins — every XMR is equal.

Need private EUR↔XMR trading? Cash by Mail (EU-wide), Face-to-Face (SW Germany). 683 trades, 454 partners, 100% feedback. Contact me on Telegram.