Cryptocurrency privacy: the six qualities that make a coin private

Why a public ledger needs privacy

A blockchain works because everyone can check every transaction. That same openness makes it the most complete payment record ever kept: once one address is linked to a person, through an exchange withdrawal, a shop delivery or a single public post, every payment that address made or received is linked too, and so is every address it touched. The record cannot be edited or deleted later.

The Bitcoin whitepaper saw this and placed privacy outside the ledger.

"The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone."
§10 Privacy

Its method was keys that carry no names and a new key pair for each transaction. Chain analysis has since shown how far that goes and where it stops: amounts, timing and the way coins are spent together link addresses to each other, and one link to a name is enough to unravel the rest. The last three qualities close those gaps inside the protocol.

1. Keys not tied to an identity

The first quality is the one the whitepaper names: holding and sending the coin needs a key, not a name. On almost every public chain this holds. It fails where the chain's own rules make an identity check a condition of taking part: Concordium requires every account to carry an identity issued by an approved provider, and permissioned ledgers such as STO Chain admit only users who have passed one.

An exchange that asks for a passport does not fail this test, since the chain itself still accepts a payment from anyone with a key. It is the protocol that is graded, not the businesses built on it.

2. A UTXO ledger

The second quality is how the ledger records value. There are two designs. A UTXO ledger, the one the whitepaper describes, records coins as unspent transaction outputs: each is a separate amount locked to a key, and a payment spends whole outputs and creates new ones. An account ledger, used by Ethereum, Tezos, Solana and most smart-contract chains, keeps a running balance per address that payments add to and subtract from, like a bank account.

The difference shows when coins are spent. A UTXO payment of 0.3 from an output of 1 creates two new outputs, 0.3 to the receiver and 0.7 in change, and the wallet sends the change to an address it has never used. Several things follow from that design:

• Change moves on. After every payment the remaining coins sit at a fresh address, so the next payment does not come from the address the last one did.
• No single balance. A holder's coins are many outputs at many addresses. Nothing on the chain adds them up or says they share an owner until they are spent together.
• Spend only what is needed. A wallet can choose which outputs pay for a payment, and leave the rest untouched and unlinked.
• Fees come from the coins spent. An output can be spent as it is. Nothing has to be sent to an address first to pay for its fee.
• No running count. An account carries a public nonce, the number of payments it has sent; an output has no history beyond the transaction that created it.

An account works the other way on each point. The remainder of a payment stays at the sending address, so its next payment comes from the same place. Funds spread over several addresses cannot be spent in one transaction: they are first swept into one, and each sweep links the addresses in public. And an address that sends must hold the chain's coin for fees, so funding a fresh address for its first payment links it to whichever address paid.

A UTXO ledger is not private by itself. Spending several outputs in one transaction suggests they have one owner, and the change output can often be told from the payment by its amount or address type; chain analysis is built on those two signals. But the design leaves room that an account does not: tools such as CoinJoin, and protocols that hide which output was spent, all work on outputs.

3. New addresses from one key: HD wallets and xpub

The third quality is the whitepaper's advice that "a new key pair should be used for each transaction", made practical. A hierarchical deterministic (HD) wallet, standardised in Bitcoin as BIP32, derives every key from one seed. Its extended public key, the xpub, derives every receiving address in turn without the private keys. A shop's server holding only the xpub can show each customer a new address, a watch-only wallet can follow every payment, and a thief who takes the server takes nothing it can spend. On the chain, the addresses look unrelated: nothing links them to each other or to the xpub.

Privacy coins do the same with their own keys. Monero's subaddresses are derived from the view key and the public spend key, without the spend key. Zcash derives diversified shielded addresses from one incoming viewing key, and Firo does the same for Spark.

The quality belongs to the key scheme more than to the ledger. Ethereum uses the same curve as Bitcoin, so an Ethereum xpub derives fresh receiving addresses just as well; what it cannot fix is the spending side of the account model above. Chains whose standard keys are Ed25519 under SLIP-0010, including Solana, Stellar, Algorand and NEAR, allow hardened derivation only: each new address needs the private seed, and no public key can derive them.

The xpub itself is sensitive. Whoever holds it can list every address it derives and every payment they received, past and future, so a wallet that sends it to a server shares its whole history with that server.

4. Hidden amounts

The fourth quality hides how much moved. Amounts are what make most payments recognisable: a salary, a rent payment, an exchange withdrawal of an exact figure. A protocol that hides them records a cryptographic commitment in place of the number, with a proof that no coins were created from nothing.

Monero has hidden every amount since RingCT in January 2017. Zcash's shielded pools, Sapling in 2018 and Orchard in 2022, hide the amounts of shielded transactions. Grin and the other Mimblewimble chains hide every amount from launch, and Litecoin's MWEB extension block, active since May 2022, hides amounts for coins moved into it.

5. Hidden sender and receiver

The fifth quality hides who paid whom, and it takes two parts. The sender is hidden when a transaction does not reveal which earlier output it spends: Monero's ring signatures mix the real output with decoys, and Zcash's zero-knowledge proofs show that a valid note was spent without saying which. The receiver is hidden by one-time or stealth addresses, so a published address never appears on the chain as the destination of a payment.

Both parts are needed. Grin hides amounts and records no addresses, but its transactions spend their inputs openly, so the graph of which output funded which can still be followed; Litecoin's MWEB gives receivers stealth addresses but does not hide what is spent. Both pass hidden amounts and fail hidden parties.

6. Hidden origin on the network

The sixth quality sits below the ledger. When a wallet broadcasts a transaction, the first node to relay it learns its IP address, and anyone watching enough nodes can often tell which one heard it first. A chain that hides the transaction on the ledger but announces it from the sender's own address has left a door open.

Dandelion++ closes it by passing each new transaction privately along a short random path before it is announced, so it appears to come from somewhere else. Monero's node has done this by default since 2020, and Firo, DigiByte and Grin do the same. Tor or I2P transport built in and switched on counts as well. Tor that a user must install and configure does not: Bitcoin Core 31.0 can send a node's own transactions over Tor or I2P, but only when the user sets it up, and Zcash's nodes relay directly.

Optional or by default

A privacy feature hides a payment among the others that used it. When every transaction uses it, as on Monero or Pirate Chain, each one hides among all of them. When it is optional, as with Zcash's shielded pools, Litecoin's MWEB or Tezos's Sapling transactions, the private payments hide only among the other private ones, and moving coins in and out of the private part can itself be traced: an amount that enters the shielded pool and the same amount that leaves it soon after are easy to pair.

So the Grade scores optional privacy less than default privacy. Hidden amounts or hidden parties on every transaction score 100 of 100; a feature a user must opt into, offered on the main network beside transparent transactions, scores 50. Pirate Chain and Zcash share the same shielded-transaction design, but Pirate Chain shields every payment and scores 8, while Zcash leaves shielding to the user and scores 6.7.

What does not count

Wallet tools are left out. CoinJoin on Bitcoin, CashFusion on Bitcoin Cash and Dash's CoinJoin mixing combine several users' payments into one transaction so that outputs are harder to match with inputs. They can help, but the amounts stay public, the protocol guarantees nothing about them, and a user who does not run the tool gets none of it. Sidechains, layer 2s and privacy applications built as smart contracts are left out for the same reason: they are separate systems a user may choose, not properties of the coin.

The cost: checking the supply

On a transparent chain anyone can add up the outputs and confirm the supply. With hidden amounts that sum is replaced by cryptographic proofs, and a flaw in them can create coins nobody sees. Both leading privacy coins have had one. Monero fixed a flaw in 2017 that would have let an output be spent more than once, after it was used on Bytecoin, a chain sharing its code. Zcash's own team found a counterfeiting flaw in its original shielded proofs in March 2018, removed it with the Sapling upgrade that October and disclosed it in February 2019, with no sign that it had been used.

Neither costs points in privacy. A flaw in the chain's own protocol counts in the development criterion, as a security fix once it is fixed and a vulnerability while it is open. The trade is real, though: a private ledger is checked by fewer means than a public one, and the tools for an audit, such as the view keys Monero and Zcash both offer, are in the holder's hands, not the public's.

Privacy and fungibility

In the Grade's sound money measure, fungibility is a property of the units: a ledger of amounts passes, because one coin of a given amount is worth any other. Traceability is where privacy meets it in practice. On a transparent chain a coin's history can be read, and coins that once passed through a sanctioned address or a hack can be refused by an exchange, which makes some units worth less than others to the people who hold them. On a chain that hides amounts and parties there is no history to read, so no unit can be singled out.

The six qualities, coin by coin

The privacy criterion scores each quality 0 to 100 and averages them out of 10, an optional feature scoring 50. A few of the coins the site grades, as researched on 30 October 2026, with – where a quality is not yet researched:

Of the 440 coins with a privacy score, 4 pass every quality measured and 16 score 7.5 or more. Most score between 2 and 5: keys without names, a UTXO ledger or not, and nothing hidden.

How the Grade scores privacy

Privacy is one of the four sections of the Cryptocurrency Standards and one criterion of the Grade, weighted like every other. Each of the six qualities scores 0 to 100: 100 for a yes, 0 for a no, and 50 for hidden amounts or parties a user must opt into. The criterion is their average, out of 10, from at least two measured. A check not yet researched is left out of the score and shown in the grade's range. Each asset page lists the six with the source for each, and the method sets out the rules in full. Tokens are not scored on privacy: a token has no protocol of its own, and its privacy is its host chain's.

Questions