RingCT

Ring Confidential Transactions — RingCT — is the Monero protocol upgrade activated at the January 2017 hard fork that hid transaction amounts on the chain. Before RingCT, Monero transactions exposed amounts in plaintext on the chain even while the input and the receiving address were obscured by ring signatures and stealth addresses respectively; chain analysis could partition the transaction graph by amount and recover significant probabilistic information about flows. RingCT closed that channel.

The construction replaces the plaintext amount in a transaction output with a Pedersen commitment — a cryptographic commitment of the form C = aG + xH, where a is the amount, x is a blinding factor known to the sender (and shared with the receiver), and G and H are independent generators on the underlying elliptic curve. The commitment hides the amount from a chain observer while permitting algebraic checks: a verifier can confirm that the input commitments sum to the output commitments (preserving the no-inflation invariant) without learning any of the individual values. Range proofs — originally Borromean range signatures, replaced by Bulletproofs at the October 2018 fork and by Bulletproofs+ at the August 2022 fork — accompany each output to demonstrate the committed amount is in a valid range (non-negative and within the 64-bit space).

The aggregate effect of RingCT, ring signatures, and stealth addresses is the default-private transaction surface that distinguishes Monero from chains where privacy is opt-in (Bitcoin under CoinJoin or Zcash under the shielded pool). On Monero every transaction participates in the privacy set by default; the privacy is not a feature the user can forget to turn on.

For an offshore-hosting operator that accepts Monero the amount-hiding property is what makes the payment route resistant to chain analysis that targets flows of specific size — a frequent technique in commercial chain-analytics tooling. The published payment dossier on Monero cites RingCT as one of the three privacy primitives the operator relies on for the payment surface.