Monero

Why this rail

Monero is the cryptocurrency that treats transactional privacy as a default rather than as an opt-in. Every transaction on the network uses ring signatures to obscure the sender among a set of decoy outputs, stealth addresses to hide the recipient, and RingCT (confidential transactions) to hide the amount. There is no transparent mode the protocol could be coerced into. A subpoena to the operator of a Monero node yields a record of a payment received at a subaddress — and almost nothing else of value to a blockchain-analytics firm.

For a journalist receiving payment for a story, an NGO disbursing a stipend to a contributor in a censored region, or an archivist underwriting hosting for a leak repository, the default-private posture is the point. Bitcoin can be made private with effort and discipline; Monero is private without effort and without discipline. The asymmetry matters because operational mistakes made under deadline pressure do not retroactively de-anonymise the payer.

We accept Monero through a self-hosted node behind BTCPay. Every invoice is issued against a fresh subaddress that is never reused, and only the view key for that subaddress sits on our payment infrastructure — meaning we can verify incoming payments but not construct outgoing transactions from the same view. Confirmations are taken at ten blocks, which corresponds to the privacy-budget unlock the protocol guarantees and runs in the order of twenty minutes at standard block times.

Acquisition routes are P2P or atomic swap. Bisq for desktop trades over Tor, AgoraDesk and the LocalMonero successors for fiat-to-XMR, RoboSats for BTC↔XMR atomic swaps over the Tor network, and the integrated swap pages of self-custodial wallets (Cake Wallet, Feather) for cross-chain conversions through Side Shift, FixedFloat, or Trocador. The exchanges that still list Monero typically refuse withdrawals to fresh addresses, which defeats the privacy property the rail is chosen for.

How to pay

At checkout, choose Monero as the payment rail. The order page generates a fresh subaddress scoped to this invoice and an exact XMR amount, denominated from a coingecko mid-price at the moment of generation. The subaddress is never reused for a subsequent order, and the view key required to verify inbound payment sits only on the operator's side.

From a self-custodial Monero wallet — Cake Wallet on mobile, Feather or the official GUI on desktop, Monerujo for Android — scan the QR or paste the subaddress and send the indicated amount. The wallet computes a small network fee in the order of a few cents that is paid in addition to the invoice amount; the received amount on our side must match the invoice exactly. Hardware-wallet support exists through Ledger and Trezor for customers who keep XMR balances cold.

The invoice page polls the chain and counts confirmations as blocks land. Provisioning fires automatically once the tenth confirmation is observed — typically twenty minutes from send. If a payment is short by less than a percent of the invoice amount, the order is auto-credited; larger underpayments hold the invoice open until topped up. A send to a stale subaddress from an expired invoice is recoverable by writing in with the transaction view key, which is a read-only credential that does not authorise spends.

Closing notes

Monero is the rail to pick when financial surveillance is part of the threat model. Pick it for journalism that names a litigious counterparty, for an NGO whose donor list is itself a target, for an archive whose mere funding chain a foreign government may seek to reconstruct. Pick a different rail when convenience or balance management on a non-Monero wallet matters more than the default-private property — which, for OffshorePress's catalogued audience, is rarely the case.