Privacy coins explained: how Monero, Zcash and others work

Privacy coins are cryptocurrencies built to hide who paid whom, and how much. Bitcoin, like most blockchains, publishes every payment for anyone to read.^[1] Privacy coins use cryptography such as ring signatures, stealth addresses and zero-knowledge proofs to keep those details off the public record, while the network can still check that every payment is valid.^[2][3]

Why does payment privacy matter?

On a public blockchain, every transaction is stored permanently, and anyone can look up the balance and full history of any address.^[1] Addresses don’t carry names, but once someone links one to you, perhaps because you shared it to get paid, they can follow your money from then on.

That exposes things most people expect their bank to keep private:

• Salary. If your employer pays you in crypto, anyone who knows your address can see what you earn and where it goes.
• Savings. A visible balance tells strangers how much you hold, which can make you a target.
• Donations. A gift to a campaign, a cause or a person in need stays on the public record for good.
• Business. Competitors can watch a company’s suppliers, prices and takings.

There’s an economic reason too, called fungibility: every unit of a currency should be interchangeable with any other, as one banknote is with the next. On a transparent chain, coins carry their past, and Bitcoin.org warns that used addresses become “tainted by the history of all transactions they are involved with”.^[1] If some coins can be singled out because of where they’ve been, not every coin is equal. Hiding the history removes that problem.

How do public blockchains reveal payments?

Bitcoin is often called pseudonymous: its addresses are strings of characters, not names. But Bitcoin.org itself says addresses “cannot remain fully anonymous”, because people usually have to reveal who they are to buy goods or services.^[1] An exchange that checked your ID knows which addresses you withdrew to, and a shop that posts you a parcel knows the address you paid from.

From there, the trail is public. Bitcoin.org advises using a new address for each payment,^[1] but that only limits the damage: every payment still sits on the record, waiting to be connected. Our guide to Monero vs Bitcoin explains how analysts connect them, and what Bitcoin users can do about it.

How does a privacy coin work?

Every privacy coin solves the same puzzle. The network has to confirm that each payment is valid: the coins exist, nobody has spent them before and no money has appeared from nowhere. At the same time, it should learn as little as possible about who paid whom. Projects solve this in different ways.

Monero: ring signatures, stealth addresses and hidden amounts

Monero combines three techniques, and every transaction has to use all of them.^[2]

• Ring signatures hide the sender. A ring signature proves that one member of a group signed, without showing which one, so the coin actually being spent is hidden among others.
• Stealth addresses hide the receiver. The sender’s wallet creates a new one-time address for each payment, so payments to the same person can’t be linked.
• RingCT (Ring Confidential Transactions) hides the amount. Every node can still check that what goes into a transaction equals what comes out, plus the fee.^[2]

What is Monero? covers the basics, and How private is Monero? looks at the limits.

Zcash: zero-knowledge proofs and shielded pools

A zero-knowledge proof lets you prove that something is true without revealing anything else about it. Zcash’s shielded addresses use these proofs so that transaction data can be encrypted yet still checked by every node, and a payment from one shielded address to another hides both addresses, the amount and the memo.^[3] Coins held this way sit in what Zcash calls a shielded pool.

Zcash also has transparent addresses, which work much like Bitcoin’s and offer no privacy.^[3] Shielding is a choice each user makes. Monero vs Zcash compares the two designs in detail.

Dash: optional CoinJoin mixing

Dash offers CoinJoin, which runs your coins through a series of transactions with other users so that an observer has difficulty tracing where they came from. The mixing sessions run through servers on the Dash network called masternodes. In the Dash Core wallet, CoinJoin is switched off by default: you choose how much to mix, then start it yourself.^[4] Coins you don’t mix get no extra protection.

Grin and Beam: Mimblewimble

Mimblewimble is a different way to build a blockchain. Grin, which uses it, records no amounts and no addresses: amounts are hidden, and outputs are cryptographic commitments rather than addresses that point to a person.^[5] Grin’s documentation is open about the limits. Someone running nodes connected to many peers can see which outputs a new transaction spends before it is merged into a block, and an almost complete transaction graph, the map of which coins fed which, can be built today.^[5]

Beam also builds on Mimblewimble, combined with a protocol called Lelantus. It says all Beam transactions are private by default, and that no addresses or other identity information are ever recorded on its blockchain.^[6]

Firo: Lelantus Spark

Firo switched on Lelantus Spark in January 2024. Spark transactions hide the sender, the receiver and the amount, using zero-knowledge proofs so that anyone can still verify the blockchain, and Firo says Spark avoids the special trust requirements of some other zero-knowledge systems. Spark addresses are the default in Firo’s official wallets, but transparent addresses still exist, for example for sending coins to an exchange.^[7]

Railgun: privacy on Ethereum

Privacy isn’t limited to separate coins. Railgun is an on-chain privacy system for Ethereum and other compatible blockchains, built from smart contracts and zero-knowledge cryptography. Once tokens are moved into Railgun’s smart contract, outsiders can’t tell tokens and wallets apart, and each user gets a private address starting with “0zk”.^[8] It’s opt-in: only the tokens you move in are covered.

Why does it matter whether privacy is on by default?

Privacy works like a crowd: you’re hidden only among the people doing the same thing. Monero’s FAQ puts it plainly: your anonymity set, the crowd you blend into, is the set of people using Monero.^[2] When privacy is compulsory, everyone is in that crowd, including people who never think about it.

When privacy is optional, the crowd is only the people who opt in, and the edges leak. On Zcash, moving coins from a transparent address into a shielded one reveals the amount going in, and moving them back out reveals the amount coming out.^[3] If someone shields 3.71 ZEC and 3.71 ZEC leaves the pool an hour later, an observer can make a good guess. Optional privacy also depends on every wallet and service you use supporting it, and on you remembering to use it.

What are the top privacy coins?

There’s no official list, and rankings by market value say nothing about privacy. These are the coins and systems covered in this guide, and how they compare:

Which crypto is best for privacy?

None is best for everyone, and we don’t rank them. The useful question is what you need to hide, and from whom. Compare them on:

• What’s hidden. Mixing makes coins harder to trace; encryption keeps details such as the amount off the public record.
• Default or opt-in. Default privacy gives everyone the same crowd. Opt-in privacy protects you only when you use it correctly.
• The size of the crowd. A private mode that few people use gives you few people to hide among.
• Track record. Newer cryptography has had less time to be tested by researchers.
• Practical access. Wallet support and exchange listings vary by coin and by country, and they change.^[9]

What can’t privacy coins hide?

A privacy coin protects what’s written on the blockchain. It can’t protect everything around it.

• Your IP address. When your wallet sends a transaction, the computers it connects to can see where it came from. Some coins pass new transactions through a few peers first to hide the origin; Grin uses a protocol called Dandelion++ for this.^[5] Tor and your choice of node matter too.
• Exchange records. An exchange that verified your identity, a process known as KYC (“know your customer”), knows what you bought and where you withdrew it. Access varies too: as of November 2026, Kraken doesn’t let clients in the EEA, the UK, Canada or Australia deposit or trade Monero, and its Australian clients can’t hold Zcash or Dash either.^[9]
• The law. From 10 July 2027, an EU regulation bars banks, other financial institutions and crypto-asset service providers from keeping accounts that let transactions be anonymised or obscured, “including through anonymity-enhancing coins”.^[10] Our guide to Monero and the EU rules explains what changes.
• Your own mistakes. Posting an address next to your name, reusing a transparent address or moving identical amounts in and out of a shielded pool can undo the cryptography. Monero’s FAQ is blunt: “There is no such thing as 100% anonymous.”^[2]

Is Monero illegal in the US?

As far as we can find, no: as of November 2026, no US law bans owning or using Monero, and Kraken, for example, doesn’t list it among the assets it restricts for US clients.^[9] The pressure falls mainly on regulated businesses such as exchanges, some of which restrict or drop it. Why exchanges delist Monero explains the reasons, and Is Monero legal in the US? covers the details.