Stealth Addresses Explained: How Monero Hides Transaction Recipients in XMRWallet

A user receives Monero in their wallet and publishes a single public address for convenience. Over time, that address appears in multiple transactions. An observer examining the blockchain cannot see amounts or transaction details due to Monero’s ring signatures and confidential transactions, but they can still see that one address is associated with many inbound payments. This pattern alone, when combined with metadata from exchanges, timing analysis, or other sources, can create a persistent identifier. Stealth addresses solve this problem by generating a unique destination for each payment without requiring the recipient to manage multiple addresses manually or publish multiple public keys.

The mechanism is elegant in principle but requires careful implementation to actually deliver privacy. XMRWallet, a non-custodial wallet designed exclusively for Monero, must handle the cryptographic operations correctly so that each incoming payment lands at a unique on-chain address while the wallet can still derive and recognize it during scanning. Understanding how this works—and what it does not protect—is essential for users relying on the wallet to maintain transaction privacy.

The problem with reusing a single public address

Bitcoin users often generate one address per payment to avoid direct linking. This practice exists because Bitcoin’s transparent ledger exposes all transaction relationships. A single address used repeatedly becomes a permanent beacon on the blockchain; anyone observing the chain can cluster payments and infer behavioral patterns or transaction volume. Monero users face a different pressure. The ring signature mechanism obscures which outputs were actually spent, and confidential transactions hide amounts, but the address itself remains visible.

If a user publishes one address and receives multiple payments to it, each payment references that same address in the transaction output. Blockchain observers cannot determine the amount or confirm the sender’s identity without the private keys, yet they can still enumerate all transactions involving that address. Over months or years, this creates a transaction history tied to a single identifier. The privacy loss may be limited compared to Bitcoin, but it contradicts Monero’s goal of preventing outside observers from building a transaction history.

Stealth addresses eliminate this link by ensuring that each payment creates a unique, unlinkable address on the blockchain. The recipient publishes a single public address or public key for convenience, but the sender’s wallet derives a one-time address from that public key and a random component. The transaction output goes to that one-time address rather than the published address. An observer cannot connect the one-time address to the public address without possessing the recipient’s private view key.

How stealth address generation works mathematically

The mechanism relies on elliptic curve cryptography, specifically the ability to derive keys and addresses through scalar multiplication and hashing. A Monero user’s wallet contains two key pairs: the spend key pair and the view key pair. The spend key pair controls whether funds can be moved; the view key pair allows the wallet to identify incoming payments without the ability to spend. The public address published by the user contains both the public spend key and the public view key.

When someone sends Monero to this address, they perform the following steps. First, they generate a random number called the transaction secret key. Second, they multiply this secret key by a standard generator point to create a public transaction key, which is included in the transaction. Third, they combine the recipient’s public view key with the transaction secret key using Diffie-Hellman key exchange to derive a shared secret. Fourth, they hash this shared secret to produce a one-time key offset. Finally, they add this offset to the recipient’s public spend key to compute the one-time address where the funds are sent.

The critical insight is that every payment produces a different one-time address because each payment uses a different random transaction secret key. Even if the same sender makes multiple payments to the same recipient, each payment creates a mathematically unrelated address. An observer examining the blockchain sees multiple distinct addresses and cannot determine which ones belong to the same recipient without possessing the private view key.

How the wallet recognizes stealth address payments

The recipient’s wallet must periodically scan the blockchain to find incoming payments. This scanning process is computationally intensive but essential to privacy. When scanning, the wallet performs the inverse of the sender’s computation. For each transaction on the blockchain, the wallet extracts the public transaction key. It then multiplies this key by the recipient’s private view key—which only the recipient possesses—to derive the same shared secret that the sender used. Hashing this shared secret produces the same one-time key offset.

Adding this offset to the recipient’s public spend key yields the one-time address. The wallet checks whether this address matches any output in the transaction. If it does, the output belongs to the recipient. Because only the recipient has the private view key, only the recipient can perform this computation. Blockchain observers cannot derive the shared secret, compute the offset, or determine which addresses belong to which recipient.

Once the payment is recognized, the recipient’s wallet can spend the funds by using the offset and the private spend key. The mathematics ensure that the recipient’s wallet can reliably distinguish its own payments from all other blockchain transactions without leaking information to observers. This is why XMRWallet, like all Monero wallets, keeps the private view key on the device rather than on a server. Server-side scanning would require uploading the private view key, which would immediately compromise the entire privacy model.

Implementation details and scanning efficiency

Full wallet scanning requires examining every transaction output on the entire Monero blockchain. For a node running locally, this means storing the full chain and checking each output—currently numbering in the hundreds of millions. For a lightweight or mobile wallet using remote nodes, this creates a trade-off between scanning speed and privacy. A remote node operator can observe which addresses are being queried, potentially inferring which addresses belong to which user.

XMRWallet implementations address this through client-side scanning and private view key storage. The wallet downloads the blockchain data, extracts the transaction public keys, and performs all stealth address derivation locally. No information about which addresses the user controls is transmitted to external servers. However, the initial synchronization can be time-consuming for a new wallet or after a period offline. Some implementations use cached blockchain data or compressed formats to reduce bandwidth, but the core requirement remains: the wallet must be able to scan independently.

Subaddresses are a related feature that Monero wallets commonly support alongside stealth addresses. Rather than publishing a single public address and receiving payments via derived stealth addresses, a user can derive multiple subaddresses from the original key material. Each subaddress is independently associated with the wallet and can be published separately for different contexts. From a privacy perspective, subaddresses offer a weaker guarantee than stealth addresses because a determined observer could theoretically link multiple subaddresses to the same recipient through transaction graph analysis or other techniques. However, they provide a practical convenience: a user can share a distinct subaddress with each merchant or service, making it easier to track which counterparty sent a particular payment.

What stealth addresses protect and what they do not

Stealth addresses prevent blockchain observers from linking multiple payments to a single recipient based on the on-chain address alone. Each payment appears as a transaction to a different, apparently unrelated address. An outside observer cannot cluster these payments or infer transaction volume without additional information. This protection applies to all observers, including node operators, exchange services examining withdrawals, or surveillance entities analyzing the chain.

Stealth addresses do not, however, protect against timing analysis. If a user receives a payment within seconds of a publicly announced transaction from an exchange, timing alone may reveal the connection. They do not protect against metadata leakage through payment processors or services. If a user withdraws XMR to their wallet immediately after a known event or purchase, that behavior may be linkable despite the stealth address. They do not protect against malware or compromised devices. If the wallet software itself is altered or the device is infected, the private keys can be stolen before they’re used. They do not protect against social engineering or coercion. A user can be persuaded or forced to reveal their private view key or share transaction information.

Additionally, stealth addresses do not protect the network layer. A wallet connecting to a remote node over an unencrypted connection can leak IP address information. If a user’s device connects directly to the Monero network without Tor or another anonymity network, an ISP, network operator, or adversary observing the connection can see that the device is participating in Monero transactions. This is why users valuing strong privacy should use Tor or I2P alongside XMRWallet or any other Monero wallet. The cryptographic privacy provided by stealth addresses applies to the ledger level; it does not extend to the network layer unless additional protections are configured.

Technical considerations for wallet developers and users

Implementing stealth address support correctly requires precise elliptic curve operations. The wallet must use the same curve, hashing function, and key derivation as the Monero protocol specification. Any deviation—incorrect scalar multiplication, wrong hash algorithm, or flawed key management—can produce incorrect one-time addresses that either do not match the sender’s computation or leak information about the private keys.

Users should verify that their wallet implementation is open-source and has been reviewed by cryptographic experts. Closed-source wallets claiming to support Monero stealth addresses cannot be independently audited for correctness. Users should also understand that stealth address functionality is not optional in Monero—it is the default and only payment mechanism. Unlike some privacy coins with optional privacy features, every Monero transaction uses stealth addresses. This means that basic Monero privacy does not require special configuration; however, it also means that any flaw in stealth address implementation affects all transactions.

Recovery of funds relies on the private view key and private spend key. A user who loses the recovery seed cannot generate new keys and may be unable to access funds held at stealth addresses. Backups must be stored securely offline. For higher-value balances, a hardware wallet or paper backup stored in a secure location is appropriate. Testing the recovery process—creating a new wallet from the seed and verifying that funds are correctly recognized—is important before depositing large amounts. Users can review wallet options and implementation details through the XMRWallet official site, which documents the technical approach and privacy guarantees.

The role of stealth addresses in Monero’s broader privacy architecture

Stealth addresses are one component of Monero’s privacy model, working alongside ring signatures and confidential transactions. Ring signatures obscure the sender by mixing the actual input with decoys, making it statistically difficult to determine which output was actually spent. Confidential transactions hide the amount transferred, replacing explicit amounts with cryptographic commitments. Together, these mechanisms provide layered privacy: the sender is obfuscated, the amount is hidden, and the recipient’s identity is not permanently linked to a single address.

The combination is more robust than any single mechanism alone. An attacker cannot simply analyze amounts to guess the sender or recipient. They cannot observe transaction volume by watching a single address. They cannot perform input-output linking analysis because the ring signature creates ambiguity about which outputs were actually used. This is why Monero is considered a default-private blockchain while Bitcoin requires manual address management and other coins offer optional privacy features that users must explicitly enable.

However, this robustness depends on adoption. If most Monero users do not participate in large, well-mixed ring signatures, the ring signature protection weakens. If most transactions use small ring sizes, statistical attacks become more practical. If the blockchain is small and transaction patterns are predictable, timing and heuristics may reveal information. Stealth addresses provide individual transaction unlinkability, but broader privacy depends on network-wide parameters, active participation, and sufficient transaction volume to provide genuine mixing.

Practical implications for Monero wallet users

From a user perspective, stealth address functionality should be transparent. The wallet automatically applies stealth address derivation when receiving payments. No configuration is required; the user simply publishes their address and receives funds as usual. The privacy benefit occurs on the blockchain without requiring active participation or repeated decision-making.

The practical implication is that a user can safely publish one address on their website, in their profile, or in business documentation. Unlike Bitcoin users who should generate a new address for each payment, a Monero user can reuse the same published address without creating persistent identifiers. Each payment to that address generates a unique stealth address on the blockchain, preventing observers from clustering payments or analyzing transaction volume.

However, users should remain aware of other privacy surfaces. Publishing an address publicly creates a connection between their online identity and that address. If someone later learns that the user controls that address through social engineering, payment tracking, or other means, all past and future payments can be associated with the user’s identity in the observer’s mind. The stealth address mechanism prevents the blockchain itself from creating this link, but it does not protect against out-of-band disclosure. Users should consider whether publishing their address is necessary and whether alternative payment mechanisms—such as using a different subaddress for each transaction context—might provide additional separation.