Monero’s ring signatures are the part of every transaction that hides the sender, and the ring size is simply how many decoy outputs stand next to your real one. For years the network sat at 11, meaning every signature mixed your output with 10 decoys picked from the past outputs of others. That number was never a security boundary in itself. What protects you is the probability that an observer picks the real spend out of the set, combined with whether those decoys are statistically plausible.
Why 11 was chosen: when ring size 11 went live with Monero 0.13 in late 2018, it was a compromise. Bigger rings cost more transaction weight, and block space is finite. Research at the time suggested 11 gave a reasonable margin against plausible-deniability attacks without blowing up fees. It held up for years, but chain analysis kept improving, and the weak point was never really the count. It was decoy selection.
The old decoy selection algorithm had a known skew. It picked decoys from a gamma distribution meant to mimic real spending age, but it under-sampled very recent outputs. That mattered because a real spender who spends an output minutes after receiving it, which humans do more often than the model assumed, could be flagged: if your transaction includes an output that is hours old while the algorithm rarely picks decoys that fresh, analysts know the fresh one is probably the real spend. Monero fixed the underlying geometry issue in 2022 and improved selection again later, but the lesson stuck: a ring full of implausible decoys is worse than a smaller ring of plausible ones.
In 2024, Monero raised the minimum ring size to 16 via a hard fork, alongside Bulletproofs+ and view tags. Sixteen does not mean 45 percent more privacy than 11 in any linear sense. If decoy selection is good, 11 already makes naive tracing expensive. What 16 buys is headroom against clustering: an analyst who can rule out decoys, because they were provably unspent at signing time, or because their spending pattern is known, needs to eliminate more candidates before the real spend is exposed.
View tags are the quiet win. Before them, a wallet scanning incoming transactions had to try to match every output in every transaction with its private view key, which is expensive at scale. A view tag is one byte that lets a wallet skip about half the full checks for outputs that are not theirs. Scanning got roughly 30 percent faster. For privacy, faster scanning keeps running your own node cheap, and running your own node is still one of the biggest real-world privacy decisions you make with Monero.
What actually breaks ring signatures in practice is rarely the math. It is behavior on the edges:
- Spending immediately after receiving, at a fresher age than decoys plausibly appear, re-introduces the timing skew the algorithm tries to cover.
- Reusing a poisoned output. EAE attacks, where an exchange sees you receive, then sees a later spend that includes that output in the ring, narrow the odds even though they do not prove anything alone.
- Amount patterns. RingCT hides amounts, but if you sweep a dust deposit to the exact fraction of a unit and that output appears in your ring, the guess becomes easy.
- Remote node correlation. If you always broadcast through one third-party node and that node is watched, your transaction timing and IP sit next to each other in someone’s log.
A practical 2026 hygiene list follows directly: sweep small balances into fewer outputs rather than spending dust piecemeal, wait at least a few blocks before spending freshly received funds, use your own node or a rotation of remote nodes over Tor or an VPN alternative you trust, and stop worrying about ring size. You do not choose it. The protocol does.
The other thing worth knowing is what ring signatures do not do. They hide the sender among past outputs. They say nothing about the destination, which is handled by stealth addresses, one-time addresses derived per transaction so the receiver’s actual address never appears on chain. And they say nothing about amounts, which RingCT covers with Pedersen commitments. The three mechanisms are independent layers, and questions like “can Monero be traced” are really three separate questions with three separate answers.
Where this goes next: Seraphis is the long-term redesign of Monero’s proof system, replacing MLSAG ring signatures with a construction that supports much larger anonymity sets at comparable cost, plus better key management and simpler hardware wallet support. It is a protocol-level change years in the making, not a soft fork you will notice. When it lands, the ring size debate as we know it mostly dissolves, because the effective anonymity set stops being a handful of decoys and starts being a much larger structured set.
Until then, 16 plausible decoys plus sane spending behavior is a stronger position than most people assume. The chain looks like noise to anyone without side-channel data, and side-channel data is expensive to gather at scale. The realistic threat is not a mathematician defeating the ring. It is an exchange ledger, a KYC file, and a timing correlation. Guard those edges and the ring does its job.