For eight years the ring signature behind every Monero transaction used eleven decoys: your real output was mixed with ten unrelated ones, and a spender could not be picked out. In 2025 the network upgraded to ring size 16. Fifteen decoys instead of ten sounds like a modest bump, a 45 per cent improvement, and it is tempting to file it under routine hardening. The real effect is larger and less intuitive, because anonymity set size is only half of what a ring signature buys. This article walks through what the extra five decoys actually change, and what they deliberately do not.
First, what a ring signature hides
When you spend a Monero output, the wallet constructs a ring containing your real output plus decoys chosen from the set of outputs already on the chain. The signature proves the spender owns exactly one member of the ring without revealing which. A watcher of the chain sees a set of sixteen candidate inputs and cannot identify the spender. The protection comes from two things: how many plausible candidates exist, and how plausible the real one looks among them. Ring size addresses the first. Denominations, output age selection and, increasingly, the EAE-style heuristics address the second. If you want the mechanics of the newer side of this, our comparison of ring size 16 versus 11 breaks the numbers down.
The arithmetic of exclusion
Here is the part most explanations skip. A ring signature does not need to identify you to hurt you; it needs to shrink the candidate set enough that statistical attacks become possible elsewhere. With ring size 11, a chain analyst who can rule out decoys, say a known spent output reappearing, a decoy selected from a poisoned distribution, gains proportionally more than with 16. Concretely: if an attacker can exclude 5 of the 15 decoys in a size-16 ring, the real output is one of 11 remaining. The same five exclusions against a size-11 ring leaves one of 6. Each exclusion is worth more when the ring is smaller, which is why the upgrade matters more than the raw count suggests. The safety margin compounds across chains of transactions, because Monero privacy analysis is rarely about one ring; it is about connecting them.
How much did the odds actually shift
Base guessing probability, ignoring all heuristics, moves from one in eleven, about 9.1 per cent, to one in sixteen, 6.25 per cent. That looks like a small step. But the meaningful metric for an analyst attempting mass clustering is expected work per correct guess across millions of transactions, and there the difference is substantial: every single ring on the chain became roughly 45 per cent harder to guess correctly, simultaneously. Mass surveillance budgets do not scale linearly with that kind of across-the-board cost increase, which is precisely the design intent. Monero’s developers were not chasing a headline number; they were raising the floor under every transaction at once.
Why decoy selection matters as much as ring size
A ring is only as good as its worst decoy. If your wallet picks decoys from a distribution that does not match how real spend outputs are actually distributed by age and amount, the real one can stand out statistically even inside sixteen candidates. This is why the upgrade to ring size 16 shipped alongside improvements to decoy selection algorithms that weight recent outputs more realistically. The two changes are a pair: more decoys give the selection algorithm more material to work with, and better selection makes each decoy more believable. A size-16 ring with badly chosen decoys can be weaker than a size-11 ring with well chosen ones, so if you see the ring size debate framed as pure arithmetic, something has been left out.
What ring size 16 does not fix
Be clear-eyed about the limits. Ring size does nothing about the timing correlation between your transaction’s appearance on the chain and network-level observers. It does not address amounts, which RingCT already hides, nor the one-time stealth addresses that protect recipients. It does not protect you from reusing views of your wallet carelessly; if you hand an auditor or a merchant a tool that misuses view keys, the ring signature was never the exposure. We covered the view key side separately in our article on view key safety and audits. Ring size 16 hardens one specific layer: input origin ambiguity at the protocol level.
The 0-decoy problem and why 16 was the chosen number
Research over the years repeatedly flagged a structural quirk: outputs with fewer than the full number of available decoys, famously very young outputs that could be spent immediately after creation in older versions of the protocol, produced rings where the real input was guessable at far better than base odds. The so-called 0-decoy or zero-mix problem taught the community that minimum-age rules and selection discipline matter as much as headline ring size. Ring size 16, together with a minimum decoy age of roughly ten blocks, closes most of the remaining windows where a ring could be anomalously weak. The number 16 itself was a balance: large enough to move mass analysis costs materially, small enough to keep transaction size and fees tolerable for everyday payments.
Practical implications for an ordinary user
Almost nothing, and that is by design. You do not choose your ring size; the wallet and the protocol do. What you can control: keep your wallet software current, because older wallets keep producing old-style transactions after awareness of a weakness has spread, and outdated selection logic is its own fingerprint. Avoid spending outputs immediately after they are received when you can afford to wait a few blocks. And do not export view keys or run custom tooling against your wallet without understanding what it exposes. For a fuller picture of how the pieces fit, the community maintains explanations alongside guides on change addresses and wallet behaviour that fill in the neighbouring mechanics.
The honest summary
Ring size 16 was not a dramatic rearchitecture; it was a deliberate raising of the floor. Every transaction on the network simultaneously became about 45 per cent more expensive to guess, the compounding margins against multi-ring analysis improved, and the upgrade shipped alongside decoy selection fixes that make the numbers real rather than nominal. What it does not do is substitute for operational hygiene. Use a current wallet, mind your view keys, and let the protocol handle the mathematics. The extra five decoys are doing quiet, thankless work on your behalf; your job is simply not to undercut them.