Every Monero payment creates a second output nobody asked for: the change that returns to the sender when the amount you spend does not exactly match the outputs you own. Bitcoin inherited this design, and on Bitcoin the change output is a well-known weak point for chain analysis. Monero treats change differently, and the difference is worth understanding if you care about what your wallet reveals.
Why change exists at all
Monero amounts are encrypted and ring signatures spend outputs by reference, but the accounting rule is the same as any UTXO system: when you send 1.2 XMR from an output worth 5 XMR, the transaction spends the 5 XMR output and creates two new outputs, 1.2 XMR to the recipient and roughly 3.8 XMR back to you. That returning output is your change. Your balance is not stored anywhere; it is the sum of outputs your wallet can recognise as its own.
How a Monero wallet recognises its own money
This is where Monero departs from Bitcoin. Outputs sent to you are encrypted to a one-time public key derived from your address and a random sender-chosen value. Your wallet cannot see outputs on the chain that belong to it by looking for a repeating address, because no address ever appears on-chain. Instead the wallet scans every transaction and performs a computation against its two private keys, the view key and the spend key. The view key does the cheap work of identifying candidate outputs; the spend key confirms which of those the wallet can actually spend.
Change is handled through the same machinery. When your wallet builds a transaction, it generates a fresh one-time key for the change output just as the recipient’s sender generated one for the payment. The change output is indistinguishable, on the chain, from any other output.
Why this beats Bitcoin’s change problem
On Bitcoin, a transaction with two outputs invites the guess that the larger or the rounder one is the payment and the other is change, and address reuse over time makes those guesses firmer. Monero removes the grounds for the guess twice over. First, amounts are hidden by Pedersen commitments, so there is no round number to anchor on. Second, there is no address to cluster, because destination keys are one-time by construction. A change output and a payment output look structurally identical.
The practical consequence: change does not accumulate a history in the way Bitcoin change addresses do. A Monero output’s “history” is not traceable to prior outputs at all, which is the entire point of ring signatures. Each spend references a set of possible sources, and the true one is hidden among decoys, a mechanism we covered in detail in our ring signature explainer.
Where change still leaks, if you let it
None of this makes change automatically private. Wallet behaviour is the weak layer. If you send an amount almost exactly equal to one output you own, the change is tiny and the real spend is easy to infer despite the encryption, which is why modern wallets avoid dust change. If you send the same amount to the same recipient repeatedly, the pattern exists off-chain even though the on-chain data is opaque. And if you sweep a wallet to an exchange, the consolidation itself tells the exchange something about account structure, whatever the chain conceals.
Timing is the other leak. A transaction broadcast the moment funds arrive, in the amount received minus fees, reads as a forward regardless of what the cryptography says. Dandelion++ exists precisely to break the link between broadcast origin and IP address, and we describe it in our Dandelion++ article.
What this means for proving payment
The same one-time key structure that hides your change also gives you the proof tool. Because your wallet can identify its own outputs, it can generate a proof that a specific transaction paid a specific address, without revealing anything else. That is the basis of the payment proof procedure in our view key verification guide, and it works precisely because recognition is private to the key holder.
Practical habits
Keep change tidy by not creating it unnecessarily: batch related sends rather than dripping one output at a time. Let your wallet randomise where feasible. Avoid sweeping entire balances to services you do not trust. And if you run your own node so that scanning does not leak your activity to a third-party RPC server, you have closed the largest remaining side channel; our guide to running a Monero node in 2026 covers the realistic costs.
Two further points deserve mention. Multi-signature wallets extend the same recognition logic, with the difference that a change output may need several partial key images to assemble a valid spend, which is why multisig Monero remains an advanced, carefully tested configuration. And hardware wallets shift the private spend key off the computer, so output recognition is shared between the device’s secure element and the host software; the change mechanics are identical, but the confirmation step is physical, which is a genuine protection against a compromised host silently redirecting your change.
Change handling sounds like plumbing, and it is. But privacy failures are almost never failures of the cryptography. They are failures of the plumbing, made visible one output at a time.