admin Sixteen decoys or eleven. The change to Monero’s ring size in 2022 raised the same question for every user: is the difference measurable, or cosmetic. The honest answer has three parts, and the third part is the one most explanations skip.
The mechanics, briefly
When you spend Monero, your real output is signed alongside a set of decoy outputs drawn from the global output set. A ring of 16 means your real spend is hidden among 15 decoys; the old ring of 11 meant 10 decoys. An observer of the transaction can see all 16 key images and none of them is identifiable as the true spend. The security property is that the real output is indistinguishable from the decoys, and the practical strength of that property depends on how the decoys are chosen, not just how many exist.
Monero’s decoy selection is not uniform random. It is skewed toward outputs with a realistic age distribution, older outputs are picked more often than very fresh ones, because real people do not usually spend an output seconds after receiving it. This matters for the comparison: a ring of well chosen decoys is stronger than a larger ring of badly chosen ones.
Part one: what 16 buys over 11
For a single transaction considered in isolation, the probability that an observer guesses your real output drops from 1 in 11 to 1 in 16. In entropy terms the ring adds roughly 0.54 bits. That is a real improvement in the base guessing odds, and it compounds across the heuristic attacks described below. It does not double your privacy, and anyone selling it as a categorical change is overselling arithmetic.
Part two: where the extra decoys actually matter
The attacks ring size defends against are chaining attacks. If an adversary can guess which output in a ring is real with probability p, and your funds then move through a chain of transactions, the adversary’s confidence compounds. With p equal to 1 in 11, a chain of three transactions leaves the adversary with roughly 1 in 1331 confidence if each guess is independent. At 1 in 16, three hops give 1 in 4096. This is the context where the 2022 change earned its keep: EAE (enemy-analyzing-enemy) attacks and chain reaction attacks published in the years before the fork showed that chains of spent outputs could be pruned across transactions, and every additional ring member raises the cost of that pruning. The change also unified the effective anonymity set for two-output spends, which had been the weakest structural case.
Part three: the guessing an adversary actually does
Here is the part most comparisons omit. Nobody serious breaks Monero privacy by brute guessing a single ring. They use age. The real spend is frequently the newest output in the ring, because even with spend-time skew, the decoy distribution and real spending patterns do not perfectly align. Research measurements have repeatedly shown that age-based heuristics, picking the newest output, or weighting by output age, identify the real spend with probability well above 1 in 16, sometimes dramatically above. The ring size increase from 11 to 16 diluted that heuristic, since there are more old decoys to hide among, but it did not eliminate it.
The practical corollary: your behaviour moves the needle more than the protocol parameter. Churn patterns, spending soon after receiving, and consolidating many inputs into one transaction each leak timing structure that no ring size can paper over. A user with 11-decoy-era habits and clean behaviour retains more practical privacy than a 16-decoy user who consolidates their whole wallet in one sweep.
Practical numbers from the era of the change
For perspective on scale: at the time of the 2022 fork, Monero transactions were commonly built with 11 ring members, and the jump to 16 increased the anonymity set per input by roughly 45 percent. A two-input transaction, common when consolidating, now presented 32 candidate outputs rather than 22. Multi-input transactions are also where the weakest link lives: if two inputs in one transaction can be linked by timing or amount patterns, the effective anonymity set of the whole transaction drops toward that of its weakest input, no matter the ring size. This is the structural reason consolidation sweeps are discouraged for privacy, they multiply the linking surface.
There was also a transition cost. Outputs created under the old ring size remain in the global output set forever, and decoy selection draws from both eras. Early research on the transition noted a temporary fingerprinting risk, transactions whose decoy profile looked era-specific could in principle be dated, until the distribution of spent outputs smoothed out. Monero’s decoy algorithm was adjusted with this in mind, weighting selection to match real spend-age distributions rather than uniform coverage, which closed most of the gap.
What the numbers do not say
Ring size is one layer. Monero’s privacy also rests on stealth addresses, which break the address link, and RingCT, which hides amounts. Ring size only protects the input side of a transaction. The output side, where a fresh stealth address is generated per recipient, is where Monero is structurally strongest, and it is unaffected by ring size debates. It is also why on-chain analysis of Monero leans on timing and network-level observation rather than ring membership, an adversary watching the network layer is playing a different game entirely, which is the domain of Dandelion++ rather than ring signatures.
The verdict
Sixteen decoys over eleven is a genuine, quantified improvement in the exact attack class ring signatures exist to resist, output chaining. It was the correct change and arrived with broad community support. It is not a categorical leap, and it does not substitute for behavioural hygiene. Understand what the number protects, spend without obvious timing patterns, and the ring size does its job quietly underneath.