Monero: Flaw exposes user anonymity for 3 years

Monero core developers have alerted the community. Ianonymous cryptocurrency had suffered from a breach for three years, with up to 6% of transactions affected. To the point of damaging the reputation that XMR enjoys with the community? Not so sure.

Monero, anonymity at all costs

Monero (XMR) is an iconic cryptocurrency in the ecosystem. Robustness, reliability and tamper-proof privacy These are the ingredients that make XMR a particularly popular currency with privacy advocates. Since 2014, Monero has placed anonymity at the heart of its project. To the point that Monero is sometimes considered the real bitcoin.
Indeed, this open source blockchain is truly anonymous. It is thus distinguished from bitcoin which is simply pseudonym. The Monero protocol allows hide the origin, amount and recipient of a transaction. A real nightmare for state authorities who fear that they will no longer be able to trace transactions. This is the case of France, which recently forced Binance to ban its nationals from accessing dozens of privacy corners, of which Monero is a part. A ban that does not prevent XMR from trading in peer to peer without going through exchanges.

Within the privacy corners, Monero is therefore a juggernaut. With such a reputation, the announcement of a breach of confidentiality is enough to waver the confidence of the community. And for good reason: some users sometimes risk their lives. This is the case in the most virulent dictatorships, such as in Afghanistan where the Taliban controls transactions. Unfortunately, even the most robust cryptographic protocols are not infallible.

Up to 6% of transactions affected

Thus, for three years, a flaw in the encryption system threatened Monero blockchain data. More specifically, the vulnerability affected the protocol that allows the “mixing” of addresses during a transaction (also called Ring CT). How Ring CT works is as follows: when you send your payment (input) to an address, your wallet consults the blockchain and selects 15 other random payments, then mixes them with your payment. Except that a bug in the code of selection was “jumping” transactions every 10 blocks. Result: a fraction of these transactions could be guessed.
SIf you are a Monero user, what shave the chances that you have a transaction directly affected by this bug? In practice, the total number of transactions affected by this bug would be 2 to 6% during the last years. However, it would seem that among this percentage, only XMR immediately retransferred to another address are affected. Thus, if you waited a few hours (at least 11 blocks) to retransfer an amount from your address, the bug remained without consequences. An anomaly that has since been corrected by the developers of Monero.

What future for Monero?

Admittedly, this security problem is far from calling into question everything. However, Monero’s popularity stems from its untraceable reputation. Thus, the slightest doubt about its security is enough to harm the image of XMR in a lasting way. Especially as this news comes on top of recent concerns about Monero Ordinals. As with bitcoin, this addition of metadata gives a broader cyber attack spectrum. What still fuel concern.

Because even if Monero is the absolute reference in terms of anonymity, its users cannot accept the slightest data breach. The recent privacy incident is a reminder that XMR is not foolproof. And that Monero may need a full security audit in the future to hope to survive.