[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83183-en":3,"doc-seo-83183-105":29,"detail-sidebar-cat-0-en-105":82},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83183,2336464648746,"Skyler","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Deanonymizing Monero Transactions in Tor Network","Monero is a privacy-oriented cryptocurrency combining Dandelion++ transaction propagation with anonymity networks such as Tor and I2P to prevent adversaries from linking transactions to source IPs. This work shows that the Tor integration creates a key weakness: transactions originated by a Monero Tor node are initially forwarded only to two Tor hidden-service proxy nodes before clearnet diffusion. An adversary controlling outgoing connections can capture these transactions. A three-stage ProxyMark framework identifies node roles, originated transactions, and performs node location deanonymization, validated on live Tor, Monero mainnet, and testnet.","Deanonymizing Monero Transactions  \nin Tor Network  \nRuisheng Shi 1 , Shihan Zhang 1 , Yulian Ge 1 , Lina Lan 1 , Qingfeng Zhang 1 , Qin Wang2  \n1 Beijing University of Posts and Telecommunications | 2Independent  \narXiv :2607 .07062v 1 [ cs .CR] 8 Jul 2026  \nAbstract—Monero is a privacy-focused cryptocurrency that deploys the Dandelion++ protocol and incorporates anonymity networks (such as Tor and I2P) to prevent malicious attackers from linking transactions with their source IPs. In this paper, we demonstrate that Monero’s integration of the Tor network introduces a fundamental vulnerability: a Monero Tor node’s originated transactions are exclusively forwarded to two outgoing Tor hidden service nodes (proxy nodes) prior to clearnet propagation, enabling an adversary to capture originated transactions by occupying the target node’s outgoing connections. Based on this observation, we propose ProxyMark, a three-stage deanonymization framework for the Monero Tor network, comprising node role identification, originated transaction identification, and node location deanonymization. Through experiments on the live Tor network, Monero mainnet, and testnet, we empirically demonstrate the effectiveness of ProxyMark in successfully deanonymizing transactions originating from Monero nodes over Tor.  \nIndex Terms—Blockchain, Monero, Tor, Deanonymizing, P2P  \nI. INTRODUCTION  \nMonero is considered one of the most representative anonymous cryptocurrencies due to the application of multiple privacy-preserving technologies. As of April 15th, 2026, Monero’s market capitalization is $6.32 billion [2], ranking it first among privacy-focused cryptocurrencies. The privacy features of Monero have led to its widespread use in darknet markets, earning it the title of the king of darknet.  \nIn Monero peer-to-peer (P2P) network, transactions are forwarded by nodes to their neighbors after created, enabling all nodes in the P2P network to receive transactions. Deanonymisation attacks on the network layer aim to obtain source IPs of transactions by analyzing the propagation path of transactions in the P2P network. Existing research on networklayer transaction de-anonymization for cryptocurrencies [3],[4], [5], [6], [7], [8], [9] is mostly proposed for Bitcoin’s diffusion transaction propagation mechanism. However, since Monero uses a transaction propagation mechanism different from Bitcoin, existing research methods cannot successfully de-anonymize Monero transactions. It is necessary to propose a de-anonymization approach aiming at Monero transaction propagation mechanism.  \nMonero conceals the source IP address of transactions through Dandelion++ [10] and anonymity networks [11] . Dandelion++ divides transaction propagation into two phases: stem and fluff. In the stem phase, a node forwards a transaction to one randomly selected outgoing neighbor; after a random number of hops, the transaction enters the fluff phase and is  \nAn abstract version was published in WWW’24 workshop [1] .  \nbroadcast to all neighbors with random delays. An observer that receives the transaction cannot directly infer how many stem hops have already occurred.  \nMonero over Tor. Monero also supports routing P2P traffic through Tor and I2P. When Monero uses Tor, P2P messages are relayed through encrypted Tor circuits, hiding the node’s IP address from its Monero peers and hiding the communication relationship from local network observers. In practice, Monero over Tor creates two main types of participants. A Tor client node uses Tor to establish outbound connections and may connect either to clearnet public peers through Tor exits or to Monero hidden service peers inside Tor. A Monero Tor hidden service node publishes an onion address, accepts incoming Tor connections, and can also maintain outbound connections to public peers and hidden service peers.  \nThis distinction matters because Tor is not only a transport wrapper around the ordinary Monero P2P protocol. Monero treats","cbCaiv43ioqHprYH","https://ap.wps.com/l/cbCaiv43ioqHprYH","pdf",4707812,1,16,"English","en",105,"# Introduction\n## Monero and Dandelion++ Transaction Propagation\n## Monero Over Tor: Participants and Connection Roles\n## Intuition for Deanonymizing via Proxy Nodes","[{\"question\":\"How does the Tor participant distinction affect transaction forwarding and deanonymization?\",\"answer\":\"Monero distinguishes public peers and hidden-service peers for multiple protocol functions; hidden-service connections form a protected forwarding layer for Tor-originated transactions, while public peers are still needed for clearnet diffusion and synchronization, enabling role-dependent identifiers and forwarding paths to leak information.\"}]",1784185821,40,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":77,"head_meta":79,"extra_data":81,"updated_unix":27},"deanonymizing-monero-transactions-in-tor-network","",{"@graph":35,"@context":76},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/deanonymizing-monero-transactions-in-tor-network/83183/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70],{"name":71,"@type":72,"acceptedAnswer":73},"How does the Tor participant distinction affect transaction forwarding and deanonymization?","Question",{"text":74,"@type":75},"Monero distinguishes public peers and hidden-service peers for multiple protocol functions; hidden-service connections form a protected forwarding layer for Tor-originated transactions, while public peers are still needed for clearnet diffusion and synchronization, enabling role-dependent identifiers and forwarding paths to leak information.","Answer","https://schema.org",{"og:url":51,"og:type":78,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":80,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":83},[84,88,92,96,101,106,110,113,118,121,125],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":45,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":45,"category_name":108,"show_sort_weight":28,"slug":109},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":111,"slug":112},30,"research-report",{"id":114,"doc_module":4,"doc_module_name":45,"category_name":115,"show_sort_weight":116,"slug":117},9,"Religion & Spirituality",20,"religion-spirituality",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":119,"show_sort_weight":116,"slug":120},"World Cup","world-cup",{"id":122,"doc_module":4,"doc_module_name":45,"category_name":123,"show_sort_weight":122,"slug":124},10,"Lifestyle","lifestyle",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":127,"show_sort_weight":97,"slug":128},19,"General","general"]