Monero Transaction-Graph Heuristics in 2026: What Decoy-Selection Research Actually Shows

Monero’s decoy selection has always been the soft spot. Not the cryptography. The math behind ring signatures is solid. The problem is that the wallet has to pick 15 fake outputs to hide your real one, and if it picks badly, an analyst can sometimes guess which one is real. That is what decoy-selection research has been chipping away at for years, and the picture in 2026 is more nuanced than either the “Monero is untraceable” crowd or the “Monero is broken” crowd wants to admit.

What the rings actually are

A ring in Monero is not a group of people. It is a set of transaction outputs already sitting on the blockchain. When you spend, your wallet grabs your real output and mixes it with decoys pulled from historical outputs. The ring signature proves you control one of the 16 members without saying which. Since the protocol moved to a mandatory ring size of 16, that is 1 real output and 15 fakes per input, per the Monero documentation.

The decoys are not picked at random. The wallet uses a statistical distribution designed to mirror how outputs are actually spent on the network over time. This matters. If the wallet picked uniformly, an analyst could immediately discard old outputs as implausible and shrink the effective ring. The whole design goal is that every member of the ring looks equally likely to be the real spend.

That goal is what gets tested.

The 10 Block Decoy Bug, and why it still shows up in arguments

The most cited case is the so-called 10 Block Decoy Bug. As TRM researchers describe it in their traceability review, the flaw let investigators identify true spends with high accuracy because the decoy selection algorithm never picked outputs from the range of exactly ten blocks old, the shortest possible window for spending. So if a ring referenced an output that young, it was almost certainly the real one. No decoys could have been selected from that range.

The bug affected popular wallet implementations. It was patched in early 2023, which means it is useless against current transactions. If you see someone in 2026 leaning on the 10 Block bug to argue Monero is traceable, they are arguing about a historical dataset. Older transactions on the chain may still be exposed to that analysis. New ones are not.

This is the recurring pattern in this space. A weakness gets disclosed, gets patched, and the disclosure lives on in blog posts long after the code has moved on.

The Coinbase output heuristic

The other heuristic worth understanding is the Coinbase output heuristic. In any ring, some members may be outputs created by mining. Regular users almost never mine Monero. So an analyst can look at a ring, spot the mining-related outputs, and treat them as unlikely to be the real spend, effectively eliminating them as candidates.

It is not foolproof on its own. TRM’s review notes it works best when combined with other techniques. But it illustrates the general shape of the threat: the anonymity set is nominal, not real. Your ring says 16, but the effective anonymity set is whatever survives the heuristics an analyst can apply to that specific ring. If three members are mining outputs and one is ten blocks old, your 16 is really a much smaller number.

Which is why “effective ring size” is the only number that matters

The headline ring size is 16. The number that determines your actual privacy is the effective ring size, meaning the anonymity set left after heuristics. TRM’s review puts it plainly: even applying the publicly known heuristics, the effective anonymity set has still been growing over time as the protocol improves.

That is the part the traceability industry does not put in the press release. Individual heuristics can be highly reliable within their narrow applicability. But applicability is limited, and the protocol keeps closing the gaps the heuristics feed on.

There is also a broader class of attack that has nothing to do with decoy selection. Non-uniform decoy selection before 2018 was a real weakness, and analysts could predict true inputs by age or rank in the ring. That is history now, but it tells you something about how this research moves: the cryptographic layer holds, and the attacks keep coming at the wallet layer, the timing layer, and the metadata layer.

What the arrests actually show

People point to law enforcement successes as proof Monero is broken. Read the cases carefully and a different pattern shows up. In Finland, officers used infrastructure patterns to link Monero transactions to a hacker. In Japan, police tied XMR flows to 18 individuals laundering more than $670,000. In both cases, the tracing appears to lean on correlation and operational sloppiness rather than breaking the cryptography.

Chainalysis and similar vendors do not decrypt Monero. They look at timing, exchange deposit and withdrawal patterns, wallet fingerprints, reuse of infrastructure, and simultaneous transfers. They group activity and infer sources without touching the contents of the transactions. The cryptographic privacy holds; the human and network layer leaks.

Payment IDs, reused wallets, unprotected IP addresses, and high-frequency transfers to centralized exchanges are all metadata vectors that have nothing to do with rings. You can have a perfect 16-member ring and still hand an investigator everything they need by depositing to a KYC exchange at 2am from the same IP you used last week.

FCMP++ and the end of this entire argument

The fix that actually matters is FCMP++, Full-Chain Membership Proofs. Instead of picking a fixed ring of 15 decoys from a modeled distribution, FCMP++ would let a transaction prove membership across the entire set of unspent outputs on the chain.

If that lands, the anonymity set stops being 16 and stops being vulnerable to statistical decoy analysis entirely. There are no decoys to analyze because there is no small ring. The upgrade is under active development and expected in a future hard fork. Until it ships, every heuristic in this article remains a live question for the current chain.

I would not treat FCMP++ as a guarantee until it is merged and the cryptography has been stress-tested in the wild. Development roadmaps slip. But it is the direction of travel, and it is the only change that fundamentally closes the decoy-selection attack surface rather than patching individual leaks.

What this means if you actually care about the graph

The honest verdict: decoy-selection research has produced real, working heuristics, and they have real limits. The 10 Block bug is dead. The Coinbase heuristic works but only as one signal among many. Effective ring size is growing. The cryptographic core of Monero has held up under a decade of scrutiny.

What has not held up is layering. The people who get caught are not beaten by ring analysis. They are beaten by timing correlation between Monero and exchanges, by reused wallets, by infrastructure that links two supposedly separate identities. The transaction graph is only one of several graphs an investigator can build, and for most targets it is not the weakest one.

Transparency note: this is research writing for people studying privacy technology and its limits. Nothing here is a how-to, a recommendation, or a link to any live service. If you are building threat models, treat decoy selection as one component among many and stop treating any single ring size as a guarantee.